Tagged “cve.org”
CVEs tagged cve.org, newest first.
46345 CVEsRSS
CVE-2026-119747High· 7.1GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API
The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method in includes/api/class-getpaid-rest-posts-controller.php maps REST operations to generic WordPress …
CVE-2026-18142High· 7.1IBM MQ is affected by a denial of service vulnerability
IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow a remote authenticated attacker to cause a denial of servic…
CVE-2026-122008Medium· 5.0Oqtane Framework before 10.3.0 SSRF via File Upload From URL
Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of FileController.cs that allows authenticated registered users to make the server fetch arbitrary URLs by supplying a caller-…
CVE-2026-93900Medium· 6.4Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the [gravity-simple-turnstile] shortcode in versions up to, and including, 1.44.3 This is due to ins…
CVE-2026-121941High· 7.8PoClibmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex
libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more t…
CVE-2026-120554High· 8.8Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()`…
CVE-2026-115498High· 7.2Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field
The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and ou…
CVE-2026-110935High· 8.4Path traversal in plug-in deployment
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an un…
CVE-2026-110022High· 8.4Signed plug-in validation bypass
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by th…
CVE-2026-110021Medium· 6.2Missing GSDX SignatureValue verification
PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `SignedInfo`. An unauthenticated local attacker can modify signed GSDML content, update its manifes…
CVE-2026-113371High· 7.1Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase
Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST endpoint, to a user account that holds only the read privilege for administering that repository. The account does not need …
CVE-2026-113368Medium· 5.3Nexus Repository 3 - Group Repository Member Authorization Bypass
Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the repository is added as a member of a group repository. A user account that has signed in with valid credentials and holds the …
CVE-2026-113370High· 7.7Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task
Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern" task. A user who holds the nexus:tasks:create privilege can supply a crafted filter condition that the database runs as…
CVE-2026-113369Medium· 6.3Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab
Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account that holds the edit permission on that repository) to store script content in the artifact type field of an OCI manifest…
CVE-2026-113374High· 8.6Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation
Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capability. A user who holds only the capability creation permission (nexus:capabilities:create) can create this capability, whic…
CVE-2026-113373Critical· 9.1Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again
Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML or OAuth2/OpenID Connect identity provider. A user whose account was disabled or locked by an administrator in Nexus R…
CVE-2026-113372High· 7.1Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key
Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds only the read privilege for administering that repository. The account does not need the privilege to edit the reposi…
CVE-2026-121817High· 7.5About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference
Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify specific parameters to access or operate other users' data and functions.
CVE-2026-121816High· 8.8About Time Technologies｜Herowatch Mini - Missing Authentication
Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources…
CVE-2026-121818High· 7.8About Time Technologies｜Herowatch Go - Security Misconfiguration
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute a…
CVE-2026-119366High· 7.1WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Stored XSS.This issue affects wpDiscuz: from n/a through 7.6.73.
CVE-2026-114456Medium· 6.5Missing origin validation for the externalbrowser authenticator callback in multiple Snowflake client drivers
Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener use…
CVE-2026-121925Medium· 6.6Buffer overflow in SAML authentication post-back URL handling in libsnowflakeclient and Snowflake PHP PDO Driver
A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions, result in memory corruption during SAML-based authentication. During a native SSO/SAML login flow, the affected driver…
CVE-2026-120421Medium· 6.1Reflected XSS via client window id in URL client window mode
In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client window mode is enabled (`jakarta.faces.CLIENT_WINDOW_MODE=url`), the client window id from the `jfwid` or `jakarta.fa…
CVE-2026-122118High· 7.4In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used
In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain unauthorized netw…
CVE-2026-122116Medium· 4.3Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function
Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authentication credentials to u…
CVE-2026-76806Medium· 6.3Solidtime: Path Traversal in Toggl ZIP Data Importer - arbitrary directory creation + filesystem existence oracle
Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without val…
CVE-2026-122192High· 7.5Guest access to Firecracker process memory after a failed memory discard
Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with root privileges to read or modify Firecracker VMM process memory via balloon or virtio-mem discard requests on microVM…
CVE-2026-121933Critical· 10.0Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication
A flaw has been found in Linksys E5350 1.0.00.037. This impacts the function save_settings of the file /wizard/apply.cgi of the component Setup Wizard. Executing a manipulation of the argument wizard_router_pwd can lead to missing authen…
CVE-2026-122054Medium· 5.9BIG-HKSCS decoding hang on crafted input
Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application t…