Tagged “nvd”
CVEs tagged nvd, newest first.
51020 CVEsRSS
CVE-2026-108606Medium· 5.4PoCJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded …
CVE-2026-108605Medium· 4.3PoCJeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/…
CVE-2026-97853Medium· 6.9Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) …
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) …
CVE-2026-81797Critical· 9.8Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.
CVE-2026-78535Critical· 9.8Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.
CVE-2026-78534High· 7.1Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
CVE-2026-78533Critical· 9.8Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.
CVE-2026-78532High· 7.1Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-78531Critical· 9.8Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.
CVE-2026-78530High· 7.7Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
CVE-2026-78529Critical· 9.8Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.
CVE-2026-66569Critical· 9.8Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.
CVE-2026-66568Critical· 9.8Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.
CVE-2026-66567Critical· 9.8Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.
CVE-2026-66566High· 8.1Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
CVE-2026-66565Critical· 9.8Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.
CVE-2026-66564Critical· 9.8Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.
CVE-2026-66563Critical· 9.8Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.
CVE-2026-66483Critical· 9.8Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.
CVE-2026-66482Critical· 9.8Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.
CVE-2026-66481Medium· 6.8Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.
Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.
CVE-2026-66480Medium· 5.3Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a thr…
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a thr…
CVE-2026-65459High· 7.5Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
CVE-2026-62130High· 7.2Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
CVE-2026-62129Critical· 9.9Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.
CVE-2026-62125Critical· 9.8Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.
CVE-2026-62124Critical· 9.8Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.
CVE-2026-62123Critical· 9.8Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.
CVE-2026-62120Critical· 9.8Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.
CVE-2026-62118High· 7.3Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.