Tagged “nvd”
CVEs tagged nvd, newest first.
51020 CVEsRSS
CVE-2026-94390High· 7.2Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions.
CVE-2026-62073High· 7.5Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
CVE-2026-103752Critical· 9.8PoCUnauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions.
CVE-2026-97297High· 7.6Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.
Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.
CVE-2026-97260High· 7.1Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions.
CVE-2026-97258Medium· 6.5Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.
Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.
CVE-2026-97269Medium· 6.5Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions.
CVE-2026-97268High· 7.1Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
CVE-2026-100514High· 7.5Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.
Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions.
CVE-2026-97273High· 7.1Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions.
CVE-2026-100517High· 7.5Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Photo Reviews for WooCommerce <= 1.2.30 versions.
CVE-2026-97281Medium· 6.3Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.
CVE-2026-97277High· 7.6Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.
Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.
CVE-2026-103068High· 8.8Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.
Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions.
CVE-2026-97284High· 8.8Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
Contributor PHP Object Injection in Icegram <= 3.1.31 versions.
CVE-2026-102378High· 7.1Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions.
CVE-2026-103347Medium· 5.3Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.
Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions.
CVE-2026-79901Critical· 9.9In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp
In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a predictable pseudo-random sequence seeded with the current Unix timestamp. An attacker who knows t…
CVE-2026-103686Low· 3.5PoCA flaw has been found in rhukster dom-sanitizer up to 1.0.15
A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanitizer.php of the component URL Validation. This manipulation causes cross site scripting. It is po…
CVE-2026-66253Low· 3.1iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of …
iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session, enabling unauthorized access to the application and the ability to perform actions on behalf of …
CVE-2026-102505Medium· 6.3Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every …
Imager versions before 1.037 for Perl overflow a heap buffer fetching float samples from a paletted image in i_gsampf_fp. For a paletted image, getsamples() with type "float" allocates a buffer of one sample per pixel and fetches every …
CVE-2026-102504High· 7.5Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol. Nothing range-checks raw_datachannels. The line buffer is sized as the image width times the chann…
CVE-2026-66248Low· 3.1iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to p…
iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to p…
CVE-2026-66246High· 8.8iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modific…
iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or insecure direct object references (IDOR), enabling privilege escalation and the unauthorized modific…
CVE-2026-66247Medium· 4.3iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrat…
iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execute cross-origin requests with included credentials, enabling an attacker to access and exfiltrat…
CVE-2026-66249Low· 3.1iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as ses…
iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as ses…
CVE-2026-62063Medium· 5.4Missing Authorization vulnerability in Magepeople inc
Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.
CVE-2026-62061Medium· 5.3Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGr…
Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ProfileGr…
CVE-2026-62060High· 7.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2.
CVE-2026-62059High· 7.6PoCImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1.