VulnSea

Tagged “nvd”

CVEs tagged nvd, newest first.

51023 CVEsRSS

CVE-2026-93903Critical· 9.4PoC
1mo ago

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."

▾ Abyssallitespeedtech · LiteSpeed Web ServerEPSS 0.35%via NVD
CVE-2026-86778Medium· 5.3
1mo ago

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc

Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11.

▾ SunlitMaksisoft Technology, IT, and Software Industry and Trade Inc. · Maksisoft GymEPSS 0.24%via NVD
CVE-2026-76504Critical· 9.8CISA KEV0dayPoC
1mo ago

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is …

▾ Hadalcisco · catalyst_sd-wan_managerEPSS 39%via NVD
CVE-2026-103117Medium· 4.7PoC
1mo ago

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3

A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/DatabaseInc.php of the component Save Data Handler. Such manipulation of the argument values lead…

▾ TwilightOS4ED · openSIS-ClassicEPSS 0.26%via NVD
CVE-2026-94078High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

▾ TwilightGemini Labs · site-reviewsEPSS 0.19%via NVD
CVE-2026-89238Critical· 9.1
1mo ago

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions …

WSS4J EncryptedHeader child confusion could promote an attacker-controlled plaintext element as the decrypted header, leading to incorrect confidentiality coverage and possible policy bypass. Users are recommended to upgrade to versions …

▾ Midnightapache · wss4jEPSS 0.33%via NVD
CVE-2026-103115Medium· 6.3PoC
1mo ago

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3

A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsFnc.php of the component Student Search. The manipulation of the argument cust results in sql inje…

▾ TwilightOS4ED · openSIS-ClassicEPSS 0.25%via NVD
CVE-2026-92121High· 7.5
1mo ago

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set

In the WSS4J streaming (StAX) code, a signature reference using the WS-Security STR-Transform leaves an internal "inside signed content" flag permanently set. The WS-SecurityPolicy enforcer uses that flag to decide whether an element nee…

▾ Twilightapache · wss4jEPSS 0.55%via NVD
CVE-2026-27371High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

▾ TwilightWPFunnels · wpfunnelsEPSS 0.18%via NVD
CVE-2026-27085Low· 2.7
1mo ago

Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions.

▾ SunlitBrainstorm Force · astraEPSS 0.23%via NVD
CVE-2026-62080Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.

Contributor Cross Site Scripting (XSS) in Happy Addons for Elementor <= 3.23.1 versions.

▾ SunlitLeevio · happy-elementor-addonsEPSS 0.17%via NVD
CVE-2026-62079Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

Contributor Cross Site Scripting (XSS) in Qi Addons For Elementor <= 1.11 versions.

▾ SunlitQode · qi-addons-for-elementorEPSS 0.17%via NVD
CVE-2026-62078Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

▾ SunlitLeap13 · premium-addons-for-elementorEPSS 0.16%via NVD
CVE-2026-93514High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5.2 versions.

▾ Twilightrainafarai · notification-for-telegramEPSS 0.18%via NVD
CVE-2026-93512High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

Unauthenticated Cross Site Scripting (XSS) in JW Player for WordPress <= 2.3.11 versions.

▾ TwilightilGhera · jw-player-7-for-wpEPSS 0.18%via NVD
CVE-2026-62081Medium· 5.4
1mo ago

Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

Contributor Insecure Direct Object References (IDOR) in Flexible PDF Coupons <= 1.14.11 versions.

▾ Sunlitwpdesk · flexible-couponsEPSS 0.21%via NVD
CVE-2026-93624High· 7.2
1mo ago

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

Shop manager PHP Object Injection in Music Player for WooCommerce <= 1.9.1 versions.

▾ Twilightcodepeople · music-player-for-woocommerceEPSS 0.36%via NVD
CVE-2026-93621High· 8.2
1mo ago

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

Unauthenticated SQL Injection in WP Data Access <= 5.5.84 versions.

▾ TwilightPassionate Programmer Peter · wp-data-accessEPSS 0.25%via NVD
CVE-2026-62085High· 7.6
1mo ago

Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

Administrator SQL Injection in WP Activity Log <= 5.6.6 versions.

▾ TwilightMelapress · wp-security-audit-logEPSS 0.31%via NVD
CVE-2026-62083Medium· 5.4
1mo ago

Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

Subscriber Other Vulnerability Type in Creator LMS <= 1.2.19 versions.

▾ SunlitWPFunnels · creatorlmsEPSS 0.23%via NVD
CVE-2026-94076High· 8.8
1mo ago

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

Contributor PHP Object Injection in SEO Plugin by Squirrly SEO <= 14.2.5 versions.

▾ TwilightSEO Squirrly · squirrly-seoEPSS 0.34%via NVD
CVE-2026-93770High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.13 versions.

▾ TwilightVeronaLabs · wp-statisticsEPSS 0.19%via NVD
CVE-2026-93651High· 7.2
1mo ago

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

Author PHP Object Injection in Minimum and Maximum Quantity for WooCommerce <= 2.1.2 versions.

▾ TwilightDotstore · min-and-max-quantity-for-woocommerceEPSS 0.36%via NVD
CVE-2026-94077Medium· 6.5
1mo ago

Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

Contributor Cross Site Scripting (XSS) in Safe SVG <= 2.5.0 versions.

▾ Sunlit10up · safe-svgEPSS 0.17%via NVD
CVE-2026-94074Medium· 6.5PoC
1mo ago

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

▾ TwilightNSquared · simply-schedule-appointmentsEPSS 0.25%via NVD
CVE-2026-93771High· 7.2
1mo ago

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

Shop manager PHP Object Injection in Cost of Goods for WooCommerce <= 3.5.2 versions.

▾ TwilightWPFactory · cost-of-goods-for-woocommerceEPSS 0.36%via NVD
CVE-2026-94115High· 8.5
1mo ago

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

Contributor SQL Injection in Easy Pricing Tables <= 4.1.2 versions.

▾ TwilightFatcatapps · easy-pricing-tablesEPSS 0.25%via NVD
CVE-2026-94082High· 7.6
1mo ago

Author SQL Injection in Quiz Cat <= 3.1.1 versions.

Author SQL Injection in Quiz Cat <= 3.1.1 versions.

▾ TwilightFatcatapps · quiz-catEPSS 0.27%via NVD
CVE-2026-94081High· 7.1
1mo ago

Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Persistent Login <= 3.1.3 versions.

▾ Twilightlukeseager · wp-persistent-loginEPSS 0.18%via NVD
CVE-2026-94173Medium· 5.4
1mo ago

Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

Contributor Insecure Direct Object References (IDOR) in Business Directory <= 6.4.27 versions.

▾ SunlitStrategy11 Team · business-directory-pluginEPSS 0.20%via NVD
CVEs tagged “nvd” — page 306 · VulnSea