Tagged “nvd”
CVEs tagged nvd, newest first.
51020 CVEsRSS
CVE-2026-97302Medium· 5.3Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions.
CVE-2026-97301Medium· 6.5Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
CVE-2026-100508Medium· 5.3Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.
Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions.
CVE-2026-102384Medium· 5.9Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.
Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions.
CVE-2026-100513Medium· 6.5Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
Contributor Cross Site Scripting (XSS) in CF7 Views – Complete Entry Management for Contact Form 7 <= 3.2.5 versions.
CVE-2026-100507High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Persona…
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Persona…
CVE-2026-102386Medium· 6.5Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions.
CVE-2026-102385High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions.
CVE-2026-102398High· 7.1Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions.
CVE-2026-102395High· 7.1Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions.
CVE-2026-102399Medium· 5.4Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions.
CVE-2026-102396High· 7.1Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions.
CVE-2026-97253High· 7.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
CVE-2026-95587High· 7.5Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
CVE-2026-97235High· 7.1Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-96450Medium· 5.4Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
Contributor Cross Site Scripting (XSS) in pixfort Core < 4.3.3 versions.
CVE-2026-97237High· 7.1Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
CVE-2026-97236Medium· 6.5Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-97238Medium· 5.5Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
CVE-2026-95616High· 7.5An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation
An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP message carrying an X.509 certificate whose SubjectKeyIdentifier extension declares a length of 0x7…
CVE-2026-103321High· 8.3MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation
MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was accepted and stored without server-side validation. On the client side, the stored value was render…
CVE-2026-92899Medium· 4.8Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused
Apache WSS4J remembers the Nonce of each UsernameToken it accepts, so a captured token cannot be reused. It stored the Nonce as raw base64 text, but authentication decodes that text and uses the bytes.The same bytes can be written as bas…
CVE-2026-74865Critical· 9.2sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication
sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic authentication. An unauthenticated attacker who provides the username of an existing user and any arb…
CVE-2026-103116Medium· 6.3PoCA weakness has been identified in OS4ED openSIS-Classic up to 9.3
A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LO_sort causes …
CVE-2026-74864Critical· 9.3sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any cl…
sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a verified user without performing password validation. Since Nginx does not strip this header, any cl…
CVE-2026-103114Medium· 6.3PoCA vulnerability was identified in OS4ED openSIS-Classic up to 9.3
A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modules/grades/Assignments.php of the component Assignment Management Endpoint. The manipulation of th…
CVE-2026-10726Medium· 6.8Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability
Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the Windows service, running as Local System, to read and disclose arbitrary local files due to impr…
CVE-2026-103012Low· 2.0Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-man…
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-man…
CVE-2026-10739High· 8.5Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validation of a client-supplied SID over a local IPC named pipe.
CVE-2026-62146High· 7.8PoCA trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbo…
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbo…