cve.li

Recent

CVE-2026-44612CWE-427

Published 2026-05-13 by jpcert

CVE-2025-11159CWE-1395

Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component

Published 2026-05-13 by HITVAN

CVE-2026-2725CWE-863

Improper Authorization in Gerrit allowing Code Review Bypass via "Submitted Together"

Published 2026-05-13 by Google

CVE-2026-6965CWE-639

Tutor LMS <= 3.9.9 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Post Deletion via 'course' GET Parameter

Published 2026-05-13 by Wordfence

CVE-2025-14033CWE-639

ilGhera Support System for WooCommerce <= 1.3.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure

Published 2026-05-13 by Wordfence

CVE-2026-6929CWE-89

JoomSport <= 5.7.7 - Unauthenticated SQL Injection via 'sortf' Parameter

Published 2026-05-13 by Wordfence

CVE-2026-32661CWE-121

Published 2026-05-13 by jpcert

CVE-2026-21024

Published 2026-05-13 by SamsungMobile

CVE-2026-21022

Published 2026-05-13 by SamsungMobile

CVE-2026-21021

Published 2026-05-13 by SamsungMobile

CVE-2026-21020

Published 2026-05-13 by SamsungMobile

CVE-2026-21019

Published 2026-05-13 by SamsungMobile

CVE-2026-21018

Published 2026-05-13 by SamsungMobile

CVE-2026-21016

Published 2026-05-13 by SamsungMobile

CVE-2026-21015

Published 2026-05-13 by SamsungMobile

CVE-2025-9989CWE-79

Broadstreet <= 1.53.1 - Authenticated (Admin+) Stored Cross-Site Scripting

Published 2026-05-13 by Wordfence

CVE-2026-7051CWE-862

Blog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter

Published 2026-05-13 by Wordfence

CVE-2026-6828CWE-79

Fluent Forms <= 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'permission_message' Shortcode Attribute

Published 2026-05-13 by Wordfence

CVE-2025-9987CWE-200

Broadstreet <= 1.53.1 - Authenticated (Subscriber+) Information Disclosure

Published 2026-05-13 by Wordfence

CVE-2026-6962CWE-79

Cost of Goods: Product Cost & Profit Calculator for WooCommerce <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published 2026-05-13 by Wordfence

CVE-2026-7619CWE-89

Charitable <= 1.8.10.4 - Authenticated (Custom+) SQL Injection via 's' Search Parameter

Published 2026-05-13 by Wordfence

CVE-2026-7635CWE-502

coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field

Published 2026-05-13 by Wordfence

CVE-2025-9988CWE-285

Broadstreet <= 1.53.1 - Missing Authorization to Authenticated (Subscriber+) Advertiser Creation

Published 2026-05-13 by Wordfence

CVE-2025-14755CWE-862

Cost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference

Published 2026-05-13 by Wordfence

CVE-2026-6888

SQL Injection Vulnerability

Published 2026-05-13 by CSA

CVE-2024-36315CWE-693

Published 2026-05-13 by AMD

CVE-2025-61972CWE-1233

Published 2026-05-13 by AMD

CVE-2025-61971CWE-1233

Published 2026-05-13 by AMD

CVE-2025-62627CWE-822

Published 2026-05-13 by AMD

CVE-2025-62624CWE-122

Published 2026-05-13 by AMD

CVE-2025-62623CWE-119

Published 2026-05-13 by AMD

CVE-2026-8202CWE-770

Post-authentication CPU utilization DoS via $trim/$ltrim/$rtrim operators

Published 2026-05-13 by mongodb

CVE-2026-8336CWE-416

Post-authentication use-after-free error in $_internalJsEmit and mapreduce commands

Published 2026-05-13 by mongodb

CVE-2026-8201CWE-416

Use-After-Free in MongoDB FLE Query Analysis When Processing Positional Projections on Encrypted Fields

Published 2026-05-13 by mongodb

CVE-2026-8200CWE-532

Schema validation log messages may not redact user data

Published 2026-05-13 by mongodb

CVE-2026-8199CWE-1325

Post-auth memory exhaustion via bitwise match expressions

Published 2026-05-13 by mongodb

CVE-2026-8053CWE-787

FlatBSON Duplicate Field Index Drift

Published 2026-05-12 by mongodb

CVE-2026-42158CWE-284

Flowsint: Broken Access Control allows modification of investigation metadata from any user

Published 2026-05-12 by GitHub_M

CVE-2026-42156CWE-943

Flowsint: Cypher query injection in node type on node creation

Published 2026-05-12 by GitHub_M

CVE-2026-42157CWE-79

Flowsint: Stored XSS on map node marker in map page

Published 2026-05-12 by GitHub_M

CVE-2026-44352CWE-284

Flowsint: Broken Access Control allows reading of sketch logs from any user

Published 2026-05-12 by GitHub_M

CVE-2026-44245CWE-79

Kyverno: [policy-reporter-ui] XSS via Stored Property Values in PropertyCard Component

Published 2026-05-12 by GitHub_M

CVE-2026-44347CWE-352

Warpgate: SSO CSRF -- State Token Not Validated on Return

Published 2026-05-12 by GitHub_M

CVE-2026-44341CWE-284CWE-639

GoJobs: Insecure Direct Object Reference (IDOR) in Job Retrieval Endpoint

Published 2026-05-12 by GitHub_M

CVE-2026-41901CWE-917CWE-1336

Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions

Published 2026-05-12 by GitHub_M

CVE-2026-44548CWE-352CWE-650

ChurchCRM: CSRF via legacy GET-delete pages (FundRaiserDelete.php, PropertyTypeDelete.php, NoteDelete.php)

Published 2026-05-12 by GitHub_M

CVE-2026-44547CWE-287CWE-304

ChurchCRM: Incomplete fix for CVE-2026-40582: public API login still bypasses 2FA and account lockout in ChurchCRM 7.2.2

Published 2026-05-12 by GitHub_M

CVE-2026-8108CWE-749

Fuji Electric Tellus Exposed Dangerous Method or Function

Published 2026-05-12 by icscert

CVE-2026-42288CWE-94

ChurchCRM: Incomplete fix for CVE-2026-39337: Unauthenticated RCE in Setup Wizard via unsanitized DB_PASSWORD

Published 2026-05-12 by GitHub_M

CVE-2026-43680

Published 2026-05-12 by apple

CVE-2026-43685

Published 2026-05-12 by apple

CVE-2025-15463CWE-94

Advanced Custom Fields: Extended <= 0.9.2.3 - Unauthenticated Arbitrary Shortcode Execution

Published 2026-05-12 by Wordfence

CVE-2026-1250CWE-89

Court Reservation – Manage Your Court Bookings Online <= 1.10.11 - Unauthenticated SQL Injection

Published 2026-05-12 by Wordfence

CVE-2026-5371CWE-862

MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset

Published 2026-05-12 by Wordfence

CVE-2026-42289CWE-269CWE-306CWE-352

ChurchCRM: Cross-Site Request Forgery (CSRF) Leading to Admin Privilege Escalation

Published 2026-05-12 by GitHub_M

CVE-2026-40863CWE-770

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Index in SpreadsheetML XML Reader

Published 2026-05-12 by GitHub_M

CVE-2026-40902CWE-770

PhpSpreadsheet: CPU Denial of Service via Unbounded Row Number in XLSX Row Dimensions

Published 2026-05-12 by GitHub_M

CVE-2026-42854CWE-121

arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE

Published 2026-05-12 by GitHub_M

CVE-2026-42855CWE-287

arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack

Published 2026-05-12 by GitHub_M

CVE-2026-44307CWE-22

Mako: Path traversal via backslash URI on Windows in TemplateLookup

Published 2026-05-12 by GitHub_M

CVE-2026-42545CWE-248CWE-755

Granian: DoS via WSGI response header panic

Published 2026-05-12 by GitHub_M

CVE-2026-42544CWE-20CWE-248CWE-400

Granian: Unauthenticated DoS via WebSocket subprotocol header panic

Published 2026-05-12 by GitHub_M

CVE-2026-42844CWE-434CWE-269

Grav: Low-privileged API users can create super-admin accounts via blueprint-upload

Published 2026-05-12 by GitHub_M

CVE-2026-42268CWE-191CWE-248

ModSecurity: Unsigned integer underflow in @verifySSN / @verifyCPF / @verifySVNR operators

Published 2026-05-12 by GitHub_M

CVE-2026-44301CWE-22

Hugo: Node tool execution allows file system access outside the project directory

Published 2026-05-12 by GitHub_M

CVE-2026-8449CWE-125

Linux ksmbd Remote Memory Corruption via ACL Inheritance

Published 2026-05-12 by VulnCheck

CVE-2026-44302CWE-835

Snappier: Infinite loop in SnappyStream decompression on malformed framed input

Published 2026-05-12 by GitHub_M

CVE-2026-44306CWE-204

Statamic: Email enumeration via forgot password endpoint

Published 2026-05-12 by GitHub_M

CVE-2026-44305CWE-295

Lemur: LDAP TLS certificate verification globally disabled enables credential interception

Published 2026-05-12 by GitHub_M

CVE-2026-44304CWE-90

Lemur: LDAP Filter Injection enables post-authentication privilege escalation

Published 2026-05-12 by GitHub_M

CVE-2026-41195CWE-918

mosparo: Rule package source URL stored SSRF enables internal HTTP probing

Published 2026-05-12 by GitHub_M

CVE-2026-44241CWE-400

Micronaut Framework: Unbounded formattersCache in TimeConverterRegistrar Allows Memory Exhaustion via Accept-Language Header

Published 2026-05-12 by GitHub_M

CVE-2026-45227CWE-693

Heym < 0.0.21 Sandbox Escape via Python Introspection

Published 2026-05-12 by VulnCheck

CVE-2026-44242CWE-400

Micronaut Framework: Unbounded bundleCache in ResourceBundleMessageSource Allows Memory Exhaustion via Accept-Language Header

Published 2026-05-12 by GitHub_M

CVE-2026-45226CWE-863

Heym < 0.0.21 Authorization Bypass in Workflow Execution

Published 2026-05-12 by VulnCheck

CVE-2026-44260CWE-863

efw4.X: readonly Flag Not Enforced Server-Side

Published 2026-05-12 by GitHub_M

CVE-2026-45225CWE-22

Heym < 0.0.21 Path Traversal File Upload via upload_file()

Published 2026-05-12 by VulnCheck

CVE-2026-44259CWE-80

efw4.X: Stored XSS via previewServlet

Published 2026-05-12 by GitHub_M

CVE-2026-44257CWE-77

efw4.X: RCE via zipslip

Published 2026-05-12 by GitHub_M

CVE-2026-44871

Authenticated Command Injection Vulnerabilities in Command Line Interface (CLI) Service Accessed by PAPI Protocol of AOS-8 and AOS-10 Operating Systems

Published 2026-05-12 by hpe

CVE-2026-44258CWE-78

efw4.X: Path Traversal via Unchecked dst Parameter leads to Remote Code Execution

Published 2026-05-12 by GitHub_M

CVE-2026-26289CWE-863

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

Published 2026-05-12 by icscert

CVE-2026-33570CWE-863

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

Published 2026-05-12 by icscert

CVE-2026-42196CWE-22CWE-26

django-s3file: Relative path traversal

Published 2026-05-12 by GitHub_M

CVE-2026-44262CWE-94

Scramble: Remote code execution via evaluation of user-controlled input in validation rules

Published 2026-05-12 by GitHub_M

CVE-2026-44296CWE-400CWE-405

Deskflow: TLS multiplexer DoS on failed `SSL_accept`

Published 2026-05-12 by GitHub_M

CVE-2026-44015CWE-918

Nginx UI: Server-Side Request Forgery (SSRF) via Cluster Proxy Middleware Allows Access to Internal Services

Published 2026-05-12 by GitHub_M

CVE-2026-35555CWE-863

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

Published 2026-05-12 by icscert

CVE-2026-43948CWE-863

wger: cross-tenant password reset and plaintext disclosure via gym=None bypass

Published 2026-05-12 by GitHub_M

CVE-2026-44403CWE-94

Wing FTP Server 8.1.2 Authenticated Remote Code Execution via Session Serialization

Published 2026-05-12 by VulnCheck

CVE-2026-44246CWE-1427

nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`

Published 2026-05-12 by GitHub_M

CVE-2026-44240CWE-400CWE-770

basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering

Published 2026-05-12 by GitHub_M

CVE-2026-44224CWE-269

Wiki.js: Privilege Escalation via Missing Group Validation in users.update

Published 2026-05-12 by GitHub_M

CVE-2026-44232CWE-791

dssrf: every IPv6 category bypasses is_url_safe

Published 2026-05-12 by GitHub_M

CVE-2025-65088CWE-125

Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

Published 2026-05-12 by icscert

CVE-2025-65087CWE-125

Out-of-bounds read in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

Published 2026-05-12 by icscert

CVE-2026-44011CWE-479

Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior

Published 2026-05-12 by GitHub_M

CVE-2025-65086CWE-787

Out-of-bounds write in Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, Cobalt Share

Published 2026-05-12 by icscert

CVE-2026-35504CWE-93

Subnet Solutions PowerSYSTEM Center CRLF injection

Published 2026-05-12 by icscert

CVE-2026-44012CWE-862

Craft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure

Published 2026-05-12 by GitHub_M

CVE-2026-44010CWE-862

Craft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure

Published 2026-05-12 by GitHub_M

CVE-2026-34672CWE-191

CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)

Published 2026-05-12 by adobe

CVE-2026-34671CWE-190

CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)

Published 2026-05-12 by adobe

CVE-2026-34669CWE-20

CAI Content Credentials | Improper Input Validation (CWE-20)

Published 2026-05-12 by adobe

CVE-2026-34678CWE-400

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

Published 2026-05-12 by adobe

CVE-2026-34688CWE-20

CAI Content Credentials | Improper Input Validation (CWE-20)

Published 2026-05-12 by adobe

CVE-2026-34680CWE-190

CAI Content Credentials | Integer Overflow or Wraparound (CWE-190)

Published 2026-05-12 by adobe

CVE-2026-34668CWE-20

CAI Content Credentials | Improper Input Validation (CWE-20)

Published 2026-05-12 by adobe

CVE-2026-34673CWE-400

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

Published 2026-05-12 by adobe

CVE-2026-34667CWE-191

CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)

Published 2026-05-12 by adobe

CVE-2026-34665CWE-400

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

Published 2026-05-12 by adobe

CVE-2026-34670CWE-20

CAI Content Credentials | Improper Input Validation (CWE-20)

Published 2026-05-12 by adobe

CVE-2026-34679CWE-20

CAI Content Credentials | Improper Input Validation (CWE-20)

Published 2026-05-12 by adobe

CVE-2026-34666CWE-20

CAI Content Credentials | Improper Input Validation (CWE-20)

Published 2026-05-12 by adobe

CVE-2026-34677CWE-400

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

Published 2026-05-12 by adobe

CVE-2026-44225CWE-22CWE-284

Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files

Published 2026-05-12 by GitHub_M

CVE-2026-44223CWE-131CWE-704

vLLM: extract_hidden_states speculative decoding crashes server on any request with penalty parameters

Published 2026-05-12 by GitHub_M

CVE-2026-44222CWE-129

vLLM: Remote DoS via Special-Token Placeholders

Published 2026-05-12 by GitHub_M

CVE-2026-44221CWE-863

ArcadeDB: Cross-database authorization bypass and unsecured newly-created databases

Published 2026-05-12 by GitHub_M

CVE-2026-44217CWE-93

sse-channel: SSE Injection via unsanitized event fields

Published 2026-05-12 by GitHub_M

CVE-2026-34656CWE-285

Adobe Commerce | Improper Authorization (CWE-285)

Published 2026-05-12 by adobe

CVE-2026-34658CWE-79

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Published 2026-05-12 by adobe

CVE-2026-34650CWE-400

Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

Published 2026-05-12 by adobe

CVE-2026-34686CWE-79

Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)

Published 2026-05-12 by adobe

CVE-2026-34647CWE-918

Adobe Commerce | Server-Side Request Forgery (SSRF) (CWE-918)

Published 2026-05-12 by adobe

CVE-2026-34685CWE-20

Adobe Commerce | Improper Input Validation (CWE-20)

Published 2026-05-12 by adobe

CVE-2026-34653CWE-22

Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Published 2026-05-12 by adobe

CVE-2026-34652CWE-1395

Adobe Commerce | Dependency on Vulnerable Third-Party Component (CWE-1395)

Published 2026-05-12 by adobe

CVE-2026-34645CWE-863

Adobe Commerce | Incorrect Authorization (CWE-863)

Published 2026-05-12 by adobe

CVE-2026-34648CWE-400

Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)

Published 2026-05-12 by adobe

Load more ↓