cve.li

Recent

CVE-2026-67178CWE-601

Open Redirect in MISP Installer-Generated Apache Configuration

Published 2026-07-28 by CIRCL

CVE-2026-66299CWE-400

Apache Tomcat: DoS via WebSocket chat example

Published 2026-07-28 by apache

CVE-2026-63727CWE-648

Anchore Enterprise Privilege Escalation via User Management API

Published 2026-07-28 by VulnCheck

CVE-2026-8164CWE-427

Search Order Hijacking in ArkSigner's ArkSigner Desktop Client

Published 2026-07-28 by TR-CERT

CVE-2026-7521CWE-22

SAML certificate deletion allows path traversal to delete arbitrary files outside the config directory

Published 2026-07-28 by Mattermost

CVE-2026-67174CWE-79

DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick

Published 2026-07-28 by CIRCL

CVE-2026-66713CWE-502

Apache Axis2/Java: deserialization of untrusted Data

Published 2026-07-28 by apache

CVE-2026-59878CWE-20

Apache ActiveMQ AMQP, Apache ActiveMQ, Apache ActiveMQ All: AMQP NIO negative frame size validation bypass leading to DoS

Published 2026-07-28 by apache

CVE-2026-61487CWE-285

Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authorization bypass via temporary composite destinations

Published 2026-07-28 by apache

CVE-2026-67173CWE-918

Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests

Published 2026-07-28 by CIRCL

CVE-2026-66922CWE-1321

Pivotick Prototype-Key Collision in Tree Layout and Cycle Detection Allows Graph Manipulation and Denial of Service

Published 2026-07-28 by CIRCL

CVE-2026-66921CWE-79

Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References

Published 2026-07-28 by CIRCL

CVE-2026-66920CWE-674CWE-400

Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Published 2026-07-28 by CIRCL

CVE-2026-66919CWE-79

Stored DOM-Based Cross-Site Scripting in Node Modal Headers

Published 2026-07-28 by CIRCL

CVE-2026-18038CWE-200CWE-284

nextlevelbuilder GoClaw jq Handler tools_invoke.go ExecTool.Execute information disclosure

Published 2026-07-28 by VulDB

CVE-2026-18047CWE-288

Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash

Published 2026-07-28 by redhat

CVE-2026-66918CWE-79

DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons

Published 2026-07-28 by CIRCL

CVE-2026-65881CWE-1188CWE-200

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle < 3.1.1

Published 2026-07-28 by Joomla

CVE-2026-15393CWE-79

Cozy Blocks <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute

Published 2026-07-28 by Wordfence

CVE-2026-15016CWE-79

Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions <= 3.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published 2026-07-28 by Wordfence

CVE-2026-65882CWE-79

Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1

Published 2026-07-28 by Joomla

CVE-2026-62434

PoD: Don't try to reclaim special pages

Published 2026-07-28 by XEN

CVE-2026-62433

correct buffer checks for DM_OP hypercalls

Published 2026-07-28 by XEN

CVE-2026-62432

evtchn: Race between FIFO expand and reset

Published 2026-07-28 by XEN

CVE-2026-62431

Viridian STIMER division by zero

Published 2026-07-28 by XEN

CVE-2026-62430

x86: Out-of-bounds read in vRTC emulation

Published 2026-07-28 by XEN

CVE-2026-62429

vNUMA domain cleanup may race other operations

Published 2026-07-28 by XEN

CVE-2026-62436

grant-table: version change racing with other operations

Published 2026-07-28 by XEN

CVE-2026-62435

grant-table: version change racing with other operations

Published 2026-07-28 by XEN

CVE-2026-62428

grant-table: type confusion in grant-copy

Published 2026-07-28 by XEN

CVE-2026-62427

sysctl and platform-op locks open to abuse

Published 2026-07-28 by XEN

CVE-2026-62426

sysctl and platform-op locks open to abuse

Published 2026-07-28 by XEN

CVE-2026-62425

buffer overruns in libfsimage iso9660 handling

Published 2026-07-28 by XEN

CVE-2026-62424

buffer overruns in libfsimage iso9660 handling

Published 2026-07-28 by XEN

CVE-2026-62423

buffer overruns in libfsimage iso9660 handling

Published 2026-07-28 by XEN

CVE-2026-42495

buffer overruns in libfsimage iso9660 handling

Published 2026-07-28 by XEN

CVE-2026-42494

buffer overruns in libfsimage iso9660 handling

Published 2026-07-28 by XEN

CVE-2026-42492

vIRQ event channel binding may break Xenstore

Published 2026-07-28 by XEN

CVE-2026-42493

x86 shadow paging is deprecated

Published 2026-07-28 by XEN

CVE-2026-7187CWE-306

Improper Authentication in Universal Sotware's UKBS

Published 2026-07-28 by TR-CERT

CVE-2026-66913CWE-400

Zip Bomb in Lookyloo Capture Upload Allows Denial of Service

Published 2026-07-28 by CIRCL

CVE-2026-49332CWE-436

Openshift/oauth-proxy: openshift/oauth-proxy: underscore header smuggling enables identity impersonation on wsgi/php upstreams

Published 2026-07-28 by redhat

CVE-2026-41874CWE-256

Hard-coded admin credentials in Quick.Cart

Published 2026-07-28 by CERT-PL

CVE-2026-4648CWE-326

Insufficient Encryption Level in CasfID Servicios Tecnológicos NFC Wristbands

Published 2026-07-28 by INCIBE

CVE-2026-13110CWE-862

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via bogo_category_msg_create AJAX Action

Published 2026-07-28 by Wordfence

CVE-2026-15411CWE-862

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action

Published 2026-07-28 by Wordfence

CVE-2026-15444CWE-89

Tutor LMS <= 4.0.1 - Authenticated (Administrator+) SQL Injection via 'coupon_code' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-13440CWE-79

StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unauthenticated Stored Cross-Site Scripting via 'message_popup' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-16773CWE-200

WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action

Published 2026-07-28 by Wordfence

CVE-2026-16774CWE-862

WPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action

Published 2026-07-28 by Wordfence

CVE-2026-15025CWE-862

Uncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints

Published 2026-07-28 by Wordfence

CVE-2026-21047

Published 2026-07-28 by SamsungMobile

CVE-2026-63303CWE-23

Path Traversal in Quick.CMS

Published 2026-07-28 by CERT-PL

CVE-2026-63302CWE-98

Local File Inclusion in Quick.CMS

Published 2026-07-28 by CERT-PL

CVE-2026-63301CWE-602

Denial of Service in Quick.CMS

Published 2026-07-28 by CERT-PL

CVE-2026-18028CWE-639

Missing authorization check in event quick setup view

Published 2026-07-28 by rami.io

CVE-2026-18029CWE-841

Insufficient validation of payment status in pretix-girosolution

Published 2026-07-28 by rami.io

CVE-2026-65880CWE-94

Joomla Extension - joomshaper.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3

Published 2026-07-28 by Joomla

CVE-2026-17072CWE-125

Gstreamer1-plugins-good: gst-plugins-good: 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing flac codec data in matroska containers

Published 2026-07-28 by redhat

CVE-2026-65624CWE-770

Cowboy HTTP/1.1 max_headers Bypass via Duplicate Header Names Enables Memory Exhaustion

Published 2026-07-28 by EEF

CVE-2026-59248CWE-770

Unbounded HPACK/QPACK prefixed-integer decoding in Cowlib causes memory-exhaustion DoS

Published 2026-07-28 by EEF

CVE-2026-58246CWE-497

Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

Published 2026-07-28 by sap

CVE-2026-14785CWE-89

Web Directory Free <= 1.7.13 - Unauthenticated SQL Injection

Published 2026-07-28 by Wordfence

CVE-2026-11598CWE-79

Shortcodify <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute

Published 2026-07-28 by Wordfence

CVE-2026-14328CWE-269

Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

Published 2026-07-28 by Wordfence

CVE-2026-10207CWE-89

PickPlugins Question Answer <= 1.2.73 - Unauthenticated SQL Injection via 'id' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-16462CWE-89

SQL injection via unauthenticated GetGridData endpoint

Published 2026-07-28 by CERTVDE

CVE-2026-11841CWE-552

CVE-2026-11841

Published 2026-07-28 by SICK AG

CVE-2026-14171CWE-601

ads-tec Industrial IT: Post-login open redirect in the web interface

Published 2026-07-28 by CERTVDE

CVE-2026-14169CWE-696

ads-tec Industrial IT: Account lockout via non-atomic user creation

Published 2026-07-28 by CERTVDE

CVE-2026-14168CWE-862

ads-tec Industrial IT: Vertical privilege escalation via configuration table write

Published 2026-07-28 by CERTVDE

CVE-2026-14167CWE-863

ads-tec Industrial IT: Privilege escalation during configuration import

Published 2026-07-28 by CERTVDE

CVE-2026-9680CWE-1188

MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

Published 2026-07-28 by alibaba

CVE-2026-61376CWE-78

Published 2026-07-28 by jpcert

CVE-2026-59764CWE-78

Published 2026-07-28 by jpcert

CVE-2026-44387CWE-79

Published 2026-07-28 by jpcert

CVE-2026-12800CWE-89

Premium Packages <= 6.2.0 - Unauthenticated SQL Injection

Published 2026-07-28 by Wordfence

CVE-2026-13161CWE-89

TrueBooker <= 1.2.2 - Unauthenticated SQL Injection

Published 2026-07-28 by Wordfence

CVE-2026-15267CWE-89

Taskbuilder <= 5.0.9 - Authenticated (Subscriber+) SQL Injection

Published 2026-07-28 by Wordfence

CVE-2026-14516CWE-89

Online Scheduling and Appointment Booking System <= 27.5 - Unauthenticated SQL Injection

Published 2026-07-28 by Wordfence

CVE-2026-8167CWE-79

Reflected XSS in theWP's News Theme V8

Published 2026-07-28 by TR-CERT

CVE-2026-55977

Bypass of application rate-limiting mechanism

Published 2026-07-28 by CSA

CVE-2024-14041CWE-208

ML-KEM (Kyber) decapsulation leaks private key information through non-constant-time division in message decoding and ciphertext compression (KyberSlash)

Published 2026-07-28 by bcorg

CVE-2026-12741CWE-89

WP Fast Total Search <= 1.80.280 - Unauthenticated SQL Injection

Published 2026-07-28 by Wordfence

CVE-2026-11756CWE-502

Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x

Published 2026-07-28 by 3DS

CVE-2026-15730CWE-79

GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute

Published 2026-07-28 by Wordfence

CVE-2026-15673CWE-89

SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'checkout_payment_plans' and 'order_status' Settings

Published 2026-07-28 by Wordfence

CVE-2026-15670CWE-89

SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-15671CWE-89

SMS Alert <= 3.9.7 - Authenticated (Administrator+) SQL Injection via 'id' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-15014CWE-288

SMS Alert <= 3.9.7 - Unauthenticated Authentication Bypass to Account Takeover via 'billing_phone' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-14926

FluentCart < 1.4.0 - Subscriber+ Subscription Payment-Method Tampering via IDOR

Published 2026-07-28 by WPScan

CVE-2026-14924

Tablesome < 1.1.31 - Unauthenticated Post Creation and Modification

Published 2026-07-28 by WPScan

CVE-2026-14870

Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id

Published 2026-07-28 by WPScan

CVE-2026-14821

Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion

Published 2026-07-28 by WPScan

CVE-2026-14819

Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move

Published 2026-07-28 by WPScan

CVE-2026-14545

TrueBooker Appointment Booking < 1.2.4 - Unauthenticated Account Takeover via Password Reset

Published 2026-07-28 by WPScan

CVE-2026-16585CWE-22

Better Messages <= 2.15.19 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal via 'file' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-16811CWE-89

ShopLentor <= 3.4.5 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-16587CWE-862

Advanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function

Published 2026-07-28 by Wordfence

CVE-2026-15136CWE-352

Cookie Banner for GDPR / CCPA – WPLP Cookie Consent <= 4.3.7 - Cross-Site Request Forgery via Bulk Action to Delete/Resolve Entries

Published 2026-07-28 by Wordfence

CVE-2026-16797CWE-639

ShopLentor <= 3.4.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'optionSection' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-14490CWE-22

Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action

Published 2026-07-28 by Wordfence

CVE-2026-15012CWE-200

Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy

Published 2026-07-28 by Wordfence

CVE-2026-6251CWE-89

Chaty Pro <= 3.5.5 - Authenticated (Subscriber+) SQL Injection via 'widget_id' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-12124CWE-862

PDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter

Published 2026-07-28 by Wordfence

CVE-2026-17528CWE-79

Published 2026-07-28 by snyk

CVE-2026-17524CWE-22

Published 2026-07-28 by snyk

CVE-2026-51259

Published 2026-07-28 by mitre

CVE-2026-51261

Published 2026-07-28 by mitre

CVE-2026-51251

Published 2026-07-28 by mitre

CVE-2026-51254

Published 2026-07-28 by mitre

CVE-2026-51260

Published 2026-07-28 by mitre

CVE-2026-51252

Published 2026-07-28 by mitre

CVE-2026-65448CWE-79

WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65447CWE-79

WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65446CWE-79

WordPress Kali Forms plugin <= 2.4.18 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65445CWE-862

WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65443CWE-79

WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65442CWE-918

WordPress FormCraft plugin <= 3.9.15 - Server Side Request Forgery (SSRF) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65441CWE-79

WordPress GiveWP plugin <= 4.16.3 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65440CWE-79

WordPress GetGenie plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65439CWE-79

WordPress Ultimate Addons for Contact Form 7 plugin <=3.5.45 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65438CWE-79

WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.9 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-65437CWE-79

WordPress Spam protection, AntiSpam, FireWall by CleanTalk plugin <= 6.82 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-61957CWE-79

WordPress miniorange otp verification plugin <= 5.5.1 - Cross Site Scripting (XSS) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-61953CWE-918

WordPress Simple Link Directory Pro plugin <= 15.0.6 - Server Side Request Forgery (SSRF) vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-66473CWE-862

WordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability

Published 2026-07-27 by Patchstack

CVE-2026-53669CWE-601

React Router: Open redirect via backslash in <Link> and useNavigate (CVE-2025-68470 bypass)

Published 2026-07-27 by GitHub_M

CVE-2026-55685CWE-400CWE-407

React Router: Unauthenticated Denial of Service via Inefficient Route Matching

Published 2026-07-27 by GitHub_M

CVE-2026-53668CWE-601CWE-79

React Router: Open redirect can lead to XSS

Published 2026-07-27 by GitHub_M

Load more ↓