CVE-2026-62187 - OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-accoun

CVE-2026-62186 - OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible

CVE-2026-62185 - Argo CD Helm Chart before 10.0.0 fails to install network policies by default, allowing any pod on a

CVE-2026-62184 - luci-app-banip contains a log parsing vulnerability where the awk-based parser extracts the first IP

CVE-2026-61458 - PasswordPusher before 2.9.2 contains a brute-force vulnerability in the POST /p/:token/access endpoi

CVE-2026-59801 - 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote a

CVE-2026-58500 - MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on

CVE-2026-58488 - HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to

CVE-2026-58487 - HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to version 1

CVE-2026-58411 - ChurchCRM is an open-source church management system. Prior to version 7.4.0, Cross-Site Scripting (

CVE-2026-56877 - The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validat

CVE-2026-52533 - An issue in D-Link DIR-1253 v.1.0.1.250923.142435 allows an attacker to escalate privileges via the

CVE-2026-51821 - SQL Injection vulnerability in Shenzhou Shihan Video Conference System v.1.0 allows a remote attacke

CVE-2026-51541 - OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in CIP message parsing when handling m

CVE-2026-51540 - OpENer 2.3.0 (master branch up to commit 76b95cf) is vulnerable to a severe memory corruption issue

CVE-2026-51539 - A Denial of Service (DoS) vulnerability exists in the receive loop of libmodbus 3.1.12 when running

CVE-2026-51538 - EIPStackGroup OpENer 2.3.0 (commit 76b95cf) suffers from an Incorrect Access Control vulnerability i

CVE-2026-51537 - EIPStackGroup OpENer 2.3.0 (commit 76b95cf) has an out-of-bounds read issue in Connection Manager ha

CVE-2026-51536 - In OpENer 2.3.0 (commit 76b95cf) when parsing incoming CIP (Common Industrial Protocol) network pack

CVE-2026-39042 - An issue in MikroTIk (SIA Mikrotikls, Latvia) RouterOS 7.21.x before v.7.21.4 and 7.22.x before v.7.

CVE-2026-15685 - Ollama downloadBlob Improper Validation of Array Index Denial-of-Service Vulnerability. This vulnera

CVE-2026-15684 - Glarysoft Glary Utilities Link Following Local Privilege Escalation Vulnerability. This vulnerabilit

CVE-2026-15683 - Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulne

CVE-2026-15682 - AnyDesk Support Information Link Following Denial-of-Service Vulnerability. This vulnerability allow

CVE-2026-15681 - AnyDesk Screen Recording Link Following Denial-of-Service Vulnerability. This vulnerability allows l

CVE-2026-15680 - Lorex 2K Indoor Wi-Fi Security Camera CDeviceOperator Format String Remote Code Execution Vulnerabil

CVE-2026-15598 - A weakness has been identified in antv layout 2.0.0. This impacts the function setNestedValue in the

CVE-2026-15597 - A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0/2.php. T

CVE-2026-15596 - A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. The impacted

CVE-2026-58410 - ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authoriza

CVE-2026-58409 - ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated admin

CVE-2026-48364 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element

CVE-2026-48363 - ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Uncontrolled Search Path Element

CVE-2026-15595 - A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. The affected

CVE-2026-15594 - A vulnerability was found in waooAI waoowaoo up to 0.4.1. Impacted is the function stablePublicIdFro

CVE-2026-58408 - ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user

CVE-2026-58407 - Rejected reason: Please submit CVE requests for each vulnerability.

CVE-2026-55773 - CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained

CVE-2026-55771 - CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained

CVE-2026-12536 - The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the

CVE-2026-12385 - The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versi

CVE-2026-6875 - ServiceNow has addressed a remote code execution vulnerability that was identified in the ServiceNow

CVE-2026-58228 - Cross-site scripting vulnerability in phoenixframework phoenix_live_view allows an attacker to bypas

CVE-2026-55772 - CedarJava is an open source Java implementation of the Cedar policy language, used for fine-grained

CVE-2026-49972 - Laravel-Mediable before 7.0.0 contains a file upload vulnerability that allows unauthenticated attac

CVE-2026-49971 - Laravel-Mediable before 7.0.0 contains a stored cross-site scripting vulnerability that allows authe

CVE-2026-49970 - Laravel-Mediable before 7.0.0 contains a path traversal vulnerability in the File::sanitizePath() fu

CVE-2026-49969 - Laravel-Mediable before 7.0.0 contains a server-side request forgery vulnerability that allows remot

CVE-2026-26396 - OpenBMB XAgent v1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XA

CVE-2026-14906 - Pages with malicious titles could potentially allow saved PDF content to overwrite PDF files or bund

CVE-2025-45869 - LogicalDOC Enterprise Version up to and before v9.1.1 is vulnerable to Server-Side Request Forgery (

CVE-2026-61505 - Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a

CVE-2026-61504 - Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and

CVE-2026-61503 - Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depen

CVE-2026-61502 - Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts G

CVE-2026-61501 - Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sani

CVE-2026-61500 - Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Ma

CVE-2026-61463 - Shiori contains a privilege escalation vulnerability in the account update endpoint that allows auth

CVE-2026-61462 - mcp-gitlab contains a path traversal vulnerability in the job_id parameter of build/index.js that al

CVE-2026-60103 - Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to tr

CVE-2026-53365 - In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: fix zerocopy comp

CVE-2026-53364 - In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory

CVE-2026-57433 - Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted S

CVE-2026-57432 - Perl versions through 5.43.10 have an integer overflow in S_measure_struct leading to an out-of-boun

CVE-2026-13221 - Perl versions through 5.43.9 produce silently incorrect regular expression matches when an alternati

CVE-2026-61692 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-61454. Reason:

CVE-2026-59245 - In the Apache Airflow FAB auth manager, a DAG whose `dag_id` is `DAGs` collided with the global all-

CVE-2026-58065 - The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by

CVE-2026-6847 - Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a cri

CVE-2026-61498 - Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj

CVE-2026-60121 - Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/aj

CVE-2026-40553 - Buffer overflow vulnerability has been found in "extension/readdir.c" program file of gawk (ftype() 

CVE-2026-40469 - Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine)

CVE-2026-40468 - Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may le

CVE-2026-40467 - Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routi

CVE-2026-15584 - A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool

CVE-2026-15559 - A vulnerability was detected in CodeAstro Simple Online Leave Management System 1.0. This affects an

CVE-2026-62147 - The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on so

CVE-2026-15558 - A security vulnerability has been detected in CodeAstro Simple Online Leave Management System 1.0. A

CVE-2026-12257 - Versions of Mura CMS prior to 10.0.712 contain a critical remote code execution (RCE) vulnerability.

CVE-2026-9824 - Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage

CVE-2026-9820 - Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by

CVE-2026-6541 - Mattermost versions 11.7.x <= 11.7.1, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict metric

CVE-2026-4765 - Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability

CVE-2026-14934 - A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQu

CVE-2026-61985 - Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows E

CVE-2026-61983 - Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorr

CVE-2026-61977 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblo

CVE-2026-61976 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblo

CVE-2026-61975 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblo

CVE-2026-61971 - Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture me

CVE-2026-61970 - Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbna

CVE-2026-61968 - Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Config

CVE-2026-61958 - Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-fo

CVE-2026-61956 - Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام &#8211; همگام سازی ووکامرس و باسل

CVE-2026-61955 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-61952 - Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor wo

CVE-2026-59523 - Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appoint

CVE-2026-59521 - Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC Real Testimonials testimonial-fr

CVE-2026-59518 - Deserialization of Untrusted Data vulnerability in wpWax Directorist directorist allows Object Injec

CVE-2026-59516 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-59515 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57816 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57815 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU

CVE-2026-57814 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57813 - Incorrect Privilege Assignment vulnerability in properfraction MailOptin mailoptin allows Privilege

CVE-2026-57812 - Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appoint

CVE-2026-57811 - Improper Control of Generation of Code ('Code Injection') vulnerability in Realtyna Realtyna Organic

CVE-2026-57810 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57805 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57804 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57803 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57802 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57801 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57800 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57799 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57798 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57797 - Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Confi

CVE-2026-57796 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57795 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57794 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57793 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57792 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57791 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57790 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57789 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57788 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57787 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57786 - Cross-Site Request Forgery (CSRF) vulnerability in purethemes WorkScout-Core workscout-core allows A

CVE-2026-57783 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57782 - Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiti

CVE-2026-57781 - Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Co

CVE-2026-57780 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57779 - Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly C

CVE-2026-57778 - Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking

CVE-2026-57776 - Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly

CVE-2026-57774 - Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Inco

CVE-2026-57773 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57772 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57771 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57770 - Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Photography grandphotography all

CVE-2026-57768 - Incorrect Privilege Assignment vulnerability in favethemes Houzez Login Register houzez-login-regist

CVE-2026-57745 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57744 - Deserialization of Untrusted Data vulnerability in stmcan RT-Theme 18 | Extensions rt18-extensions a

CVE-2026-57743 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-57741 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57740 - Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymail

CVE-2026-57739 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57738 - Deserialization of Untrusted Data vulnerability in axiomthemes 777 triple-seven allows Object Inject

CVE-2026-57734 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57733 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57732 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57729 - Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Con

CVE-2026-57728 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57727 - Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured

CVE-2026-57726 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57725 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57724 - Deserialization of Untrusted Data vulnerability in Themeum Kirki kirki allows Object Injection.This

CVE-2026-57719 - Unrestricted Upload of File with Dangerous Type vulnerability in CodeRevolution Aimogen Pro aimogen-

CVE-2026-57718 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57715 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57714 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57713 - Deserialization of Untrusted Data vulnerability in Marcus (aka @msykes) Events Manager events-manage

CVE-2026-57712 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57711 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57710 - Unrestricted Upload of File with Dangerous Type vulnerability in quantumcloud WoowBot Pro Max woowbo

CVE-2026-57709 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP S

CVE-2026-57708 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57707 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57706 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57705 - Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorre

CVE-2026-57702 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57698 - Authentication Bypass Using an Alternate Path or Channel vulnerability in VillaTheme Abandoned Cart

CVE-2026-57697 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Metagauss ProfileGrid pro

CVE-2026-57695 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57694 - Authorization Bypass Through User-Controlled Key vulnerability in Themeum Tutor LMS tutor allows Exp

CVE-2026-57693 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57691 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57668 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57424 - Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerc

CVE-2026-57423 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57422 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57421 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57420 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57419 - Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations

CVE-2026-57418 - Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices

CVE-2026-57417 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57416 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57415 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57414 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57413 - Server-Side Request Forgery (SSRF) vulnerability in bdthemes Instant Image Generator ai-image allows

CVE-2026-57412 - Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Inc

CVE-2026-57411 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57410 - Incorrect Privilege Assignment vulnerability in MailerPress Team MailerPress mailerpress allows Priv

CVE-2026-57409 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57408 - Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gatewa

CVE-2026-57407 - Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-genera

CVE-2026-57406 - Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting I

CVE-2026-57405 - Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly C

CVE-2026-57404 - Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-

CVE-2026-57403 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57402 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57401 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Brai

CVE-2026-57400 - Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets

CVE-2026-57399 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57398 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57396 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57395 - Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Config

CVE-2026-57394 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57393 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EDGARROJ

CVE-2026-57392 - Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Config

CVE-2026-57391 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57390 - Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce addi

CVE-2026-57389 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adri

CVE-2026-57388 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57387 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57386 - Incorrect Privilege Assignment vulnerability in Kodezen LLC aBlocks ablocks allows Privilege Escalat

CVE-2026-57385 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-57383 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57382 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57381 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57380 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57379 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57378 - Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting In

CVE-2026-57377 - Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly

CVE-2026-57376 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57375 - Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrect

CVE-2026-57372 - Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server S

CVE-2026-57371 - Deserialization of Untrusted Data vulnerability in denishua WPJAM Basic wpjam-basic allows Object In

CVE-2026-57369 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57368 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57365 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-57364 - Improper Validation of Specified Quantity in Input vulnerability in WPDeveloper Better Payment – Ins

CVE-2026-57363 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-49876 - Authenticated SSRF in Gravitino JobManager allows server-side HTTP requests to internal network and

CVE-2026-41041 - URL path injection via unencoded user-supplied identifiers vulnerability in Apache Gravitino. This

CVE-2026-22103 - The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

CVE-2026-22102 - A POST request sent to a specific webserver endpoint can be used to write to arbitrary file location

CVE-2026-22100 - The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the

CVE-2026-22099 - The charging station does not require authentication for Bluetooth commands to perform actions. The

CVE-2026-22098 - Various sensitive information such as passwords and charging card UIDs are written to log files.

CVE-2026-22097 - The firmware update mechanism does not include cryptographic signature validation. This allows anyon

CVE-2026-22096 - The webserver running on port 8090 does not require authentication. This allows for sensitive inform

CVE-2026-22095 - The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

CVE-2026-22093 - The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the ce

CVE-2026-15557 - A weakness has been identified in waooAI waoowaoo up to 0.4.1. Affected by this vulnerability is the

CVE-2026-15548 - A security vulnerability has been detected in Shibby Tomato up to 1.28.0000. This vulnerability affe

CVE-2026-14846 - In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of e

CVE-2026-13014 - A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated

CVE-2026-9708 - Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to validate that an