CVE-2026-21130 - Improper input validation in CreditCardRetrieveActivity of Samsung Checkout prior to version 5.1.03.

CVE-2026-21129 - Improper input validation in GuestCreditCardRegisterActivity of Samsung Checkout prior to version 5.

CVE-2026-21128 - Improper input validation in CreditCardRegisterActivity of Samsung Checkout prior to version 5.1.03.

CVE-2026-21127 - Improper export of android application components in Samsung Account prior to version 15.7.01.1 allo

CVE-2026-21126 - Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR O

CVE-2026-21125 - Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-20

CVE-2026-21124 - Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR O

CVE-2026-21123 - Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privilege

CVE-2026-21122 - Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to ex

CVE-2026-21121 - Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local

CVE-2026-21120 - Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially

CVE-2026-21119 - Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows

CVE-2026-21118 - Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers t

CVE-2026-21117 - Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers

CVE-2026-21116 - Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to

CVE-2026-21115 - Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attacke

CVE-2026-21114 - Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to

CVE-2026-108801 - A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element i

CVE-2026-108800 - A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown func

CVE-2026-108799 - A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacte

CVE-2026-108798 - A vulnerability was found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This issue affects some unkno

CVE-2026-108797 - A vulnerability has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This vulnerability affec

CVE-2026-108796 - A flaw has been found in ZKTeco BioTime 9.5.6 Build 20260130.3206. This affects an unknown part of t

CVE-2026-108795 - A vulnerability was detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this issue is

CVE-2026-108985 - ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs

CVE-2026-108982 - VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It d

CVE-2026-108981 - ngx_cache_purge before 3.0.4 can allow file deletion via a symlink attack in certain situations wher

CVE-2026-108794 - A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by

CVE-2026-108791 - A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab.

CVE-2026-108790 - A security flaw has been discovered in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc

CVE-2026-108789 - A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the fu

CVE-2026-107437 - GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application compo

CVE-2026-87765 - In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corrupt

CVE-2026-66086 - In the modem OTA stack, there is a possible stack-based buffer overflow due to improper validation o

CVE-2026-66085 - In modem, there is a possible information disclosure due to missing filtering of sensitive data in c

CVE-2026-108980 - Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugi

CVE-2026-108788 - A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2. The impacted elemen

CVE-2026-108787 - A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the

CVE-2026-108786 - A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5. Impacted is the function r

CVE-2026-108785 - A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.r

CVE-2026-108784 - A vulnerability was detected in macrozheng mall up to 1.0.3. This vulnerability affects the function

CVE-2026-108783 - A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affe

CVE-2026-108782 - A weakness has been identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this issue is

CVE-2026-108781 - A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vuln

CVE-2026-108779 - A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function W

CVE-2026-108778 - A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function

CVE-2026-108777 - A vulnerability was found in erzhongxmu JEEWMS up to 2026.09.27-W39. This affects the function WvGiC

CVE-2026-108775 - A vulnerability has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The impacted element is th

CVE-2026-108774 - A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the functio

CVE-2026-108773 - A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function doc

CVE-2026-108772 - A security vulnerability has been detected in bleenco abstruse up to 2.1.0. This issue affects the f

CVE-2026-108770 - A weakness has been identified in Appwrite up to 2.3.0. This vulnerability affects the function Publ

CVE-2026-104703 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-108978 - Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows Buffer Overflow via En

CVE-2026-108769 - A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part o

CVE-2026-108976 - GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because t

CVE-2026-108963 - databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., maria

CVE-2026-108925 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohes

CVE-2026-108768 - A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the funct

CVE-2026-59508 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-19935 - The Bluetooth LE host queues received L2CAP connection-oriented channel (CoC) data for deferred proc

CVE-2026-19740 - The Link Layer Control Procedure (LLCP) implementation of the Zephyr software Bluetooth LE Controlle

CVE-2026-19739 - The Bluetooth Link Layer control procedure code in subsys/bluetooth/controller/ll_sw/ull_llcp_conn_u

CVE-2026-19738 - The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (C

CVE-2026-19737 - i2s_esp32_trigger_check() in drivers/i2s/i2s_esp32.c validates the requested direction only for I2S_

CVE-2026-19736 - The NXP MCUX TRNG entropy driver in drivers/entropy/entropy_mcux_trng.c passed the caller's byte cou

CVE-2026-19735 - The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN fro

CVE-2026-19669 - The user-mode syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() in d

CVE-2026-19577 - net_route_ipv6_packet() in subsys/net/ip/route_ipv6.c resolved the nexthop's link-layer address with

CVE-2026-19576 - The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the co

CVE-2026-18418 - The zbus proxy agent IPC backend in subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c logged the channe

CVE-2026-108913 - omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because th

CVE-2026-107761 - Several Postiz endpoints return the complete database row of the record they operate on instead of o

CVE-2026-108905 - pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool

CVE-2026-108904 - pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability th

CVE-2026-108903 - pH7Builder (pH7 Social Dating CMS) before 19.3.0 contains a CAPTCHA bypass vulnerability that allows

CVE-2026-108902 - pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the pict

CVE-2026-108891 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getU

CVE-2026-108888 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleControlle

CVE-2026-108887 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController e

CVE-2026-108886 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController quer

CVE-2026-108885 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController d

CVE-2026-108884 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateCont

CVE-2026-108883 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig han

CVE-2026-108882 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController

CVE-2026-108881 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo hand

CVE-2026-108880 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDict

CVE-2026-108879 - JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiCo

CVE-2026-108878 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController que

CVE-2026-108877 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController tha

CVE-2026-108876 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler

CVE-2026-108875 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addS

CVE-2026-108874 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated

CVE-2026-108873 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108872 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler

CVE-2026-108871 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler o

CVE-2026-108870 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController save

CVE-2026-108869 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged au

CVE-2026-108868 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated

CVE-2026-108867 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController ge

CVE-2026-108866 - JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated use

CVE-2026-108684 - A vulnerability was detected in erzhongxmu Jeewms up to 3.7. This affects the function getTreeData o

CVE-2026-108683 - A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is

CVE-2026-108682 - A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the functio

CVE-2026-108865 - AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthentica

CVE-2026-108864 - iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that a

CVE-2026-108863 - Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenti

CVE-2026-108862 - APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows au

CVE-2026-108861 - Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP client

CVE-2026-108860 - BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated r

CVE-2026-108859 - mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP th

CVE-2026-108858 - Predibase LoRAX through 0.12.1 contains a sensitive information exposure vulnerability that writes t

CVE-2026-108857 - Hugging Face Text Embeddings Inference through 1.9.4 contains a cleartext logging vulnerability that

CVE-2026-108856 - UnicomAI Wanwu through 0.6.5 contains an authorization bypass vulnerability that allows authenticate

CVE-2026-108855 - UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenti

CVE-2026-108854 - Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows any authen

CVE-2026-108853 - UnicomAI Wanwu before 0.6.3 contains an insecure direct object reference vulnerability that allows a

CVE-2026-108852 - Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to injec

CVE-2026-108851 - phpMyFAQ through 4.1.10 contains a missing authorization vulnerability in the MCP server faq_search

CVE-2026-108850 - Company Research Agent through 2.2.0 contains a server-side request forgery vulnerability that allow

CVE-2026-108839 - thClaws through 0.141.0 contains a link-following vulnerability in the post_inputs handler of the v1

CVE-2026-108699 - hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attack

CVE-2026-108698 - hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/w

CVE-2026-108697 - CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged

CVE-2026-108681 - A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown functio

CVE-2026-108760 - LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated F

CVE-2026-108759 - mistral.rs 0.9.0 through 0.9.4 contains a link following vulnerability in mistralrs-code-exec that a

CVE-2026-108758 - Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register(

CVE-2026-108757 - Nexting pinclaw OpenClaw channel plugin through 0.3.0 contains a missing authentication vulnerabilit

CVE-2026-108756 - Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram route

CVE-2026-108755 - Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows

CVE-2026-108754 - GPT-Load through 1.4.11 contains a cleartext logging vulnerability that exposes client proxy keys be

CVE-2026-108753 - Agnaistic agnai through 1.0.555 contains a hard-coded credentials vulnerability in self-host.docker-

CVE-2026-108752 - JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated us

CVE-2026-108751 - MoAI-ADK through 3.1.2 contains an improper link resolution vulnerability in the moai init template

CVE-2026-108750 - OpenDocMan 2.4.0 through 2.10.0 contains a decompression bomb vulnerability that allows authenticate

CVE-2026-108749 - docling-serve 1.14.0 through 1.36.0 contains a missing authentication vulnerability that allows unau

CVE-2026-108748 - Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the c

CVE-2026-108747 - Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated o

CVE-2026-108746 - Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionFo

CVE-2026-108745 - CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet tha

CVE-2026-108744 - pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that

CVE-2026-108742 - CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection Grap

CVE-2026-108741 - Shepherd (shepherd-ai) through 0.3.1 contains a server-side request forgery guard bypass in the cita

CVE-2026-108740 - GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userP

CVE-2026-108739 - OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerabili

CVE-2026-108738 - Traccar 5.7 through 6.16.0 contains a cross-site request forgery vulnerability that allows attackers

CVE-2026-108737 - Traccar through 6.16.0 contains a weak password recovery vulnerability that allows attackers to reus

CVE-2026-108736 - Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthent

CVE-2026-108735 - Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authen

CVE-2026-108734 - Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_l

CVE-2026-108733 - Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a mi

CVE-2026-108732 - Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a mi

CVE-2026-108731 - Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated u

CVE-2026-108730 - Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/

CVE-2026-108729 - Corteza through 2024.9.10 contains an incorrect authorization vulnerability in compose attachment en

CVE-2026-108728 - Flyte 2.0.1 through 2.0.51 contains a cleartext secret storage vulnerability that allows users with

CVE-2026-108727 - EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-templat

CVE-2026-108726 - GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authe

CVE-2026-108725 - Cheshire Cat AI core through 2.0.23 contains a stored cross-site scripting vulnerability in the uplo

CVE-2026-108724 - Sylius through 2.3.0 contains an authorization bypass vulnerability that allows unauthenticated atta

CVE-2026-108723 - answer-me-with-html through 0.5.0 contains a link following vulnerability in the am CLI code block s

CVE-2026-108722 - open-computer-use through commit 610bac8 contains a stored cross-site scripting vulnerability in Log

CVE-2026-108721 - Open Computer Use through 1.0.0 on macOS contains an improper case sensitivity handling vulnerabilit

CVE-2026-108720 - phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-p

CVE-2026-108719 - LLMGateway through 1.20.0 contains a blind server-side request forgery vulnerability that allows API

CVE-2026-108718 - Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server

CVE-2026-108717 - Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController

CVE-2026-108716 - mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDevi

CVE-2026-108715 - LibreNMS through 26.9.1.1 contains an authorization bypass vulnerability in includes/html/graphs/smo

CVE-2026-108714 - MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows r

CVE-2026-108713 - SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that a

CVE-2026-108712 - SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserR

CVE-2026-108711 - Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer

CVE-2026-108710 - NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated user

CVE-2026-108584 - A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unkn

CVE-2026-108578 - A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the

CVE-2026-108577 - A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects

CVE-2026-108576 - A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function proces

CVE-2026-108575 - A vulnerability has been found in BerriAI LiteLLM up to 1.94.0. This affects the function get_secret

CVE-2026-108574 - A flaw has been found in BerriAI LiteLLM up to 1.95.0. Affected by this issue is the function ui_vie

CVE-2026-108573 - A vulnerability was detected in Open Asset Import Library Assimp up to 6.0.5. Affected by this vulne

CVE-2026-108572 - A security vulnerability has been detected in Casdoor up to 3.164.0/4.10.0. Affected is the function

CVE-2026-108571 - A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcm

CVE-2026-108570 - A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the functi

CVE-2026-108569 - A vulnerability was identified in Furion .NET Framework up to 4.9.9.92. The impacted element is the

CVE-2026-108568 - A vulnerability was determined in InstantSoft icms2 up to 2.18.2. The affected element is the functi

CVE-2026-108567 - A vulnerability was found in InstantSoft icms2 up to 2.18.2. Impacted is the function files_delete_f

CVE-2026-108566 - A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function in

CVE-2026-108544 - A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. This a

CVE-2026-108543 - A vulnerability was determined in ag2ai ag2 up to 0.13.4. Affected by this issue is the function os.

CVE-2026-108542 - A vulnerability was found in 021is elvix-sdk up to 0.10.1. Affected by this vulnerability is an unkn

CVE-2026-97183 - The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its

CVE-2026-96227 - The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submissio

CVE-2026-94235 - The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one o

CVE-2026-93550 - The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remot

CVE-2026-91829 - The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter befor

CVE-2026-89305 - The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before

CVE-2026-89304 - The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before

CVE-2026-89302 - The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a paramete

CVE-2026-89299 - The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter b

CVE-2026-89297 - The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter

CVE-2026-89287 - The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter b

CVE-2026-89285 - The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request paramete

CVE-2026-89283 - The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or

CVE-2026-89234 - The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using

CVE-2026-89232 - The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before usi

CVE-2026-89214 - The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values be

CVE-2026-89213 - The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter befo

CVE-2026-89195 - The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a paramet

CVE-2026-88930 - The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set b

CVE-2026-88905 - The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check wh

CVE-2026-88903 - The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handler

CVE-2026-88827 - The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on a

CVE-2026-88826 - The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJA

CVE-2026-88785 - The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered m

CVE-2026-87764 - The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat me

CVE-2026-87762 - The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks

CVE-2026-87761 - The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or

CVE-2026-87760 - The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measu

CVE-2026-86798 - The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of it

CVE-2026-86717 - The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of it

CVE-2026-86706 - The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on o

CVE-2026-85126 - The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX a

CVE-2026-85121 - The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of it

CVE-2026-85118 - The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capabi

CVE-2026-84737 - The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when a

CVE-2026-84734 - The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied

CVE-2026-84261 - The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape

CVE-2026-84260 - The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape c

CVE-2026-84259 - The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content

CVE-2026-84258 - The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape con

CVE-2026-84254 - The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation a

CVE-2026-84253 - The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation an

CVE-2026-84252 - The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF

CVE-2026-84251 - The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and

CVE-2026-81649 - The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on sev

CVE-2026-81420 - The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it

CVE-2026-81156 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery set

CVE-2026-81155 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting befor

CVE-2026-81154 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before o

CVE-2026-81153 - The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image setti

CVE-2026-14854 - The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before

CVE-2026-12980 - The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substitut

CVE-2026-108541 - A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown fu

CVE-2026-108540 - A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the fi

CVE-2026-107694 - The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.2.0 do

CVE-2026-107507 - The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport

CVE-2026-106029 - The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity

CVE-2026-104684 - The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user is authorized to read