CVE-2026-89301 - The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to limited file

CVE-2026-87869 - The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflec

CVE-2026-6723 - The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress

CVE-2026-5727 - The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

CVE-2026-104993 - The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre

CVE-2026-104735 - The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plu

CVE-2026-104724 - The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin fo

CVE-2026-104021 - The Fastcache by Host.it plugin for WordPress is vulnerable to Code Injection in all versions up to,

CVE-2026-103998 - The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is v

CVE-2026-103964 - The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all ver

CVE-2026-103889 - The 3D Product configurator for WooCommerce plugin for WordPress is vulnerable to Remote Code Execut

CVE-2026-103424 - The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to S

CVE-2026-102401 - The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regu

CVE-2026-101324 - The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin fo

CVE-2026-96743 - The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scrip

CVE-2026-94589 - The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for Word

CVE-2026-108501 - ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary a

CVE-2026-107645 - The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to,

CVE-2026-104898 - The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to

CVE-2026-104797 - The Advanced Form Integration — Connect Forms to 300+ Apps plugin for WordPress is vulnerable to Aut

CVE-2026-104732 - The Advanced IP Blocker plugin for WordPress is vulnerable to Authentication Bypass in all versions

CVE-2026-103365 - The Bookly – Online Scheduling and Appointment Booking System plugin for WordPress is vulnerable to

CVE-2026-101947 - ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths

CVE-2026-93883 - The Advanced Classifieds & Directory Pro plugin for WordPress is vulnerable to Stored Cross-Site Scr

CVE-2026-104915 - The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulne

CVE-2026-104022 - The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulne

CVE-2026-108474 - In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of sever

CVE-2026-22061 - Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an au

CVE-2026-18524 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-16681 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-103755 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-108269 - Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connecti

CVE-2026-108268 - Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end att

CVE-2026-108267 - Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/t

CVE-2026-92705 - Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loa

CVE-2026-62376 - Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store passwo

CVE-2026-62367 - Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, whe

CVE-2026-57458 - Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token

CVE-2026-108266 - Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channe

CVE-2026-108265 - Enclave OS Mini is a Rust-based runtime for confidential applications inside Intel SGX enclaves. Pri

CVE-2026-108264 - Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other medi

CVE-2026-108263 - Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the

CVE-2026-108261 - Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the /

CVE-2026-108260 - Tina is a headless content management system. Prior to 0.2.1, the tina-markdown element in packages/

CVE-2026-108259 - Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values f

CVE-2026-108258 - Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 unti

CVE-2026-107857 - Mindwtr is a free offline-first task management application for desktop and mobile. Prior to 1.1.5,

CVE-2026-107856 - CiviForm simplifies applications for government benefits programs by reusing applicant data across m

CVE-2026-107854 - Jexactyl is a customisable game management panel and billing system. From 4.0.0 until 4.0.5, the POS

CVE-2026-107852 - Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/c

CVE-2026-107851 - Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule()

CVE-2026-107850 - Contao is an Open Source CMS. From version 5.7.1 until 5.7.12, core-bundle/config/services.yaml regi

CVE-2026-107848 - Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, RequestTokenListener valid

CVE-2026-78797 - An issue in iStoreOS istoreos-24.10.7 and before allows a remote attacker to execute arbitrary code

CVE-2026-107845 - Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor

CVE-2026-107844 - Contao is an Open Source CMS. From version 5.0.0 until 5.3.50 and 5.7.12, ImagesController joins the

CVE-2026-107843 - Contao is an Open Source CMS. From version 4.1.0 until 5.3.50 and 5.7.12, ModuleRegistration::compil

CVE-2026-107842 - Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, ModuleSearch can disclose

CVE-2026-104758 - Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-73364. Reason:

CVE-2025-8457 - Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

CVE-2026-78835 - Rocket Software Rocket Remote Desktop 18.0.8583.1 is vulnerable to Insufficiently Protected Credenti

CVE-2026-75353 - OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOp

CVE-2026-75352 - OpENer v2.3/commit 76b95cf, contains an integer underflow in the server-side EtherNet/IP ForwardOpen

CVE-2026-75351 - OpENer v2.3/commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpe

CVE-2026-75350 - EIPStackGroup OpENer v2.3 / master commit 76b95cf contains a buffer overflow in the GetAttributeList

CVE-2026-108096 - Improper authorization in the query resolvers generated by @aws-amplify/graphql-index-transformer in

CVE-2026-107841 - pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.

CVE-2026-107840 - yopass is a service for securely sharing secrets, passwords, and files. Prior to version 14.7.0, the

CVE-2026-107839 - ageLANServer provides a cross-platform web server and launcher for offline multiplayer in several Ag

CVE-2026-107838 - RIOT is an open-source microcontroller operating system designed for Internet of Things devices and

CVE-2026-107837 - RIOT is an open-source microcontroller operating system designed for Internet of Things devices and

CVE-2026-107836 - RIOT is an open-source microcontroller operating system designed for Internet of Things devices and

CVE-2026-107835 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.8.1

CVE-2026-107834 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 unt

CVE-2026-107833 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 unt

CVE-2026-107826 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 unt

CVE-2026-107825 - OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 unt

CVE-2026-107824 - x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugg

CVE-2026-107823 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2026-107822 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2026-107821 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2026-107820 - x64dbg-MCP Server is a native Model Context Protocol (MCP) plugin for x64dbg that exposes the debugg

CVE-2026-107819 - MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL d

CVE-2026-107818 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2026-107817 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2026-107816 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2026-75597 - pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/

CVE-2026-75347 - EIPStackGroup OpENer v2.3 and master up to commit 76b95cf contain an expired pointer dereference vul

CVE-2026-55797 - Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15,

CVE-2026-48484 - pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the AP

CVE-2026-42695 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-108160 - AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allow

CVE-2026-108159 - AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-

CVE-2026-108158 - plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion

CVE-2026-108157 - Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that all

CVE-2026-108156 - LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the

CVE-2026-108119 - A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardli

CVE-2026-108093 - A flaw was found in GIMP. The XCF loader processes image-simulation-intent and image-simulation-bpc

CVE-2026-107815 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2025-61560 - A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo

CVE-2016-20098 - Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vu

CVE-2026-90983 - Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hay

CVE-2026-75349 - EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability

CVE-2026-75348 - An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b9

CVE-2026-75346 - An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76

CVE-2026-75345 - OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging

CVE-2026-108113 - ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI questio

CVE-2026-108112 - ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticate

CVE-2026-108111 - ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability in the GET /workflow/sea

CVE-2026-108110 - MOVO through 0.2.3 contains an authorization bypass vulnerability in the chat-api document endpoints

CVE-2026-107814 - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 1

CVE-2026-107813 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster r

CVE-2026-107812 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade

CVE-2026-107811 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenti

CVE-2026-107810 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/r

CVE-2026-107809 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired acce

CVE-2026-107808 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login c

CVE-2026-107807 - Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts

CVE-2026-107783 - Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might al

CVE-2026-104084 - SmarterMail before build 9777 contains a privilege escalation vulnerability where JWT access and ref

CVE-2026-104083 - SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that all

CVE-2026-104082 - SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker

CVE-2026-102554 - Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in

CVE-2026-95702 - Use-after-free vulnerability in VFS in Google gVisor prior to release 20260831.0 on all platforms al

CVE-2026-78796 - An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540

CVE-2026-78795 - An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540

CVE-2026-39460 - Usernames and passwords, including the default factory credentials, are stored in plaintext within t

CVE-2026-39453 - Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be auto

CVE-2026-33367 - SNMP can be used to perform administrative actions such as retrieving configuration files, modifying

CVE-2026-33272 - A malicious user with physical access to the device can boot the switch from factory settings withou

CVE-2026-32645 - Default factory credentials with administrative access are enabled and persist even after configurin

CVE-2026-29797 - No authentication is required when updating firmware or bootloader, making it easy for malicious fil

CVE-2026-28745 - Usernames and passwords, including the default credentials, are stored in the configuration file usi

CVE-2026-15340 - lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

CVE-2026-108125 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-108124 - Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability i

CVE-2026-108109 - PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password res

CVE-2026-108108 - PHPNuxBill through 2025.3.20 contains an authentication bypass vulnerability in RADIUS CHAP verifica

CVE-2026-108107 - PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.p

CVE-2026-108106 - Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows

CVE-2026-108105 - Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_req

CVE-2026-108104 - Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFr

CVE-2026-108103 - Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_

CVE-2026-108102 - Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_meas

CVE-2026-108101 - HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAtt

CVE-2026-108100 - HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token h

CVE-2026-107806 - Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated

CVE-2026-107805 - Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signatur

CVE-2026-107804 - Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled rever

CVE-2026-105278 - The published Docker image for openPDC includes a fixed administrative credential with no forced cha

CVE-2026-104117 - A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to c

CVE-2026-104116 - A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user

CVE-2026-104115 - A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to

CVE-2026-104114 - A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to c

CVE-2026-104113 - A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to cra

CVE-2026-104112 - A missing release of resources in the illumos name service cache daemon (nscd) allows a local user t

CVE-2026-104081 - KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function wit

CVE-2026-102916 - A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. Wh

CVE-2026-94067 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-94066 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-94065 - Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Inj

CVE-2026-94064 - Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme ne

CVE-2026-94063 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-92085 - Improper neutralization of input during web page generation ('cross-site scripting') vulnerability i

CVE-2026-85479 - The STTP-based data publisher on openPDC accepts network connections without authentication in its d

CVE-2026-79363 - Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Foo

CVE-2026-62026 - Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allo

CVE-2026-108063 - A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that

CVE-2026-107803 - ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api

CVE-2026-107785 - Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key.

CVE-2026-106581 - Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Dock

CVE-2026-105281 - The internal data publisher on openPDC accepts network connections without authentication in its def

CVE-2026-104629 - A component loading mechanism in openPDC and openHistorian will construct and run any specified type

CVE-2026-101022 - A Modbus connection feature on openPDC accepts a caller-specified destination address and port with

CVE-2026-100730 - A service console interface on openPDC and openHistorian deserializes a client-supplied data structu

CVE-2026-96396 - The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calcu

CVE-2026-96395 - The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bou

CVE-2026-96394 - The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not validate ima

CVE-2026-96393 - The Affinity by Canva app before 3.3.1 (October 2026 release) did not perform adequate bounds checki

CVE-2026-94062 - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusio

CVE-2026-94061 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-94060 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-94059 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-94058 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-8374 - Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attac

CVE-2026-86405 - Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment

CVE-2026-85531 - Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment

CVE-2026-62029 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-62028 - Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for

CVE-2026-106602 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack

CVE-2026-106601 - Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack

CVE-2026-105883 - Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incor

CVE-2026-105877 - Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-an

CVE-2026-105872 - Deserialization of Untrusted Data vulnerability in mklacroix Product Configurator for WooCommerce pr

CVE-2026-105870 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-105318 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-104392 - Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-ne

CVE-2026-104079 - Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conv

CVE-2026-103413 - Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, K

CVE-2026-103412 - Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apac

CVE-2026-103220 - The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bound

CVE-2026-101130 - The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bound

CVE-2026-101094 - The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incom

CVE-2026-89235 - The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parame

CVE-2026-87846 - The Shipping for Nova Poshta WordPress plugin through 1.19.8 does not perform any authorisation, non

CVE-2026-86851 - The Livees Checkout WordPress plugin through 7.0.2 does not perform any capability, nonce or order-k

CVE-2026-85348 - The GDPR Data Request Form WordPress plugin through 1.7.1 does not have CSRF protection when updatin

CVE-2026-62042 - Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exp

CVE-2026-62041 - Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploit

CVE-2026-62040 - Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with F

CVE-2026-62039 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-62036 - Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in AREOI Al

CVE-2026-39779 - Missing Authorization vulnerability in Asgaros Asgaros Forum asgaros-forum allows Exploiting Incorre

CVE-2026-107419 - Missing Authorization vulnerability in Cool Plugins AI Translation for Polylang automatic-translatio

CVE-2026-103329 - The Super Payments WordPress plugin before 1.43.1 does not properly verify the authenticity of incom

CVE-2026-97791 - In Apache CXF, STSTokenValidator checks whether a SAML assertion is signed by a trusted certificate

CVE-2026-97468 - Apache CXF's STSTokenValidator and Security Token Service (STS) cached validated security tokens und

CVE-2026-86463 - Apache CXF's FIQL query parser has a vulnerability in how it searches for operators in query express

CVE-2026-79650 - Apache CXF’s OIDC relying-party component could redirect users to an attacker-controlled URL after s

CVE-2026-78384 - CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A

CVE-2026-73179 - Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code

CVE-2026-71575 - The max_age authentication-freshness check in OidcClientCodeRequestFilter was inoperative due to a m

CVE-2026-108039 - By default, StaxUtils placed no limit on the total number of elements or the total number of charact

CVE-2026-107938 - In Apache CXF, the Netty-based HTTP client transport (cxf-rt-transports-http-netty-client) did not v

CVE-2026-107937 - In Apache CXF, the parser for multipart/MTOM attachment part headers did not fully enforce the confi

CVE-2026-100227 - Improper Verification of Cryptographic Signature vulnerability in Apache CXF's JAX-RS XML Security m

CVE-2026-96809 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-96761 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-96671 - Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-f

CVE-2026-96607 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-96553 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-96539 - Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allo

CVE-2026-96518 - Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting

CVE-2026-96461 - Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Config

CVE-2026-96337 - Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting

CVE-2026-96336 - Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Sp

CVE-2026-96334 - Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploit

CVE-2026-96333 - Authentication Bypass by Spoofing vulnerability in Liquid Web / StellarWP GiveWP give allows Identit

CVE-2026-96332 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-96331 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-96330 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-96329 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-96328 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-96327 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-95610 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-95609 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-95608 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i

CVE-2026-95607 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-95599 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i

CVE-2026-95598 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability i