90960 matches found
CVE-2026-93623: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in AI Engine = 3.7.8 versions...
CVE-2026-94679: Missing Authorization
Subscriber Broken Access Control in Fluent Support = 2.3.2 versions...
CVE-2026-94684: Undefined Security Weakness
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection...
CVE-2026-94457: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in Captcha Code = 3.32 versions...
CVE-2026-5695: Unrestricted Upload of File with Dangerous Type
Arbitrary file upload vulnerability due to a lack of proper validation in upload forms. This allows authenticated users to upload files to the server without restrictions. An attacker could exploit this flaw to execute malicious code remotely demonstrated by uploading the EICAR test file, which...
CVE-2026-95586: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 = 3.5.50 versions...
CVE-2026-95527: Missing Authorization
Unauthenticated Broken Access Control in Conekta Payment Gateway = 6.2.4 versions...
CVE-2026-95603: Deserialization of Untrusted Data
Shop manager PHP Object Injection in Reycob Product Import Export = 2.3.0 versions...
CVE-2026-15358: Unquoted Search Path or Element
ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 were vulnerable to an unauthorized Path Traversal vulnerability...
CVE-2026-6327: Improper Output Neutralization for Logs
IBM Concert 1.0.0 through 3.0.0 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files...
CVE-2026-93772: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in wpForo Forum = 3.1.5 versions...
CVE-2026-93622: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WPS Limit Login = 1.5.9.3 versions...
CVE-2026-76980: Improper Input Validation
ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector...
CVE-2026-95590: Improper Neutralization of Special Elements used in an SQL Command
Subscriber SQL Injection in Tainacan = 1.2.0 versions...
PT-2026-97149
Name of the Vulnerable Software and Affected Versions SourceCodester Smart Attendance System with QR Code Scanner version 1.0 Description An issue exists in the Self-Registration component within the student signup.php file. Manipulating the full name argument in the prepend function allows for...
CVE-2026-94487: Cross-Site Request Forgery (CSRF)
Unauthenticated Cross Site Request Forgery CSRF in PublishPress Capabilities = 2.50.1 versions...
CVE-2026-94168: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...
CVE-2026-93620: Missing Authorization
Unauthenticated Broken Access Control in PayPlus Payment Gateway = 8.2.5 versions...