91235 matches found
CVE-2026-84773: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84769: Authorization Bypass Through User-Controlled Key
Unauthenticated Insecure Direct Object References IDOR in Business Directory = 6.4.26 versions...
CVE-2026-84766: Authentication Bypass by Spoofing
Unauthenticated Bypass Vulnerability in FluentBooking Pro = 2.2.1 versions...
CVE-2026-84765: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...
CVE-2026-84763: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...
CVE-2026-84762: External Control of Assumed-Immutable Web Parameter
Unauthenticated Bypass Vulnerability in WP EasyPay = 4.5.3 versions...
CVE-2026-84756: Incorrect Privilege Assignment
Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...
CVE-2026-9853: Incorrect Implementation of Authentication Algorithm
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...
CVE-2026-79679: Use of Weak Credentials
Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0...
CVE-2026-76178: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...
CVE-2026-85309: Missing Authorization
Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3...
CVE-2026-84767: Insufficient Verification of Data Authenticity
Unauthenticated Bypass Vulnerability in BookIt = 2.6.0.3 versions...
CVE-2026-84768: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...
CVE-2026-85305: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery SSRF vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1...
CVE-2026-85304: Missing Authorization
Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through...
CVE-2026-84779: Missing Authorization
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...
CVE-2026-85458: Divide By Zero
Divide-by-zero in Xpdf 4.06 and earlier, when a glyph in a Type 3 font has a zero height...
CVE-2026-76175: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the delcheck parameter of the /ocsreports/?function=savequerylist endpoint. Input provided by an authenticated user with operator privileges is incorporated into an SQL query without proper parameterisation or validation, allowing the query to be manipulated and...
CVE-2026-84971: Reachable Assertion
Improper handling of an unexpected value size in the decryption path of a client-side encryption library can cause a failed internal check that terminates the process using the library. A party able to place a suitably formed encrypted value where an application will decrypt it, or able to contro...