92235 matches found
CVE-2026-27410: Deserialization of Untrusted Data
Unauthenticated Deserialization of untrusted data in Slimstat Analytics 5.4.0 versions...
CVE-2026-27400: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Deletion in BookPro = 1.1.0 versions...
CVE-2026-27395: Incorrect Privilege Assignment
Unauthenticated Privilege Escalation in Support Board 3.8.9 versions...
CVE-2026-24611: Missing Authorization
Unauthenticated Broken Access Control in MetForm Pro = 3.9.1 versions...
CVE-2026-22339: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WPJobster = 6.3.5 versions...
WordPress Plugin: wc-frontend-manager-ultimate: CVE-2026-22335: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Subscriber SQL Injection in WooCommerce Frontend Manager – Ultimate 6.7.7 versions...
CVE-2026-22332: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in Tutor LMS Pro = 3.9.6 versions...
CVE-2026-22331: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in AutoParts = 1.5.8 versions...
CVE-2026-22330: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Right Way = 4.0 versions...
CVE-2026-22329: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Skillate = 1.2.10 versions...
CVE-2026-22326: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Reprizo = 1.0.8 versions...
CVE-2026-22325: Improper Control of Filename for Include/Require Statement in PHP Program
Unauthenticated Local File Inclusion in Promo = 1.3.0 versions...
CVE-2026-10837: URL Redirection to Untrusted Site
Open redirection vulnerability due to insufficient validation of the X-Forwarded-Host HTTP header. An attacker could create manipulated links that, when opened by a victim, cause the victim to be redirected to domains controlled by the attacker, enabling phishing or deception attacks with limited...
CVE-2026-10836: Improper Neutralization of HTTP Headers for Scripting Syntax
Improper handling of HTTP headers that allows a remote attacker to manipulate the value of the Host header using specially crafted requests. A successful exploit could result in the generation of manipulated links or responses, potentially leading to limited information disclosure or compromising...
CVE-2026-0083: Undefined Security Weakness
In Nfc::eventCallback of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0082: Undefined Security Weakness
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0064: Undefined Security Weakness
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2026-0063: Undefined Security Weakness
In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...