601064 matches found
CVE-2026-73404
Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73367
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73377
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73361
Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...
CVE-2026-73348
Unauthenticated Broken Access Control in GiveWP 4.16.6 versions...
CVE-2026-73352
Unauthenticated Broken Access Control in GiveWP = 4.16.5.1 versions...
CVE-2026-73356
Unauthenticated Arbitrary Content Deletion in Breeze = 2.5.12 versions...
CVE-2026-73181
Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce 7.6 versions...
CVE-2026-70657
Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both...
CVE-2026-69189
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while...
CVE-2026-66651
Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...
CVE-2026-66679
Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-61407
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
CVE-2026-50139
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50138
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...