CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

233124 matches found

NVD•added 2026/07/30 9:18 p.m.•13 views

CVE-2026-68501

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /locale/thank-you PageRedirectController::thankYouAction and GET /locale/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId...

6.5CVSS0.00341EPSS

SaveExploits0References10

NVD•added 2026/07/30 9:18 p.m.•18 views

CVE-2026-68500

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...

7.5CVSS0.00382EPSS

SaveExploits0References10

ATTACKERKB•added 2026/07/30 8:27 p.m.•7 views

CVE-2026-68501

6.5CVSS5.8AI score0.00341EPSS

SaveExploits0References11Affected Software1

Vulnrichment•added 2026/07/30 8:27 p.m.•11 views

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

6.5CVSS5.5AI score0.00341EPSS

SaveExploits0References10

Cvelist•added 2026/07/30 8:27 p.m.•39 views

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

6.5CVSS0.00341EPSS

SaveExploits0References10

CVE•added 2026/07/30 8:27 p.m.•48 views

CVE-2026-68501

Sylius Mollie Plugin for Sylius is affected by an IDOR vulnerability prior to versions 2.2.8, 3.2.4, and 3.3.1. The GET endpoints /{_locale}/thank-you (PageRedirectController::thankYouAction) and /{_locale}/get-code (QrCodeAction::fetchQrCodeFromOrder) can look up sequential orderId values withou...

6.5CVSS5.8AI score0.00341EPSS

SaveExploits0References10

OSV•added 2026/07/30 8:27 p.m.•6 views

CVE-2026-68501 Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII

6.5CVSS5.5AI score

SaveExploits0References12

Patchstack•added 2026/07/30 8:21 p.m.•9 views

WordPress MailerPress – Newsletter, email marketing & AI automation plugin <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates vulnerability

Missing Authorization to Unauthenticated Contact Updates vulnerability discovered by Jakub Lipiński A3RES in WordPress Plugin MailerPress versions = 1.5.0...

5.3CVSS5.8AI score0.00297EPSS

SaveExploits0References1Affected Software1

NVD•added 2026/07/30 8:16 p.m.•11 views

CVE-2026-10569

IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 is susceptible to an Exposure of Sensitive Information Vulnerability in plugin output logs. This exposure could allow an...

4.3CVSS0.0018EPSS

SaveExploits0References1

ATTACKERKB•added 2026/07/30 8:15 p.m.•11 views

CVE-2026-68500

7.5CVSS5.9AI score0.00382EPSS

SaveExploits0References11Affected Software1

OSV•added 2026/07/30 8:15 p.m.•8 views

CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook

7.5CVSS5.5AI score

SaveExploits0References12

Vulnrichment•added 2026/07/30 8:15 p.m.•7 views

CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook

7.5CVSS5.5AI score0.00382EPSS

SaveExploits0References10

CVE•added 2026/07/30 8:15 p.m.•43 views

CVE-2026-68500

The Sylius Mollie Plugin (affected: before versions 2.2.8, 3.2.4, 3.3.1) exposes a vulnerability in the POST /{_locale}/update-payment webhook. The webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment corresponds to the referenced Sylius order,...

7.5CVSS5.9AI score0.00382EPSS

SaveExploits0References10

Cvelist•added 2026/07/30 8:15 p.m.•41 views

CVE-2026-68500 Sylius Mollie Plugin: Payment status forgery via the payment webhook

7.5CVSS0.00382EPSS

SaveExploits0References10

Cvelist•added 2026/07/30 7:6 p.m.•35 views

CVE-2026-10569 IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability

4.3CVSS0.0018EPSS

SaveExploits0References1

CVE•added 2026/07/30 7:6 p.m.•46 views

CVE-2026-10569

IBM UrbanCode Deploy (UCD) and IBM DevOps Deploy are affected by CVE-2026-10569 due to exposure of sensitive information in plugin output logs. Affected products/versions: UCD 7.2–7.2.3.23; 7.3–7.3.2.18; DevOps Deploy 8.0–8.0.1.13; 8.1–8.1.2.6; 8.2–8.2.1.0. Root cause: plugin output logs may reve...

4.3CVSS5.9AI score0.0018EPSS

SaveExploits0References1Affected Software2

EUVD•added 2026/07/30 7:6 p.m.•11 views

EUVD-2026-51275

4.3CVSS5.9AI score0.0018EPSS

SaveExploits0References1

SUSE CVE•added 2026/07/30 4:36 p.m.•6 views

SUSE CVE-2026-59691

A heap buffer overflow vulnerability was found in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit...

7.1CVSS7.4AI score0.00326EPSS

SaveExploits0References4

NVD•added 2026/07/30 12:19 p.m.•11 views

CVE-2026-5582

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

4.3CVSS0.00132EPSS

SaveExploits0References5

NVD•added 2026/07/30 12:17 p.m.•10 views

CVE-2026-15397

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wpssfwinstallpluginconfiguration AJAX handler. This...

7.2CVSS0.00314EPSS

SaveExploits0References5

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by