90887 matches found
CVE-2026-84834: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in JobSearch = 3.2.0 versions...
CVE-2026-84779: Missing Authorization
Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...
CVE-2026-84768: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in VikAppointments Services Booking Calendar = 1.2.20 versions...
CVE-2026-84756: Incorrect Privilege Assignment
Subscriber Privilege Escalation in WCFM Membership = 2.11.11 versions...
CVE-2026-84776: Allocation of Resources Without Limits or Throttling
Unauthenticated Denial of Service Attack in MalCare Security = 6.69 versions...
CVE-2026-84813: Improper Neutralization of Special Elements used in an SQL Command
Unauthenticated SQL Injection in GeoDirectory = 2.8.174 versions...
CVE-2026-84765: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...
CVE-2026-79679: Use of Weak Credentials
Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit used in mapp Services: before 6.8.0...
CVE-2026-84215: Missing Authorization
Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...
CVE-2026-84752: Deserialization of Untrusted Data
Contributor PHP Object Injection in RTMKit = 2.1.5 versions...
CVE-2026-84848: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-9853: Incorrect Implementation of Authentication Algorithm
A vulnerability exists in SYS600 which allows any user authenticated to the operating system of the server hosting the application to read and modify application objects without being authenticated to the SYS600 system itself. Only the SYS600 system users should be permitted to view and modify...
CVE-2026-81281: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...
CVE-2026-84762: External Control of Assumed-Immutable Web Parameter
Unauthenticated Bypass Vulnerability in WP EasyPay = 4.5.3 versions...
CVE-2026-6071: Out-of-bounds Write
A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write past the end of an allocated object and execute code within the context of the current process. To exploit this vulnerability, a legitimate user must visit a...
CVE-2026-76176: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admindouble due to improper processing of the values in the ID field included in the selectedgrpdupli parameter. An authenticated user with operator privileges can manipulate these values to alter the SQL queries executed ...
CVE-2026-84763: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...
CVE-2026-85307: Insertion of Sensitive Information Into Sent Data
Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. This issue affects KP Agent Ready: from n/a before 1.2.08...
CVE-2026-76178: Improper Neutralization of Input During Web Page Generation
A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...