Lucene search
+L

467606 matches found

Cvelist
Cvelist
added 6 hours ago6 views

CVE-2026-57916 Arbitrary Path Execution via CPS URI in proCertum SmartSign

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

4.6CVSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 6 hours ago2 views

CVE-2026-57916

proCertum SmartSign opens Certificate Practice Statement CPS URI without schema validation. An attacker can prepare arbitrary certificate with CPS URI pointing to a local executable file or any URL, sign a document with it, and send it to the victim. When the victim opens the document in the...

4.6CVSS5.9AI score
SaveExploits0References3
EUVD
EUVD
added 7 hours ago4 views

EUVD-2026-49129

cJSON library is vulnerable to an integer overflow in the printstringptr function in cJSON.c on 32-bit platforms. The escapecharacters counter, a 32-bit sizet, can wrap around when processing strings containing approximately 858,993,460 or more control characters, causing the output buffer to be...

5.1CVSS6.4AI score
SaveExploits0References2
OSV
OSV
added 8 hours ago6 views

ROOT-APP-NPM-CVE-2026-54289 CVE-2026-54289 in @rootio/hono - Patched by Root

Root has patched CVE-2026-54289 in the @rootio/hono package for Root:npm. Multiple fixed versions available...

4.8CVSS6.1AI score0.00178EPSS
SaveExploits0
Cvelist
Cvelist
added 8 hours ago9 views

CVE-2026-65765 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.1

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities...

6.9CVSS
SaveExploits0References1
EUVD
EUVD
added 8 hours ago5 views

EUVD-2026-49128

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities...

6.9CVSS5.8AI score
SaveExploits0References1
EUVD
EUVD
added 8 hours ago4 views

EUVD-2026-49127

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability...

5.1CVSS5.8AI score
SaveExploits0References1
NVD
NVD
added 9 hours ago10 views

CVE-2026-13400

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

6.1CVSS
SaveExploits0References1
NVD
NVD
added 9 hours ago7 views

CVE-2026-13152

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...

8.1CVSS
SaveExploits0References1
CVE
CVE
added 10 hours ago9 views

CVE-2026-64532

CVE-2026-64532 affects the Linux kernel ntfs3 code path and fixes an out-of-bounds write in UpdateRecordDataRoot/UpdateRecordDataAllocation. In do_action(), the memmove destination is Add2Ptr(e, le16_to_cpu(e->view.data_off)) where e->view.data_off comes from an on-disk NTFS_DE inside INDEX...

5.8AI score
SaveExploits0References7
CVE
CVE
added 10 hours ago8 views

CVE-2026-14827

The CVE-2026-14827 entry concerns the Calendar WordPress plugin (before 1.3.18). The vulnerability is a stored XSS via the event_link parameter, where a user-supplied event field is not properly escaped before being output inside an HTML attribute on a public page. This allows users with the Cont...

5.9AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 10 hours ago2 views

CVE-2026-14568

The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership before deleting an attachment, allowing unauthenticated attackers to permanently delete author-less attachments su...

5.8AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago14 views

CVE-2026-14289

CVE-2026-14289 affects the FacturaONE para WooCommerce con VeriFactu WordPress plugin prior to 5.37. The vulnerability is in an unauthenticated request handler that is only protected by a cryptographic key that is empty in the default/unconfigured state, allowing an unauthenticated attacker to wr...

6.3AI score
SaveExploits0References1
CVE
CVE
added 10 hours ago10 views

CVE-2026-14820

The CVE-2026-14820 entry affects the Quiz And Survey Master WordPress plugin, specifically versions before 11.1.3. The root cause is the absence of rate limiting and standard failed-login auditing on the front-end credential-check function, which returns distinct responses for valid versus invali...

5.9AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 10 hours ago2 views

CVE-2026-14190

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

6.1AI score
SaveExploits0References1
EUVD
EUVD
added 10 hours ago5 views

EUVD-2026-49077

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

6.1CVSS6.1AI score
SaveExploits0References1
Cvelist
Cvelist
added 10 hours ago9 views

CVE-2026-13332 Masteriyo LMS < 2.3.1 - Unauthenticated Arbitrary User Session Termination (Denial of Service)

The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers to terminate the active sessions force-logout of any user on the site, including administrators...

SaveExploits0References1
Cvelist
Cvelist
added 10 hours ago9 views

CVE-2026-13152 Custom Fields Account Registration For WooCommerce < 1.4 - Unauthenticated Privilege Escalation

The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be grant...

SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 10 hours ago2 views

CVE-2026-12982

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

5.9AI score
SaveExploits0References1
Cvelist
Cvelist
added 10 hours ago10 views

CVE-2026-10082 Advanced Ads – Ad Manager & AdSense < 2.0.23 - Contributor+ Stored XSS via the_ad Shortcode 'ad_args' Parameter

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

SaveExploits0References1
Rows per page
Query Builder