3794 matches found
CVE-2026-27542
CVE-2026-27542 and CVE-2026-27540 affect the WordPress WooCommerce Wholesale Lead Capture plugin up to version 2.0.3.1. CVE-2026-27542 is an unauthenticated privilege-escalation in wwlc_create_user that can inject arbitrary WordPress capabilities (including administrator) during registration, ena...
CVE-2026-3564
CVE-2026-3564 affects ConnectWise ScreenConnect. A condition in ScreenConnect may allow an attacker who already has access to server‑level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. Red Hat, EUVD, NVD, and CVE...
CVE-2026-3910
CVE-2026-3910 is an inappropriately implemented Google Chrome V8 vulnerability (pre-146.0.7680.75) that allows remote code execution via a crafted HTML page in a sandbox. Public fixes landed in Chrome 146.0.7680.75 (and related channels); exploitation has been observed in reports, including notes...
CVE-2026-3909
CVE-2026-3909 is a Google Chrome/Skia vulnerability: an out-of-bounds write in Skia could allow a remote attacker to trigger out-of-bounds memory access via a crafted HTML page. Affects Chrome before 146.0.7680.75; exploits are known to exist in the wild. Chrome/Chromium advisories note that fixe...
CVE-2026-3657
The CVE-2026-3657 entry concerns the WordPress plugin My Sticky Bar. Affected: all versions insert(), while values are sanitized. Impact: unauthenticated attackers can inject SQL to perform blind time-based data extraction from the database. Remediation: upgrade to version 2.8.7 (fixed in the ref...
CVE-2026-3965
CVE-2026-3965 affects whyour qinglong up to 2.20.1, with the vulnerability located in the back/loaders/express.ts API Interface. The issue arises from manipulation of the command argument, causing protection mechanism failure and enabling remote access. Public exploit information exists, and ther...
CVE-2025-67038
Summary: CVE-2025-67038 affects Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module concatenates the username into a shell command used for logging on authentication failures, allowing injection of arbitrary OS commands with root privileges. Multiple sources (NVD, Red Hat, CISA KEV, CNNVD) describe ...
CVE-2026-26127
CVE-2026-26127 is a DoS vulnerability in the .NET stack caused by an out-of-bounds read that can be triggered by unauthenticated, network-based access. Connected advisories confirm this affects .NET and related ASP.NET Core behavior under resource allocation conditions. The published information ...
CVE-2026-25187
CVE-2026-25187 is a Winlogon elevation-of-privilege vulnerability described as improper link resolution before file access (link following). It is a local vulnerability in Windows Winlogon that could allow an authorized attacker to elevate privileges to SYSTEM with no user interaction required. T...
CVE-2026-21262
CVE-2026-21262 affects Microsoft SQL Server and is a privilege-escalation vulnerability caused by improper access control. An authorized, network-present attacker with low privileges can elevate to sysadmin, potentially reading/changing data, creating accounts, or altering configurations, as desc...
CVE-2026-0953
CVE-2026-0953 affects the Tutor LMS Pro WordPress plugin (versions through 3.9.5). The issue is an authentication bypass in the Social Login addon: the plugin fails to verify that the email in the authentication request matches the email from the validated OAuth token, allowing unauthenticated at...
CVE-2026-31816
Budibase
CVE-2026-3836
CVE-2026-3836 is linked to crashes in the dnf5 component. Fedora advisories (Fedora 42, 43, 44) indicate the issue is addressed by updating dnf5 to the upstream 5.4.0.0 release, which fixes a crash in dnf5daemon-server when it receives an unknown locale over D-Bus. Red Hat and Ubuntu entries ment...
CVE-2026-29059
CVE-2026-29059 (Windmill) : Windmill
CVE-2026-27944
CVE-2026-27944 affects Nginx UI prior to 2.3.3, where the /api/backup endpoint is accessible without authentication. The response header X-Backup-Security leaks the AES decryption key/IV, enabling an unauthenticated attacker to download a full system backup (including credentials, tokens, SSL key...
CVE-2026-27541
CVE-2026-27541 pertains to the WordPress plugin Wholesale Suite (woocommerce-wholesale-prices)
CVE-2026-20131
CVE-2026-20131 affects Cisco Secure Firewall Management Center (FMC) Software via the web-based management interface. The root cause is insecure deserialization of untrusted Java byte streams, enabling an unauthenticated, remote attacker to execute arbitrary Java code as root. Affected artifacts ...
CVE-2026-2025
Mail Mint WordPress plugin versions prior to 1.19.5 contain an information disclosure vulnerability due to missing authorization on a REST API endpoint, allowing unauthenticated users to retrieve email addresses of blog users. Affected versions: