408278 matches found
CVE-2026-93903
LiteSpeed Web Server (LSWS) versions prior to 6.3.7 build 1 are vulnerable to a flaw where the software mishandles internal redirect URL validation during specific "corner case" scenarios. This vulnerability could lead to significant impact as indicated by its CRITICAL severity rating (CVSS 4.0 s...
CVE-2026-103118
A vulnerability exists in GraphicsMagick up to version 1.3.47 within the WPG File Handler component. Specifically, the ExtractPostscript function in the file coders/wpg.c is susceptible to uncontrolled recursion when processing manipulated input. This issue can be triggered via a remote attack . ...
CVE-2026-82307
Dolusoft Software Technologies SOPLOG is vulnerable to an SQL injection due to the improper neutralization of special elements used in SQL commands. This vulnerability affects versions before Soplog 2026.9.4.1 . The flaw allows an attacker to execute unauthorized SQL commands, potentially leading...
CVE-2026-93547
The Vaadin Spreadsheet component (including the Spreadsheet add-on for Vaadin Framework 7 and 8) contains a missing authorization check that allows authenticated users to add or replace cell comments on sheets with enabled protection, including locked cells. The underlying cause is that the handl...
CVE-2026-91860
A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base . The flaw occurs because the application fails to filter keys that address the prototype chain when merging user-controlled objects (e.g., parsed JSON) into chart configurations or a c...
CVE-2026-76504
A critical authentication bypass vulnerability exists in the Cisco Catalyst SD-WAN Manager API session-based authentication management. The root cause is improper handling of URI encoding (CWE-177) in HTTP requests, allowing an unauthenticated, remote attacker to bypass authentication rules and g...
CVE-2026-103117
A security vulnerability exists in OS4ED openSIS-Classic up to version 9.3. The flaw is located in the db_properties function within the functions/DatabaseInc.php file of the Save Data Handler component. Improper handling of argument values allows for a remote SQL injection attack. While the expl...
CVE-2026-86778
The Maksisoft Gym software (versions 0.5.10 to 0.5.11 ) is vulnerable to a username enumeration flaw caused by an observable response discrepancy . This vulnerability allows an attacker to perform account footprinting to identify valid users. No specific exploit details or remediation steps are p...
CVE-2026-103116
A SQL injection vulnerability exists in OS4ED openSIS-Classic versions up to 9.3 . The flaw is located within the DBQuery function of the functions/GetStuListFnc.php file in the Student List Search Endpoint component. The vulnerability is triggered by the manipulation of the LO_sort argument, all...
CVE-2026-102398
The Popup by Supsystic WordPress plugin (versions
CVE-2026-102399
The Photo Gallery by Supsystic plugin for WordPress, version 1.21.0 and below , is vulnerable to an unauthenticated Cross Site Request Forgery (CSRF) . While the vulnerability is identified, the provided documents do not specify the exact root cause, affected functions, or specific remediation st...
CVE-2026-102396
The Ultimate Maps by Supsystic WordPress plugin (versions
CVE-2026-102395
The WordPress Easy Google Maps plugin versions
CVE-2026-102386
The WP Photo Album Plus WordPress plugin, version 9.3.02.003 and below, contains a Subscriber Cross Site Scripting (XSS) vulnerability. While the specific root cause and internal component are not detailed in the provided documents, the vulnerability allows for XSS impacts. No exploit details or ...
CVE-2026-102385
The Ninja Forms WordPress plugin versions
CVE-2026-102384
The WordPress Supreme Modules Lite plugin in versions
CVE-2026-100513
The CF7 Views – Complete Entry Management for Contact Form 7 WordPress plugin (versions
CVE-2026-100507
The If-So Dynamic Content Personalization plugin for WordPress, version
CVE-2026-100508
The WordPress Two Factor plugin versions
CVE-2026-97302
The WordPress MPG plugin (versions
CVE-2026-97301
The Cool Formkit Lite WordPress plugin (versions
CVE-2026-97298
The King Addons for Elementor WordPress plugin (versions
CVE-2026-97299
The Razorpay Payment Links for WooCommerce WordPress plugin, versions
CVE-2026-97293
The WordPress Media Library Assistant plugin version 3.41 and below is vulnerable to a SQL Injection flaw within the Contributor role functionality. The vulnerability allows for unauthorized database interaction, potentially impacting confidentiality and availability. No specific exploit links or...
CVE-2026-97292
The YITH WooCommerce Tab Manager plugin for WordPress versions
CVE-2026-97289
The Quiz And Survey Master plugin for WordPress versions
CVE-2026-97288
The WordPress OAuth Server plugin, version 4.5.1 and below , is vulnerable to a Cross-Site Scripting (XSS) flaw. The vulnerability is attributed to the Contributor role. While the vulnerability is confirmed, specific technical root causes, exploitation details, or remediation steps are not provid...
CVE-2026-97287
The WordPress Event Tickets plugin in versions
CVE-2026-97286
The Strong Testimonials plugin for WordPress, version 3.3.11 and below , is vulnerable to a Contributor Cross Site Scripting (XSS) flaw. While specific technical root causes are not detailed in the provided documents, the vulnerability allows for potential impact on integrity, confidentiality, an...
CVE-2026-97285
The WordPress The Events Calendar plugin versions
CVE-2026-97282
The Review Schema WordPress plugin versions
CVE-2026-97279
The Polylang plugin for WordPress versions
CVE-2026-97274
The WordPress OAuth Single Sign On – SSO (OAuth Client) plugin, versions
CVE-2026-97271
The WPFunnels WordPress plugin, version 3.13.1 and below , is vulnerable to an unauthenticated Cross Site Scripting (XSS) vulnerability. Technical details regarding the specific component or root cause are not provided in the documents. The CVSS 3.1 score is 7.1 (High) , with a vector of CVSS:3.1...
CVE-2026-97272
The Premmerce Permalink Manager for WooCommerce plugin for WordPress versions
CVE-2026-97270
The CMB2 plugin for WordPress (versions
CVE-2026-97267
The Prevent files / folders access plugin for WordPress is affected by a Broken Access Control vulnerability in versions
CVE-2026-97266
The Virtue/Ascend/Pinnacle Toolkit plugin for WordPress is vulnerable to a Cross Site Scripting (XSS) vulnerability in versions
CVE-2026-97262
The Visual Composer Website Builder plugin for WordPress (versions
CVE-2026-97261
The Notivo WordPress plugin (versions
CVE-2026-97253
The Kreatura LayerSlider WordPress plugin (versions
CVE-2026-97250
The Geo Mashup WordPress plugin in versions
CVE-2026-97248
The Booking Activities WordPress plugin in versions
CVE-2026-97249
The Paid Member Subscriptions WordPress plugin versions
CVE-2026-97247
The Blocksy Companion WordPress plugin in versions
CVE-2026-97246
The ShortPixel Image Optimizer plugin for WordPress (versions
CVE-2026-97245
The WordPress SureCart plugin (versions
CVE-2026-97244
The Creator LMS WordPress plugin (versions