409467 matches found
CVE-2026-103685
Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/...
CVE-2026-108604
Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP runquery safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval,...
CVE-2026-108602
Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolv...
CVE-2026-108603
slide-maker through 5.8.0 contains a path traversal vulnerability in generateimagesopenai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked...
CVE-2026-27350
Server-Side Request Forgery SSRF vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta...
CVE-2026-97853
Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision 34 digits by default is applied, so its cost grows with the places argument instead ...
CVE-2026-66480
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0...
CVE-2026-57742
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...
CVE-2026-107434
Subscriber Bypass Vulnerability in MicroPayments = 3.2.9 versions...
CVE-2026-107420
Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway = 1.7.2 versions...
CVE-2026-81797
Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme = 1.0.2 versions...
CVE-2026-78535
Unauthenticated PHP Object Injection in Photolia = 1.0.3 versions...
CVE-2026-78534
Unauthenticated Cross Site Scripting XSS in Educavo = 3.4.2 versions...
CVE-2026-78532
Unauthenticated Cross Site Scripting XSS in LMS = 8.3 versions...
CVE-2026-78533
Unauthenticated PHP Object Injection in Qwery = 3.6.1 versions...
CVE-2026-78531
Unauthenticated PHP Object Injection in Jacqueline = 2.22 versions...
CVE-2026-78529
Unauthenticated PHP Object Injection in Alliance = 3.11 versions...
CVE-2026-78530
Subscriber Arbitrary File Deletion in FoodBakery = 4.6 versions...
CVE-2026-66569
Unauthenticated PHP Object Injection in Kicker = 2.2.1 versions...
CVE-2026-66568
Unauthenticated PHP Object Injection in Original = 1.9.0 versions...
CVE-2026-66566
Unauthenticated Local File Inclusion in Ambient = 1.7 versions...
CVE-2026-66567
Unauthenticated PHP Object Injection in Anesta = 1.5.3 versions...
CVE-2026-66565
Unauthenticated PHP Object Injection in FC United = 1.1.1 versions...
CVE-2026-66564
Unauthenticated PHP Object Injection in ShiftCV = 3.0.14 versions...
CVE-2026-66563
Unauthenticated PHP Object Injection in Windsor = 2.10 versions...
CVE-2026-66483
Unauthenticated PHP Object Injection in Education Center = 3.6.12 versions...
CVE-2026-66482
Unauthenticated PHP Object Injection in Drone Media = 2.2.0 versions...
CVE-2026-66481
Author Arbitrary File Deletion in Presto Player Pro = 3.0.1 versions...
CVE-2026-62130
Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency = 5.5.8 versions...
CVE-2026-65459
Unauthenticated Arbitrary Content Deletion in Forminator = 1.57.3 versions...
CVE-2026-62129
Contributor Arbitrary File Upload in Creator LMS = 1.2.21 versions...
CVE-2026-62125
Unauthenticated PHP Object Injection in Asia Garden = 1.3.1 versions...
CVE-2026-62124
Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events = 2.21 versions...
CVE-2026-62123
Unauthenticated PHP Object Injection in Invetex = 2.18 versions...
CVE-2026-62120
Unauthenticated PHP Object Injection in Law Office = 3.20 versions...
CVE-2026-62118
Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62117
Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62116
Unauthenticated Cross Site Scripting XSS in Barcode Scanner with Inventory & Order Manager = 1.13.1 versions...
CVE-2026-62100
Unauthenticated Cross Site Scripting XSS in KuteShop = 4.2.9 versions...
CVE-2026-62115
Unauthenticated Local File Inclusion in KuteShop = 4.2.9 versions...
CVE-2026-62099
Unauthenticated Local File Inclusion in Boutique = 2.3.3 versions...
CVE-2026-62098
Unauthenticated Content Injection in Boutique = 2.3.3 versions...
CVE-2026-62095
Unauthenticated Cross Site Scripting XSS in Biolife = 3.2.3 versions...
CVE-2026-62096
Unauthenticated Local File Inclusion in Biolife = 3.2.3 versions...
CVE-2026-62094
Unauthenticated Local File Inclusion in TechOne = 3.0.3 versions...
CVE-2026-62093
Unauthenticated Cross Site Scripting XSS in TechOne = 3.0.3 versions...
CVE-2026-62092
Unauthenticated Local File Inclusion in Armania = 1.4.8 versions...
CVE-2026-62091
Unauthenticated Cross Site Scripting XSS in Armania = 1.4.8 versions...