378746 matches found
CVE-2026-65560
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
CVE-2026-65571
Unauthenticated PHP Object Injection in 69 Clothing = 1.2.11.1 versions...
CVE-2026-65572
Unauthenticated PHP Object Injection in A.Williams = 1.3.1 versions...
CVE-2026-65574
Unauthenticated PHP Object Injection in Abogado = 1.18 versions...
CVE-2026-65573
Unauthenticated PHP Object Injection in Abelle = 1.22 versions...
CVE-2026-65552
Subscriber PHP Object Injection in Export User Data = 2.2.6 versions...
CVE-2026-65559
Shop manager Privilege Escalation in Order Delivery Date for WooCommerce = 4.6.0 versions...
CVE-2026-65556
Unauthenticated PHP Object Injection in WPBruiser no- Captcha anti-Spam = 3.1.43 versions...
CVE-2026-65553
Unauthenticated Remote Code Execution RCE in Spider Analyser WordPress搜索引擎蜘蛛分析插件 = 2.1.3 versions...
CVE-2026-65554
Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions...
CVE-2026-65548
Contributor Remote Code Execution RCE in Betheme = 28.4.2 versions...
CVE-2026-65545
Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...
CVE-2026-65543
Subscriber Sensitive Data Exposure in Vimeo = 1.2.2 versions...
CVE-2026-65544
Unauthenticated Cross Site Scripting XSS in Super Socializer = 7.14.5 versions...
CVE-2026-65546
Unauthenticated SQL Injection in Qode Tours = 3.1.3.1 versions...
CVE-2026-65549
Author PHP Object Injection in Jeg Kit for Elementor = 3.2.10 versions...
CVE-2026-65547
Subscriber SQL Injection in Creative Mail = 1.6.9 versions...
CVE-2026-65517
Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...
CVE-2026-65509
Unauthenticated Cross Site Scripting XSS in wpDataTables = 7.5.1 versions...
CVE-2026-65541
Unauthenticated Broken Access Control in Staff Training = 1.0.7 versions...
CVE-2026-65523
Unauthenticated Insecure Direct Object References IDOR in Formidable Forms Signature Online Contract Automation = 2.0.1 versions...
CVE-2026-65515
Unauthenticated Cross Site Scripting XSS in AffiliateWP = 2.35.0 versions...
CVE-2026-65520
Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...
CVE-2026-65542
Unauthenticated Broken Authentication in Super Socializer = 7.14.5 versions...
CVE-2026-65513
Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.12.10 versions...
CVE-2026-61963
Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...
CVE-2026-61982
Unauthenticated Cross Site Scripting XSS in SiteGuard WP Plugin = 1.8.6 versions...
CVE-2026-65504
Unauthenticated Broken Access Control in BOX NOW Delivery Croatia = 3.3.0 versions...
CVE-2026-61964
Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...
CVE-2026-65507
Unauthenticated Privilege Escalation in AIWU = 1.5.6 versions...
CVE-2026-65508
Unauthenticated SQL Injection in Simply Schedule Appointments = 1.6.12.10 versions...
CVE-2026-65502
Unauthenticated Bypass Vulnerability in Element Pack Elementor Addons = 8.7.13 versions...
CVE-2026-61961
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
CVE-2026-61959
Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...
CVE-2026-54489
Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contains a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This...
CVE-2026-53976
OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassi...
CVE-2026-53975
OpenChamber 1.11.7 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by sending crafted POST requests to the /api/fs/exec endpoint, which passes commands verbatim to Node.js spawn without any allowlist, blocklist, or...
CVE-2026-34502
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3...
CVE-2026-32327
A bug in APR-util version 1.6.3 and earlier allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the aprxmlquoteelem function. Users are recommended to upgrade to version 1.6.4, which fixes this issue...
CVE-2026-34501
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue...
CVE-2026-28183
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-32469
Unauthenticated Bypass Vulnerability in CAPTCHA 4WP = 7.6.0 versions...
CVE-2026-34191
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Portable Runtime Utility via aprdbdoracle provider. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3...
CVE-2026-32548
Unauthenticated Broken Access Control in SureCart = 4.6.2 versions...
CVE-2026-28169
Unauthenticated Sensitive Data Exposure in YITH WooCommerce Zoom Magnifier = 2.52.0 versions...
CVE-2026-28172
Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...
CVE-2026-28180
Unauthenticated Insecure Direct Object References IDOR in Mercado Pago payments for WooCommerce = 8.9.0 versions...
CVE-2026-28146
Contributor Arbitrary File Download in Unlimited Elements For Elementor Free Widgets, Addons, Templates = 2.0.14 versions...