380152 matches found
CVE-2026-45120
MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by getevents in inc/functionscalendar.php...
CVE-2026-15806
The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also us...
CVE-2026-19501
CSV export functionality in Brainstorm Force SureForms version, = 2.1.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the...
CVE-2026-19500
The Entries component in Brainstorm Force SureForms version, less than 2.1.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the...
CVE-2026-12564
A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetesauth function in awxplugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential wi...
CVE-2026-75898
RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...
CVE-2026-75872
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-75890
Rejected reason: Duplicate of CVE-2026-50236. This CVE ID was reserved in error for a finding that already had an existing CVE assignment...
CVE-2026-75784
A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched...
CVE-2026-75032
A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile AVRCP implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the...
CVE-2026-74008
Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme = 2.17.22 versions...
CVE-2026-74007
Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery = 1.16.20 versions...
CVE-2026-74004
Subscriber Broken Access Control in Gravity Booster Styles & Layouts for Gravity Forms = 6.0 versions...
CVE-2026-74012
Editor PHP Object Injection in TaxoPress = 3.51.0 versions...
CVE-2026-74006
Contributor Broken Access Control in WP Table Builder = 2.2.0 versions...
CVE-2026-74015
Unauthenticated SQL Injection in Readabler 2.0.18 versions...
CVE-2026-74009
Unauthenticated Insecure Direct Object References IDOR in Razorpay for WooCommerce = 4.8.7 versions...
CVE-2026-73995
Subscriber Broken Authentication in User Registration = 5.2.6 versions...
CVE-2026-73997
Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP = 2.3.3 versions...
CVE-2026-73994
Unauthenticated Broken Access Control in Charitable = 1.8.11.3 versions...
CVE-2026-73996
Unauthenticated Arbitrary File Upload in Masteriyo - LMS = 2.3.2 versions...
CVE-2026-74003
Contributor Broken Access Control in RomethemeForm For Elementor = 1.2.6 versions...
CVE-2026-73426
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...
CVE-2026-73398
Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions...
CVE-2026-73399
Unauthenticated Broken Authentication in Flutterwave WooCommerce = 3.3.0 versions...
CVE-2026-73404
Subscriber Broken Access Control in MasterStudy LMS = 3.7.41 versions...
CVE-2026-73397
Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...
CVE-2026-73400
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...
CVE-2026-73392
Unauthenticated SQL Injection in Super Store Finder = 7.8 versions...
CVE-2026-73383
Shop manager Arbitrary File Download in CTX Feed = 6.6.47 versions...
CVE-2026-73393
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
CVE-2026-73396
Subscriber Broken Authentication in MWB HubSpot for WooCommerce = 1.6.7 versions...
CVE-2026-73380
Unauthenticated PHP Object Injection in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73381
Unauthenticated Broken Authentication in Popup by Supsystic = 1.13.0 versions...
CVE-2026-73382
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73395
Unauthenticated Insecure Direct Object References IDOR in Booking calendar, Appointment Booking System = 3.2.36 versions...
CVE-2026-73375
Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73367
Unauthenticated Remote File Inclusion in Easy Google Maps 1.14.2 versions...
CVE-2026-73379
Unauthenticated Bypass Vulnerability in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-73377
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73376
Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73378
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-73365
Unauthenticated SQL Injection in JetAppointment = 2.5.2 versions...
CVE-2026-73360
Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...
CVE-2026-73358
Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...
CVE-2026-73359
Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...
CVE-2026-73366
Unauthenticated PHP Object Injection in Easy Google Maps = 1.13.0 versions...
CVE-2026-73361
Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...