380178 matches found
CVE-2026-66651
Unauthenticated Broken Access Control in MultiVendorX = 5.0.14 versions...
CVE-2026-66643
Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...
CVE-2026-66646
Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...
CVE-2026-66679
Unauthenticated Broken Access Control in Appointment Hour Booking = 1.5.91 versions...
CVE-2026-66667
Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...
CVE-2026-66644
Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...
CVE-2026-66635
Unauthenticated Cross Site Request Forgery CSRF in Slider by 10Web = 1.2.62 versions...
CVE-2026-66636
Contributor Cross Site Scripting XSS in Wise Chat = 3.4 versions...
CVE-2026-66641
Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...
CVE-2026-66637
Contributor Cross Site Scripting XSS in Featured Video Plus = 2.3.3 versions...
CVE-2026-66638
Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...
CVE-2026-66640
Contributor Cross Site Scripting XSS in Login With Ajax = 4.5.1 versions...
CVE-2026-66639
Contributor Cross Site Scripting XSS in WPZOOM Forms – Contact Form Plugin for Gutenberg = 2.0.4 versions...
CVE-2026-66627
Contributor Arbitrary File Upload in GP Premium = 2.5.5 versions...
CVE-2026-66634
Subscriber Insecure Direct Object References IDOR in Modal Survey = 2.0.2.2.3 versions...
CVE-2026-66633
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...
CVE-2026-66046
Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an ON^2 linear scan of elementType-defaultAtts to determine CDATA status. ...
CVE-2026-66621
Unauthenticated Cross Site Scripting XSS in Ultimate Dashboard = 3.11.2 versions...
CVE-2026-66620
Editor PHP Object Injection in OptionTree = 2.7.3 versions...
CVE-2026-66622
Unauthenticated SQL Injection in Depicter Slider = 4.8.0 versions...
CVE-2026-66629
Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...
CVE-2026-59949
yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.1, JNI-backed XXHash implementations fail to validate the byte array object and the off and len arguments in XXHashFactory.nativeInstance.hash32.hash, XXHashFactory.nativeInstance.hash64.hash,...
CVE-2026-63632
Open Neural Network Exchange ONNX is an open standard for machine learning interoperability. From 1.3.0 until 1.22.0, onnx.versionconverter.convertversion can perform an out-of-bounds read in Gemm76::adaptgemm76 in onnx/versionconverter/adapters/gemm76.h when a Gemm node has input tensors with...
CVE-2026-63639
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization, causing a use-after-free when...
CVE-2026-61407
Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Privilege Escalation...
CVE-2026-59940
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...
CVE-2026-56684
Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pendinglist while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a...
CVE-2026-59825
Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...
CVE-2026-50187
Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSHDOTENVFILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the fil...
CVE-2026-45733
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...
CVE-2026-50139
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, ShareHandler reads the share token's DownloadLimit under RLock, releases the lock, serves the file, then re-acquires the lock to increment the counter. Concurrent requests all read the same Downloaded/DownloadLimit snapshot, all...
CVE-2026-50138
goshs is a SimpleHTTPServer written in Go. Prior to version 2.1.0, when goshs is launched with WebDAV enabled -w, the mode-restriction flags --read-only, --upload-only, and --no-delete are enforced only on the primary HTTP port. The WebDAV port is wired straight to golang.org/x/net/webdav.Handler...
CVE-2026-48798
SSH.NET is a Secure Shell SSH library for .NET. In 2025.1.0 and earlier, ScpClient.Downloadstring directoryName, DirectoryInfo directoryInfo trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment validation, allowin...
CVE-2026-32547
Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...
CVE-2026-32474
Contributor Arbitrary File Upload in Templatiq = 0.2.5 versions...
CVE-2026-32553
Unauthenticated Server Side Request Forgery SSRF in OttoKit = 1.1.35 versions...
CVE-2026-32549
Unauthenticated Broken Access Control in ThumbPress 6.5 versions...
CVE-2026-32481
Unauthenticated Broken Authentication in Ezoic = 2.22.11 versions...
CVE-2026-32473
Unauthenticated Server Side Request Forgery SSRF in PDF Smart Viewer for Elementor = 1.0.4 versions...
CVE-2026-32472
Unauthenticated Broken Access Control in Online Contact Widget = 1.3.0 versions...
CVE-2026-32470
Unauthenticated PHP Object Injection in FundEngine = 1.7.9 versions...
CVE-2026-18534
ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing risk...
CVE-2026-73692
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
CVE-2026-50575
BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are...
CVE-2026-32468
Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway = 2.11.14 versions...
CVE-2026-32467
Subscriber Server Side Request Forgery SSRF in Aotuman Grab WeChat Articles = 2.0.1 versions...
CVE-2026-32444
Contributor Remote Code Execution RCE in Cwicly = 1.4.4 versions...
CVE-2026-32333
Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...