197466 matches found
CVE-2026-75819 Out-of-bounds Read in GNU Aspell
GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load in readonlyws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An attacker can trigger this by convincing a...
CVE-2026-75818 Heap Buffer Overflow in GNU Aspell's prezip utility
GNU Aspell prezip-bin contains a heap-based buffer overflow vulnerability in the decompressor in prog/prezip.c. The decompressor does not properly check buffer space, so a crafted compressed file can cause out-of-bounds read and write operations on the heap. An attacker who convinces a user to...
CVE-2026-103831 Insecure deserialization in the TrueLayer Magento 2 plugin
CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize function without restrictions on the classes allowed when retrieving data stored in the cache. An attacker who already has the...
CVE-2026-105985 Authenticated RCE via render-components Entry Type overrides
Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding...
CVE-2026-84854 Out of Bound Write on WibuKey for Windows
In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...
CVE-2026-80327 Open Redirect in PingGateway Fragment Filter
An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 and later...
CVE-2026-104399 WordPress Motors plugin <= 1.4.124 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124...
CVE-2026-94206 Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloakecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that...
CVE-2026-95105 Cloak AES-CTR cipher lacks ciphertext authentication, allowing chosen-plaintext forgery by bit flipping
Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR...
CVE-2026-105317 WordPress Paid Member Subscriptions plugin <= 3.1.1 - SQL Injection vulnerability
Subscriber SQL Injection in Paid Member Subscriptions = 3.1.1 versions...
CVE-2026-105071 WordPress SiteVault – Backup, Restore, Migration & Cloning plugin <= 1.5.17 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning = 1.5.17 versions...
CVE-2026-105070 WordPress Salon booking system plugin <= 10.31.7 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in Salon booking system = 10.31.7 versions...
CVE-2026-105061 WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Mailster = 1.9.0.0 versions...
CVE-2026-105059 WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1...
CVE-2026-105058 WordPress WP User Profiles plugin <= 2.7.3 - Privilege Escalation vulnerability
Subscriber Privilege Escalation in WP User Profiles = 2.7.3 versions...
CVE-2026-105057 WordPress Zero Spam plugin <= 5.7.11 - Bypass vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Zero Spam = 5.7.11 versions...
CVE-2026-104814 WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Form Block = 1.8.1 versions...
CVE-2026-104757 WordPress Import and export users and customers plugin <= 2.5.5 - Privilege Escalation vulnerability
Editor Privilege Escalation in Import and export users and customers = 2.5.5 versions...
CVE-2026-104672 WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in GiveWP = 4.17.0 versions...
CVE-2026-104747 WordPress Haaken theme <= 1.5 - PHP Object Injection vulnerability
Unauthenticated PHP Object Injection in Haaken = 1.5 versions...
CVE-2026-104670 WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in LearnPress = 4.4.9 versions...
CVE-2026-104406 WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in picu = 3.10.1 versions...
CVE-2026-104405 WordPress GiveWP plugin <= 4.17.0 - Privilege Escalation vulnerability
Unauthenticated Privilege Escalation in GiveWP = 4.17.0 versions...
CVE-2026-104395 WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in picu = 3.10.1 versions...
CVE-2026-104387 WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PowerPress Podcasting = 11.17.9 versions...
CVE-2026-104394 WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Charitable = 1.8.12.3 versions...
CVE-2026-104385 WordPress Groundhogg plugin <= 4.8.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Groundhogg = 4.8.3 versions...
CVE-2026-102915 WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPO365 = 44.1 versions...
CVE-2026-102387 WordPress Xserver Migrator plugin <= 1.6.6 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Xserver Migrator = 1.6.6 versions...
CVE-2026-100518 WordPress Advanced Google reCAPTCHA plugin <= 5.40 - Broken Authentication vulnerability
Unauthenticated Broken Authentication in Advanced Google reCAPTCHA = 5.40 versions...
CVE-2026-95594 WordPress SMS Alert Order Notifications plugin <= 4.0.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications sms-alert allows Privilege Escalation.This issue affects SMS Alert Order Notifications: from n/a through 4.0.0...
CVE-2026-97308 WordPress Login Lockdown plugin <= 2.17 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Login Lockdown = 2.17 versions...
CVE-2026-95526 WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BEAR = 1.2.2 versions...
CVE-2026-94675 WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack = 6.2.13 versions...
CVE-2026-62072 WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Progress Planner = 1.10.0 versions...
CVE-2026-66588
...
CVE-2026-48199 WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Sermon'e = 1.0.2 versions...
CVE-2026-48197 WordPress PublishPress Capabilities plugin <= 2.45.0 - Privilege Escalation vulnerability
Incorrect Privilege Assignment vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Privilege Escalation.This issue affects PublishPress Capabilities: from n/a through 2.45.0...
CVE-2026-42637 WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability
Unauthenticated Settings Change in PayPlug for WooCommerce Official = 3.1.0 versions...
CVE-2026-42638 WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1...
CVE-2026-42636 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.4.6 versions...
CVE-2026-42635 WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WooCommerce Simple Auctions = 3.0.10 versions...
CVE-2026-42634 WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Video Background Block – Use video as background in the section. = 2.0.3 versions...
CVE-2026-42418 WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5...
CVE-2026-42417 WordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerability
Unauthenticated SQL Injection in ARMember Premium = 7.8 versions...
CVE-2026-42415 WordPress Porto Theme - Functionality plugin <= 3.9.3 - SQL Injection vulnerability
Unauthenticated SQL Injection in Porto Theme - Functionality = 3.9.3 versions...
CVE-2026-42416 WordPress UDesign Core plugin <= 4.15.0 - SQL Injection vulnerability
Subscriber SQL Injection in UDesign Core = 4.15.0 versions...
CVE-2026-42414 WordPress ListingPro plugin <= 2.9.12 - SQL Injection vulnerability
Subscriber SQL Injection in ListingPro = 2.9.12 versions...
CVE-2026-42413 WordPress Snapshotify – All-in-One Backup & Restore & Migrate plugin <= 1.3.2 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Snapshotify All-in-One Backup & Restore & Migrate = 1.3.2 versions...