[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-46569 | 7 Oct 2026 | CVSS 7.7 | Tuxera ntfs-3gIn NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ib_copy_tail(), in libntfs-3g/index.c, that allows an attacker to corrupt heap… | Fix |
| CVE-2026-46571 | 7 Oct 2026 | CVSS 5.5 | Tuxera ntfs-3gIn NTFS-3G before 2026.7.7, a out-of-bounds read exists in ntfs_fix_file_name() in libntfs-3g/reparse.c that allows an attacker to read possibly… | Fix |
| CVE-2026-107183 | 7 Oct 2026 | CVSS 8.1 | ggml-org llama.cppllama.cpp before b11393 contains a use-after-free and double free vulnerability in common_chat_peg_mapper::map that allows unauthenticated remote… | |
| CVE-2026-107194 | 7 Oct 2026 | CVSS 9.2 | Sungrow iSolarCloudSungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially leading… | |
| CVE-2026-42616 | 7 Oct 2026 | CVSS 7.8 | Tuxera ntfs-3gIn NTFS-3G before 2026.7.7, a heap buffer overflow exists in cat() in ntfscat.c that allows an attacker to corrupt heap memory in the ntfscat binary… | Fix |
| CVE-2026-42617 | 7 Oct 2026 | CVSS 7.1 | Tuxera ntfs-3gIn NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_ir_to_ib() in index.c that allows an attacker to corrupt heap memory in the… | Fix |
| CVE-2026-42618 | 7 Oct 2026 | CVSS 7.1 | Tuxera ntfs-3gIn NTFS-3G before 2026.7.7, a heap buffer overflow exists in ntfs_decompress() in compress.c that allows an attacker to corrupt one byte of heap… | Fix |
| CVE-2026-43976 | 7 Oct 2026 | CVSS 7.1 | wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)wger is a free, open-source workout and fitness manager. Prior to version 2.6, five gym management views in wger apply a flawed gym-scope guard… | |
| CVE-2026-107181 | 7 Oct 2026 | CVSS 8.1 | Telegram DesktopTelegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN… | |
| CVE-2026-102257 | 7 Oct 2026 | CVSS 7.2 | SonicWall SMA1000A Zip Slip vulnerability in the in the SMA1000 Appliance Management Console (AMC) interface allows an attacker to extract files outside the intended… | Fix |
| CVE-2026-102258 | 7 Oct 2026 | CVSS 6.1 | SonicWall SMA1000Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in… | Fix |
| CVE-2026-98374 | 7 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When… | |
| CVE-2026-107180 | 7 Oct 2026 | CVSS 7.1 | MISPOn MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup… | |
| CVE-2026-41958 | 7 Oct 2026 | CVSS 6.5 | visidataA path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A… | |
| CVE-2026-42532 | 7 Oct 2026 | CVSS 5.5 | visidataA path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A specially… | |
| CVE-2026-98373 | 7 Oct 2026 | Not scored yet | LinuxIn the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: preserve mremap address delta when skipping page tables… | |
| CVE-2026-107168 | 7 Oct 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing… | |
| CVE-2026-107170 | 7 Oct 2026 | CVSS 2.9 | Red Hat Enterprise Linux 10A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific… | |
| CVE-2026-107175 | 7 Oct 2026 | CVSS 5.3 | MISPMISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution… | |
| CVE-2026-107177 | 7 Oct 2026 | CVSS 5.9 | ExpressGateway express-gatewayExpress Gateway through 1.16.11 contains a hardcoded cryptographic key vulnerability that allows attackers with datastore access to decrypt stored… | |
| CVE-2026-105139 | 7 Oct 2026 | CVSS 4.3 | obot-platform obotObot 0.26.0 before 0.26.2 contains an authorization bypass vulnerability that allows authenticated users matching any vMCP profile to reach prompts… | |
| CVE-2026-105140 | 7 Oct 2026 | CVSS 4.2 | obot-platform obotObot 0.25.0 before 0.25.6 and 0.26.0 before 0.26.1 contains a race condition in auth provider group refreshes that can restore group memberships just… | |
| CVE-2026-107151 | 7 Oct 2026 | CVSS 5.9 | Red Hat Satellite 6Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks… | |
| CVE-2026-107162 | 7 Oct 2026 | CVSS 6.8 | ExpressGateway express-gatewayExpress Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate the token… | |
| CVE-2026-102255 | 7 Oct 2026 | CVSS 10.0 | SonicWall SMA1000A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing… | Fix |
| CVE-2026-102256 | 7 Oct 2026 | CVSS 7.8 | SonicWall SMA1000Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in… | Fix |
| CVE-2026-103435 | 7 Oct 2026 | CVSS 7.7 | Anthropic @anthropic-ai/claude-codeClaude Code validated that a target file path resided within the project working directory at permission-check time, but re-resolved the path at… | |
| CVE-2026-105138 | 7 Oct 2026 | CVSS 6.5 | obot-platform obotObot 0.12.0 before 0.26.2 contains an insufficiently protected credentials vulnerability that allows authenticated users to read static secrets set… | |
| CVE-2026-106059 | 7 Oct 2026 | CVSS 8.8 | gitaheadGitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repository… | |
| CVE-2026-107159 | 7 Oct 2026 | CVSS 6.5 | miniupnp project miniupnpdMiniUPnPd through 2.3.11 built with --strict contains a divide-by-zero vulnerability in ProcessSSDPData() that allows unauthenticated local network… | |
| CVE-2026-42708 | 7 Oct 2026 | CVSS 7.6 | AF themes WP Post AuthorImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AF themes WP Post Author wp-post-author allows… | |
| CVE-2026-42710 | 7 Oct 2026 | CVSS 7.6 | 10Web Slider by 10WebImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in 10Web Slider by 10Web slider-wd allows Blind… | |
| CVE-2026-106056 | 7 Oct 2026 | CVSS 7.5 | rundeckRundeck before 6.2.0 contains an OS command injection vulnerability that allows authenticated users with job run permission to execute commands on… | |
| CVE-2026-106057 | 7 Oct 2026 | CVSS 7.8 | wummel patoolpatool before 4.0.6 contains an OS command injection vulnerability on Windows because shell_quote_nt fails to escape cmd.exe metacharacters or… | |
| CVE-2026-106058 | 7 Oct 2026 | CVSS 7.5 | gitaheadGitAhead through 2.7.1 contains an OS command injection vulnerability in src/git/Filter.cpp that allows malicious repositories to execute commands by… | |
| CVE-2026-92531 | 7 Oct 2026 | CVSS 7.5 | BugTracker.NETOperating system command injection vulnerability in the SVN integration component of BugTracker.NET. The application incorporates the value of the… | |
| CVE-2026-92532 | 7 Oct 2026 | CVSS 7.5 | BugTracker.NETUnrestricted file upload vulnerability in the BugTracker.NET attachment functionality. An authenticated user with administrator privileges could… | |
| CVE-2026-92533 | 7 Oct 2026 | CVSS 7.1 | BugTracker.NETPath traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate… | |
| CVE-2026-96408 | 7 Oct 2026 | CVSS 9.3 | Six Apart Ltd. Movable Type Cloud EditionA code injection vulnerability exists in the upgrade script of Movable Type, which may allow an unauthenticated attacker to execute an arbitrary Perl… | |
| CVE-2026-42713 | 7 Oct 2026 | CVSS 7.6 | Gopiplus Post title marquee scrollImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll… | |
| CVE-2026-42714 | 7 Oct 2026 | CVSS 7.6 | Piggly Dev Pix por Piggly (para Woocommerce)Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Piggly Dev Pix por Piggly (para Woocommerce)… | |
| CVE-2026-103668 | 7 Oct 2026 | CVSS 8.8 | Six Apart Ltd. Movable Type Cloud EditionAn SQL Injection vulnerability exists in the Site Search function of Movable Type, which may allow an unauthenticated attacker to execute an… | |
| CVE-2026-97294 | 7 Oct 2026 | CVSS 6.5 | David Lingren Media LIbrary AssistantImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant… | |
| CVE-2026-97146 | 7 Oct 2026 | CVSS 4.8 | Apache Software Foundation Apache YuniKornApache YuniKorn 1.9.0 and earlier allows bypassing the check for the user annotation by setting a secondary label on the pod. If the pod has the… | |
| CVE-2026-92393 | 7 Oct 2026 | CVSS 2.0 | Apache Software Foundation Apache YuniKornApache YuniKorn 1.9.0 and earlier does not implement label and user annotation checks for workload UPDATE action bypassing all checks. Workloads in… | |
| CVE-2026-78243 | 7 Oct 2026 | CVSS 2.1 | Apache Software Foundation Apache YuniKornApache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membership… | |
| CVE-2026-105873 | 7 Oct 2026 | CVSS 6.5 | BdThemes Element Pack Elementor AddonsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons… | |
| CVE-2026-105875 | 7 Oct 2026 | CVSS 6.5 | BdThemes Prime Slider – Addons For ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor… | |
| CVE-2026-105876 | 7 Oct 2026 | CVSS 5.3 | WP Chill Modula Image GalleryMissing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This issue… | |
| CVE-2026-105884 | 7 Oct 2026 | CVSS 6.5 | WP Media Rocket Lazy LoadImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load… | |
| CVE-2026-27434 | 7 Oct 2026 | CVSS 5.3 | sc Internet Vivoo WP RentalsMissing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-42720 | 7 Oct 2026 | CVSS 7.6 | Sarah Giles Dynamic User DirectoryImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory… | |
| CVE-2026-42721 | 7 Oct 2026 | CVSS 7.6 | SERVIT Software Solutions affiliate-toolkitImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-toolkit… | |
| CVE-2026-105871 | 7 Oct 2026 | CVSS 6.5 | BdThemes Element Pack Elementor AddonsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons… | |
| CVE-2026-105192 | 7 Oct 2026 | CVSS 9.8 | LMCache: Remote code execution via unsafe deserialization in multiprocess mode transportLMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache… | Fix |
| CVE-2026-104390 | 7 Oct 2026 | CVSS 4.3 | Arraytics BookticsMissing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-104391 | 7 Oct 2026 | CVSS 6.5 | ExpressTech Quiz And Survey MasterImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master… | |
| CVE-2026-104393 | 7 Oct 2026 | CVSS 6.5 | weDevs Happy Addons for ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor… | |
| CVE-2026-103075 | 7 Oct 2026 | CVSS 4.3 | WPMU DEV HustleMissing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This… | |
| CVE-2026-93026 | 7 Oct 2026 | CVSS 6.1 | Veeam Backup and ReplicationThis vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update… | Fix |
| CVE-2026-93684 | 7 Oct 2026 | CVSS 5.4 | Apache Software Foundation Apache ImpalaAn SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another… | |
| CVE-2026-97720 | 7 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache ImpalaIncorrect implementation of JWT/OAuth authentication in Impala executors in Apache Impala versions up to and including 4.5.2 which allows attacked to… | |
| CVE-2026-107104 | 7 Oct 2026 | CVSS 9.3 | Manacle Technologies Multi-tenant ERP SystemThis vulnerability exists in the ERP system due to unsafe deserialization of user controlled data in the affected functionality. An unauthenticated… | |
| CVE-2026-15894 | 7 Oct 2026 | CVSS 8.8 | zephyrproject zephyrThe Bluetooth Mesh On-Demand Private Proxy solicitation handler in subsys/bluetooth/mesh/solicitation.c copies a received Solicitation PDU into a… | |
| CVE-2026-19186 | 7 Oct 2026 | CVSS 8.1 | zephyrproject zephyrieee802154_decipher_data_frame() in subsys/net/l2/ieee802154/ieee802154_frame.c computed payload_len = net_pkt_get_len(pkt) - ll_hdr_len -… | |
| CVE-2026-58068 | 7 Oct 2026 | CVSS 6.8 | Veeam Agent for WindowsThis vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. | |
| CVE-2026-58069 | 7 Oct 2026 | CVSS 8.3 | Veeam Backup and ReplicationThis vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host. | |
| CVE-2026-5703 | 7 Oct 2026 | CVSS 7.1 | Satel Iberia SenNet Datalogger Serie 200Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an… | |
| CVE-2026-89417 | 7 Oct 2026 | CVSS 7.2 | daanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search… | |
| CVE-2026-90466 | 7 Oct 2026 | CVSS 6.5 | Apache Software Foundation Apache ImpalaPath traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a… | |
| CVE-2025-64392 | 7 Oct 2026 | CVSS 4.8 | Veeam Backup Enterprise ManagerThis vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link. | Fix |
| CVE-2025-64393 | 7 Oct 2026 | CVSS 9.4 | Veeam Backup and ReplicationThis vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | Fix |
| CVE-2026-102781 | 7 Oct 2026 | CVSS 6.9 | ordasoft.com Touch Slider extension for JoomlaJoomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6 - modOsTouchSliderHelper::getAjax(), wired… | |
| CVE-2026-102782 | 7 Oct 2026 | CVSS 9.3 | ordasoft.com OrdaSoft Simple Membership extension for JoomlaJoomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Simple Membership < 7.4.0 - site/simplemembership.php dispatches… | |
| CVE-2026-103416 | 7 Oct 2026 | CVSS 9.3 | Eclipse Foundation Eclipse ThreadX - NetX DuoOut-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger… | |
| CVE-2026-107102 | 7 Oct 2026 | CVSS 9.3 | Manacle Technologies Multi-tenant ERP SystemThis vulnerability exists in the ERP system due to improper validation of payment callback parameters and inadequate authentication controls in API… | |
| CVE-2026-107103 | 7 Oct 2026 | CVSS 9.3 | Manacle Technologies Multi-tenant ERP SystemThis vulnerability exists in the ERP system due to insufficient validation and parameterization of user supplied input in an API endpoint. An… | |
| CVE-2025-64391 | 7 Oct 2026 | CVSS 4.1 | Veeam Agent for WindowsThis vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when… | |
| CVE-2026-107121 | 7 Oct 2026 | CVSS 6.5 | Red Hat Build of KeycloakA flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to… | |
| CVE-2026-96530 | 7 Oct 2026 | CVSS 6.5 | Unknown OptimoleThe Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a… | |
| CVE-2026-97188 | 7 Oct 2026 | CVSS 8.8 | Unknown String locatorThe String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content of a database row saved through… | |
| CVE-2026-97331 | 7 Oct 2026 | CVSS 4.3 | Unknown User Private FilesThe User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document being operated on before… | |
| CVE-2026-97354 | 7 Oct 2026 | CVSS 4.1 | Unknown PowerPress Podcasting plugin by BlubrryThe PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.11 does not validate the destination of redirects when fetching a… | |
| CVE-2026-82211 | 7 Oct 2026 | CVSS 8.2 | Unknown Nexi XPay BuildThe Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing… | |
| CVE-2026-82212 | 7 Oct 2026 | CVSS 7.5 | Unknown Nexi XPay BuildThe Nexi XPay Build WordPress plugin through 7.6.2 does not correctly validate the security token on its payment notification route, accepting the… | |
| CVE-2026-86816 | 7 Oct 2026 | CVSS 5.3 | Unknown WPCafeThe WPCafe WordPress plugin before 3.0.21 does not restrict access to some of its REST API endpoints, allowing unauthenticated attackers to read… | |
| CVE-2026-86833 | 7 Oct 2026 | CVSS 5.4 | Unknown MetFormThe MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its… | |
| CVE-2026-87782 | 7 Oct 2026 | CVSS 8.8 | Unknown Koinonia LinkThe Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a role selection submitted with a… | |
| CVE-2026-87971 | 7 Oct 2026 | CVSS 7.1 | Unknown If-So Dynamic ContentThe If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a… | |
| CVE-2026-105316 | 7 Oct 2026 | CVSS 7.1 | Unknown Magee ShortcodesThe Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to… | |
| CVE-2026-105322 | 7 Oct 2026 | CVSS 5.3 | Unknown Magee ShortcodesThe Magee Shortcodes WordPress plugin through 2.1.1 does not restrict the recipient of some of its unauthenticated contact-form actions, allowing… | |
| CVE-2026-104653 | 7 Oct 2026 | CVSS 6.8 | Unknown Envira GalleryThe Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them… | |
| CVE-2026-104667 | 7 Oct 2026 | CVSS 6.8 | Unknown Animated Number CountersThe Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it… | |
| CVE-2026-104677 | 7 Oct 2026 | CVSS 7.2 | Unknown WP CoderThe WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to administrators, gating it on a content… | |
| CVE-2026-104678 | 7 Oct 2026 | CVSS 2.7 | Unknown CP Media PlayerThe CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only… | |
| CVE-2026-104953 | 7 Oct 2026 | CVSS 6.8 | Unknown MPGThe MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing… | |
| CVE-2026-103323 | 7 Oct 2026 | CVSS 5.9 | Unknown Integration for Epos Now and WooCommerceThe Integration for Epos Now and WooCommerce WordPress plugin before 4.11.2 does not perform an authorization check on one of its REST endpoints… | |
| CVE-2026-103378 | 7 Oct 2026 | CVSS 6.5 | Unknown Geliver Akıllı Kargo PazaryeriThe Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own… | |
| CVE-2026-103681 | 7 Oct 2026 | CVSS 4.3 | Unknown Frontend DashboardThe Frontend Dashboard WordPress plugin before 3.0.0 does not perform a capability check in one of its AJAX actions, allowing authenticated users… | |
| CVE-2026-104049 | 7 Oct 2026 | CVSS 4.3 | Unknown Academy LMSThe Academy LMS WordPress plugin before 4.0.0 does not verify course enrollment or object ownership when returning a lesson's content through one of… |
Page 106 of 168