[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-88392 | 5 Oct 2026 | CVSS 7.5 | VulnerabilityUnimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code. | |
| CVE-2026-88394 | 5 Oct 2026 | CVSS 7.5 | VulnerabilityWookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary… | |
| CVE-2026-105421 | 5 Oct 2026 | CVSS 5.3 | Kit (formerly ConvertKit) for WooCommerceMissing Authorization vulnerability in Kit Kit (formerly ConvertKit) for WooCommerce convertkit-for-woocommerce allows Exploiting Incorrectly… | |
| CVE-2026-92931 | 5 Oct 2026 | CVSS 8.8 | Progress Software @progress/sitefinity-nextjs-sdkCWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may allow a… | |
| CVE-2026-77802 | 5 Oct 2026 | CVSS 6.3 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy request… | |
| CVE-2026-77803 | 5 Oct 2026 | CVSS 3.6 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in the proxy… | |
| CVE-2026-77804 | 5 Oct 2026 | CVSS 6.6 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition exists in… | |
| CVE-2026-77805 | 5 Oct 2026 | CVSS 7.9 | Progress Software Progress® Telerik® Fiddler® ClassicIn Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, the integrity check applied to the external helper tools… | |
| CVE-2026-105315 | 5 Oct 2026 | CVSS 4.7 | django-haystackA vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file… | |
| CVE-2026-63270 | 5 Oct 2026 | CVSS 6.7 | The Document Foundation LibreOfficeURLs could be constructed which expanded environment variable or INI file values, so potentially sensitive information could be exfiltrated to a… | |
| CVE-2026-63277 | 5 Oct 2026 | CVSS 8.5 | The Document Foundation LibreOfficeLibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A document could name a Java database… | Fix |
| CVE-2026-63266 | 5 Oct 2026 | CVSS 6.8 | The Document Foundation LibreOfficeLibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. Through such a link a document could open… | |
| CVE-2026-63267 | 5 Oct 2026 | CVSS 6.7 | The Document Foundation LibreOfficeLibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the… | |
| CVE-2026-63268 | 5 Oct 2026 | CVSS 6.7 | The Document Foundation LibreOfficeLibreOffice Calc can link a cell range to an external data source, and the link is saved in the document. A link of the sql type could name a folder… | |
| CVE-2026-63269 | 5 Oct 2026 | CVSS 6.7 | The Document Foundation LibreOfficeLibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS… | |
| CVE-2026-105073 | 5 Oct 2026 | CVSS 5.3 | Arraytics WP Event SolutionExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Arraytics WP Event Solution wp-event-solution allows… | |
| CVE-2026-105307 | 5 Oct 2026 | CVSS 7.3 | CasdoorA vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the component API… | |
| CVE-2026-105396 | 5 Oct 2026 | CVSS 5.4 | heymrun heymHeym before v0.0.112 contains a token leakage vulnerability in build_public_base_url() that allows unauthenticated attackers to redirect HITL review… | |
| CVE-2026-39783 | 5 Oct 2026 | CVSS 4.3 | WP SYNTEX PolylangMissing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a… | |
| CVE-2026-103684 | 5 Oct 2026 | CVSS 5.3 | Arraytics WP Event SolutionMissing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-94669 | 5 Oct 2026 | CVSS 5.3 | WP ManageNinja LLC Fluent Forms Pro Add On PackMissing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access… | |
| CVE-2026-59788 | 5 Oct 2026 | CVSS 5.7 | ZabbixThe email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript: URL is… | Fix |
| CVE-2026-59782 | 5 Oct 2026 | CVSS 6.9 | ZabbixThe JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap data… | Fix |
| CVE-2026-59783 | 5 Oct 2026 | CVSS 2.3 | ZabbixThe Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential loss of… | Fix |
| CVE-2026-59785 | 5 Oct 2026 | CVSS 5.1 | ZabbixHost search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read access can… | Fix |
| CVE-2026-59786 | 5 Oct 2026 | CVSS 6.9 | ZabbixZabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means someone… | Fix |
| CVE-2026-59787 | 5 Oct 2026 | CVSS 5.3 | ZabbixThe Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means someone… | Fix |
| CVE-2026-39763 | 5 Oct 2026 | CVSS 4.3 | Deepak Anand WP Dummy Content GeneratorMissing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured… | |
| CVE-2026-105289 | 5 Oct 2026 | CVSS 3.5 | feelec-yishu feelcrm-osA vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialchars_decode of the file… | |
| CVE-2026-105290 | 5 Oct 2026 | CVSS 7.3 | feelec-yishu feelcrm-osA vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file… | |
| CVE-2026-105291 | 5 Oct 2026 | CVSS 4.3 | feelec-yishu feelcrm-osA vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file… | |
| CVE-2026-105286 | 5 Oct 2026 | CVSS 6.3 | Totolink A3002MUA vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub_44B250 of the file /boafrm/formUploadFile of the… | |
| CVE-2026-105287 | 5 Oct 2026 | CVSS 6.3 | feelec-yishu feelcrm-osA flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file… | |
| CVE-2026-105288 | 5 Oct 2026 | CVSS 4.3 | feelec-yishu feelcrm-osA vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file… | |
| CVE-2026-19395 | 5 Oct 2026 | CVSS 6.6 | Qt for MCUsIn Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the text contains an attribute with an empty value. The… | |
| CVE-2026-105285 | 5 Oct 2026 | CVSS 10.0 | Totolink A3002MUA security vulnerability has been detected in Totolink A3002MU 1.0.0-B20230403.1455. This affects an unknown function of the file /boafrm/formIpQoS… | |
| CVE-2026-19185 | 5 Oct 2026 | CVSS 7.8 | zephyrproject zephyrThe system-call verifier for i3c_do_ccc() in drivers/i3c/i3c_handlers.c validated the outer struct i3c_ccc_payload, the broadcast ccc.data buffer and… | |
| CVE-2026-39721 | 5 Oct 2026 | CVSS 5.4 | Brainstorm Force Starter TemplatesMissing Authorization vulnerability in Brainstorm Force Starter Templates astra-sites allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-97071 | 5 Oct 2026 | CVSS 5.3 | VillaTheme CURCYIncorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through 2.2.17. | |
| CVE-2026-105263 | 5 Oct 2026 | CVSS 4.7 | ShaarliA security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file… | |
| CVE-2026-105284 | 5 Oct 2026 | CVSS 10.0 | Totolink A3002MUA weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub_40FCFC of the file /bin/boa of the… | |
| CVE-2026-19184 | 5 Oct 2026 | CVSS 8.4 | zephyrproject zephyrThe NXP GAU ADC driver (drivers/adc/adc_mcux_gau_adc.c) validated the caller-supplied sequence->buffer_size, which is expressed in bytes, against the… | |
| CVE-2026-105062 | 5 Oct 2026 | CVSS 4.3 | Brandtoss WP Admin AuditMissing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-105064 | 5 Oct 2026 | CVSS 6.5 | Unlimited Elements For Elementor (Free Widgets, Addons, Templates)Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Unlimited Elements Unlimited Elements For… | |
| CVE-2026-105068 | 5 Oct 2026 | CVSS 5.3 | Pixelite Events ManagerInsertion of Sensitive Information Into Sent Data vulnerability in Pixelite Events Manager events-manager allows Retrieve Embedded Sensitive… | |
| CVE-2026-105069 | 5 Oct 2026 | CVSS 6.5 | Nikki Blight QR RedirectorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows… | |
| CVE-2026-105251 | 5 Oct 2026 | CVSS 6.3 | vgmstreamA vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function ps_find_padding of the file… | |
| CVE-2026-105253 | 5 Oct 2026 | CVSS 7.3 | itsourcecode Online Admission System ProjectA vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file… | |
| CVE-2026-105254 | 5 Oct 2026 | CVSS 6.3 | itsourcecode Online Admission SystemA vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such… | |
| CVE-2026-104809 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the… | |
| CVE-2026-104810 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is… | |
| CVE-2026-104811 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product… | |
| CVE-2026-105055 | 5 Oct 2026 | CVSS 5.3 | WP MailsterMissing Authorization vulnerability in WP Mailster WP Mailster wp-mailster allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-105056 | 5 Oct 2026 | CVSS 6.5 | impleCode eCommerce Product CatalogImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog… | |
| CVE-2026-105060 | 5 Oct 2026 | CVSS 6.5 | Themepoints Logo ShowcaseImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Logo Showcase logo-showcase allows… | |
| CVE-2026-104675 | 5 Oct 2026 | CVSS 4.3 | Liquid Web / StellarWP Event TicketsMissing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-104706 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443… | |
| CVE-2026-104805 | 5 Oct 2026 | CVSS 8.5 | Mitel MiVoice Office 400DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup… | |
| CVE-2026-104806 | 5 Oct 2026 | CVSS 5.5 | Mitel MiVoice Office 400DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific… | |
| CVE-2026-104807 | 5 Oct 2026 | CVSS 1.9 | Mitel MiVoice Office 400DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent… | |
| CVE-2026-104808 | 5 Oct 2026 | CVSS 1.9 | Mitel MiVoice Office 400DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent… | |
| CVE-2026-104400 | 5 Oct 2026 | CVSS 6.5 | bPlugins B BlocksImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows Stored… | |
| CVE-2026-104401 | 5 Oct 2026 | CVSS 4.3 | Memberful - Membership PluginExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Memberful Memberful - Membership Plugin memberful-wp… | |
| CVE-2026-104404 | 5 Oct 2026 | CVSS 6.5 | Liquid Web / StellarWP GiveWPImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP GiveWP give allows… | |
| CVE-2026-104407 | 5 Oct 2026 | CVSS 7.1 | Blubrry Podcasting PowerPress PodcastingCross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue… | |
| CVE-2026-104408 | 5 Oct 2026 | CVSS 7.6 | GroundhoggImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Groundhogg Groundhogg groundhogg allows Blind… | |
| CVE-2026-104409 | 5 Oct 2026 | CVSS 6.5 | WP Chill Image Photo Gallery Final Tiles GridImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid… | |
| CVE-2026-104673 | 5 Oct 2026 | CVSS 6.5 | Sonaar MP3 Audio Player for Music, Radio & Podcast by SonaarImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sonaar MP3 Audio Player for Music, Radio &… | |
| CVE-2026-103511 | 5 Oct 2026 | CVSS 5.1 | Perforce P4 (Helix Core)Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or… | |
| CVE-2026-103512 | 5 Oct 2026 | CVSS 5.3 | Perforce P4 (Helix Core)Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen… | |
| CVE-2026-104386 | 5 Oct 2026 | CVSS 6.5 | WPFunnels Team WP VRMissing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… | |
| CVE-2026-104388 | 5 Oct 2026 | CVSS 5.3 | Blubrry Podcasting PowerPress PodcastingMissing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Retrieve Embedded Sensitive Data.This issue affects… | |
| CVE-2026-104389 | 5 Oct 2026 | CVSS 8.5 | SirvImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sirv Sirv sirv allows Blind SQL Injection.This… | |
| CVE-2026-104396 | 5 Oct 2026 | CVSS 6.5 | Jeroen Peters Name DirectoryImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Peters Name Directory name-directory… | |
| CVE-2026-104397 | 5 Oct 2026 | CVSS 5.3 | Jeroen Peters Name DirectoryMissing Authorization vulnerability in Jeroen Peters Name Directory name-directory allows Exploiting Incorrectly Configured Access Control Security… | |
| CVE-2026-102914 | 5 Oct 2026 | CVSS 6.5 | Brainstorm Force Presto PlayerImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player… | |
| CVE-2026-103078 | 5 Oct 2026 | CVSS 4.3 | Ahmad JS Help DeskAuthorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured… | |
| CVE-2026-103079 | 5 Oct 2026 | CVSS 5.4 | Ahmad JS Help DeskAuthorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured… | |
| CVE-2026-103084 | 5 Oct 2026 | CVSS 6.5 | LeapWorx Premium Addons for ElementorImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor… | |
| CVE-2026-103335 | 5 Oct 2026 | CVSS 5.3 | Deepen Bajracharya Video Conferencing with ZoomInsertion of Sensitive Information Into Sent Data vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api… | |
| CVE-2026-103351 | 5 Oct 2026 | CVSS 5.3 | Magepeople inc. Taxi Booking Manager for WooCommerceImproper Validation of Specified Quantity in Input vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager… | |
| CVE-2026-103507 | 5 Oct 2026 | CVSS 7.5 | Perforce P4 (Helix Core)Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the… | |
| CVE-2026-103510 | 5 Oct 2026 | CVSS 9.5 | Perforce P4 (Helix Core)P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated… | |
| CVE-2026-100102 | 5 Oct 2026 | CVSS 9.5 | Perforce P4 (Helix Core)Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this… | |
| CVE-2026-100103 | 5 Oct 2026 | CVSS 10.0 | Perfoce P4 (Helix Core)Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An… | |
| CVE-2026-102393 | 5 Oct 2026 | CVSS 6.5 | Brainstorm Force Starter TemplatesImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Starter Templates astra-sites… | |
| CVE-2026-105247 | 5 Oct 2026 | CVSS 7.3 | SourceCodester Online Reviewer Management SystemA vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file… | |
| CVE-2026-105248 | 5 Oct 2026 | CVSS 6.3 | vgmstreamA security flaw has been discovered in vgmstream up to r2117. This affects the function parse_params/txtp_parse of the file src/meta/txtp_parser.c of… | |
| CVE-2026-105249 | 5 Oct 2026 | CVSS 4.8 | vgmstreamA weakness has been identified in vgmstream up to r2117. This impacts the function make_group_random of the file src/meta/txtp_process.c of the… | |
| CVE-2026-105250 | 5 Oct 2026 | CVSS 4.3 | vgmstreamA security vulnerability has been detected in vgmstream up to r2117. Affected is the function decode_ms_ima of the file src/coding/ima_decoder.c of… | |
| CVE-2026-105314 | 5 Oct 2026 | CVSS 7.5 | PapermergePapermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be… | |
| CVE-2026-105238 | 5 Oct 2026 | CVSS 7.3 | ChatGPTNextWeb NextChatA flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of… | |
| CVE-2026-105245 | 5 Oct 2026 | CVSS 3.7 | sgl-project sglangA vulnerability has been found in sgl-project sglang up to 0.5.21. This issue affects the function server_info of the file… | |
| CVE-2026-105246 | 5 Oct 2026 | CVSS 7.3 | SourceCodester Online Reviewer Management SystemA vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file… | |
| CVE-2026-19954 | 5 Oct 2026 | CVSS 5.4 | VulnerabilityNet::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain names… | |
| CVE-2017-20285 | 5 Oct 2026 | CVSS 9.1 | VulnerabilityYAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A perl/hash:Class tag blesses a hash… | |
| CVE-2019-25777 | 5 Oct 2026 | CVSS 7.3 | VulnerabilityYAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution… | |
| CVE-2026-100727 | 5 Oct 2026 | CVSS 6.9 | GROWI, Inc. GROWIAn improper access control vulnerability exists in GROWI, which allow an unauthenticated attacker to read files contained in non-public pages of the… | |
| CVE-2026-84169 | 5 Oct 2026 | CVSS 5.3 | Unknown UPI QR Code Payment GatewayThe UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and… | |
| CVE-2026-105302 | 5 Oct 2026 | CVSS 5.7 | Red Hat Build of KeycloakA flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does… |
Page 120 of 168