[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-91137 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftImproper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache… | |
| CVE-2026-93925 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftStack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift… | |
| CVE-2026-93926 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftMissing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift… | |
| CVE-2026-85494 | 2 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache ThriftImproper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size… | |
| CVE-2026-86325 | 2 Oct 2026 | CVSS 9.4 | Moxa MGate MB3170 SeriesA stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insufficient… | Fix |
| CVE-2026-86326 | 2 Oct 2026 | CVSS 8.6 | Moxa MGate MB3170 SeriesAn improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify the… | Fix |
| CVE-2026-85483 | 2 Oct 2026 | CVSS 6.3 | Apache Software Foundation Apache ThriftUse of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before… | |
| CVE-2026-85493 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftUncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are… | |
| CVE-2026-59666 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59667 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59668 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-104606 | 2 Oct 2026 | CVSS 6.3 | itsourcecode Online Admission System ProjectA security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file… | |
| CVE-2026-97652 | 2 Oct 2026 | CVSS 6.1 | veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternativeThe WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via… | |
| CVE-2026-94180 | 2 Oct 2026 | CVSS 4.3 | Monetizemore Advanced AdsAuthorization Bypass Through User-Controlled Key vulnerability in Monetizemore Advanced Ads allows Retrieve Embedded Sensitive Data. This issue… | |
| CVE-2026-94405 | 2 Oct 2026 | CVSS 5.3 | Shahjada Download ManagerAuthorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This issue… | |
| CVE-2026-94541 | 2 Oct 2026 | CVSS 9.8 | amauric WPMobile.App – Android and iOS App BuilderThe WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82… | |
| CVE-2026-94634 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache ThriftAllocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python… | |
| CVE-2026-94635 | 2 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache ThriftAllocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua… | |
| CVE-2026-94639 | 2 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache Thriftimproper handling of exceptional conditions, Allocation of resources without limits or throttling, Uncaught exception vulnerability in Apache Thrift… | |
| CVE-2026-95662 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59665 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59672 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59673 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-80298 | 2 Oct 2026 | CVSS 8.8 | HAVELSAN Inc. Sef - AI Chatbot PlatformImproper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows… | |
| CVE-2026-85492 | 2 Oct 2026 | CVSS 6.1 | smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin for WordPress is vulnerable to… | |
| CVE-2026-87920 | 2 Oct 2026 | CVSS 7.2 | boldgrid W3 Total CacheThe W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all… | |
| CVE-2026-59659 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59660 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59661 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59662 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59663 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59664 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-103552 | 2 Oct 2026 | CVSS 7.3 | Apache Software Foundation Apache Directory LDAP APIStack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack… | |
| CVE-2026-103877 | 2 Oct 2026 | CVSS 9.8 | Apache Software Foundation Apache Directory LDAP APIDeserialization of Untrusted Data vulnerability in Apache Directory LDAP API. A rogue/compromised LDAP server (or pre-TLS MITM) can answer a client's… | |
| CVE-2026-103878 | 2 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Directory LDAP APICleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a Search… | |
| CVE-2026-103880 | 2 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Directory LDAP APIAsymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force like 30… | |
| CVE-2026-103885 | 2 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Directory LDAP APIAsymmetric Resource Consumption vulnerability in Apache Directory LDAP API. A LDAP server using the LDAP API (like Apache DS) may consume 100% of a… | |
| CVE-2026-104403 | 2 Oct 2026 | CVSS 5.3 | ThimPress LearnPressAuthorization Bypass Through User-Controlled Key vulnerability in ThimPress LearnPress allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-102731 | 2 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Directory LDAP APIMemory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-encoded… | |
| CVE-2026-91784 | 2 Oct 2026 | CVSS 4.8 | cjbassi gotopcjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill without… | |
| CVE-2026-95512 | 2 Oct 2026 | CVSS 5.5 | Red Hat Hardened ImagesA flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into… | |
| CVE-2026-59669 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59670 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-59671 | 2 Oct 2026 | CVSS 4.8 | Repasat applicationCross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user… | |
| CVE-2026-80337 | 2 Oct 2026 | CVSS 5.3 | HAVELSAN Inc. Sef - AI Chatbot PlatformMissing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This… | |
| CVE-2026-80443 | 2 Oct 2026 | CVSS 7.4 | HAVELSAN Inc. Sef - AI Chatbot PlatformImproper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue affects… | |
| CVE-2026-80464 | 2 Oct 2026 | CVSS 4.9 | HAVELSAN Inc. Sef - AI Chatbot PlatformServer-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects… | |
| CVE-2026-97663 | 2 Oct 2026 | CVSS 7.2 | ivole Customer Reviews for WooCommerceThe Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to… | |
| CVE-2026-97338 | 2 Oct 2026 | CVSS 6.4 | codename065 Download ManagerThe Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including, 3.3.70… | |
| CVE-2026-97342 | 2 Oct 2026 | CVSS 7.2 | jetmonsters JetFormBuilder — Dynamic Blocks Form BuilderThe JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta via… | |
| CVE-2026-97634 | 2 Oct 2026 | CVSS 6.5 | stellarwp Event Tickets and RegistrationThe Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and… | |
| CVE-2026-97637 | 2 Oct 2026 | CVSS 9.8 | parorrey JSON API AuthThe JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, and… | |
| CVE-2026-97641 | 2 Oct 2026 | CVSS 7.2 | comesio Relevanssi – A Better SearchThe Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and… | |
| CVE-2026-96566 | 2 Oct 2026 | CVSS 7.2 | satollo Newsletter – Send awesome emails from WordPressThe Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'np1' Custom Field… | |
| CVE-2026-96567 | 2 Oct 2026 | CVSS 7.2 | websoudan MW WP FormThe MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and including… | |
| CVE-2026-96578 | 2 Oct 2026 | CVSS 7.2 | creative-solutions-1 GSpeech TTS – WordPress Text To Speech PluginThe GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all… | |
| CVE-2026-96647 | 2 Oct 2026 | CVSS 6.4 | webilia Listdom: AI-powered Business Directory with Classifieds Ads ListingsThe Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via… | |
| CVE-2026-96871 | 2 Oct 2026 | CVSS 7.2 | kitae-park Mang BoardThe Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including… | |
| CVE-2026-97336 | 2 Oct 2026 | CVSS 7.2 | jtsternberg CMB2The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including, 2.13.0… | |
| CVE-2026-63578 | 2 Oct 2026 | CVSS 7.1 | Legion of the Bouncy Castle Inc. bc-csharpAllocation of resources without limits in password-based private-key decryption (PbeUtilities.GenerateCipherParameters) in Legion of the Bouncy… | |
| CVE-2026-93756 | 2 Oct 2026 | CVSS 7.2 | smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPressThe Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Facebook… | |
| CVE-2026-93880 | 2 Oct 2026 | CVSS 6.1 | wpsoul Greenshift – animation and page builder blocksThe Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{{GET:}}' Dynamic… | |
| CVE-2026-94432 | 2 Oct 2026 | CVSS 5.3 | latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPressThe Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object… | |
| CVE-2026-95670 | 2 Oct 2026 | CVSS 7.2 | mihdan No External LinksThe No External Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect in all versions up… | |
| CVE-2026-95817 | 2 Oct 2026 | CVSS 7.2 | apasionados DoFollow Case by CaseThe DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including… | |
| CVE-2026-63572 | 2 Oct 2026 | CVSS 7.1 | Legion of the Bouncy Castle Inc. bc-csharpAllocation of resources without limits in PKCS#12 keystore loading (Pkcs12Store.Load) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0… | |
| CVE-2026-63573 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpObservable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc… | |
| CVE-2026-63574 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpMemory allocation with excessive size value in the OpenPGP signature and user attribute subpacket parsers (SignatureSubpacketsParser.ReadPacket… | |
| CVE-2026-63575 | 2 Oct 2026 | CVSS 7.1 | Legion of the Bouncy Castle Inc. bc-csharpLoop with unreachable exit condition in the PKCS#12 key derivation (Pkcs12ParametersGenerator) in Legion of the Bouncy Castle Inc. bc-csharp before… | |
| CVE-2026-63576 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpImproper certificate validation in PkixNameConstraintValidator (ExtractHostFromURL) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows… | |
| CVE-2026-63577 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpImproper certificate validation in the directoryName name-constraint check (PkixNameConstraintValidator.WithinDNSubtree) in Legion of the Bouncy… | |
| CVE-2026-12951 | 2 Oct 2026 | CVSS 6.5 | wcmp MultiVendorX – WooCommerce Multivendor Marketplace AI Powered SolutionsThe Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the… | |
| CVE-2026-17507 | 2 Oct 2026 | CVSS 7.5 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire… | Fix |
| CVE-2026-17508 | 2 Oct 2026 | CVSS 5.3 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, several password-based key derivation entry points ran the KDF with cost parameters taken from the untrusted… | |
| CVE-2026-18036 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. BC-JAVAIn Bouncy Castle for Java before 1.86, NTRU reduced secret values with the % operator in three helpers whose reference implementations are… | |
| CVE-2026-63570 | 2 Oct 2026 | CVSS 7.1 | Legion of the Bouncy Castle Inc. bc-csharpLoop with unreachable exit condition in Pkcs12Store.GetCertificateChain in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker… | |
| CVE-2026-63571 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpImproper verification of cryptographic signature in the attribute certificate path validator (PkixAttrCertPathValidator, also used by… | |
| CVE-2026-102772 | 2 Oct 2026 | CVSS 7.2 | jtsternberg CMB2The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<textarea_code field id> (e.g. kl_code, kl_post_code)' parameter… | |
| CVE-2026-103426 | 2 Oct 2026 | CVSS 7.2 | Relevanssi PremiumThe Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and… | |
| CVE-2026-103600 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpUncontrolled recursion in the ASN.1 parser (Asn1InputStream, Asn1StreamParser) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a… | |
| CVE-2026-103601 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpRelease of unverified plaintext in the CCM (CcmBlockCipher) and DSTU 7624 CCM (KCcmBlockCipher) AEAD modes in Legion of the Bouncy Castle Inc… | |
| CVE-2026-103602 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpImproper certificate validation in PkixNameConstraintValidator in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who… | |
| CVE-2026-103603 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpMemory allocation with excessive size value in the HSS/LMS signature code (HssPublicKeyParameters, HssSignature) in Legion of the Bouncy Castle Inc… | |
| CVE-2026-103604 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpInefficient algorithmic complexity in X.509 distinguished name string conversion (X509Name.ToString and IetfUtilities.ValueToString) in Legion of the… | |
| CVE-2026-100182 | 2 Oct 2026 | CVSS 7.2 | wpchill Download MonitorThe Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions… | |
| CVE-2026-102002 | 2 Oct 2026 | CVSS 3.1 | themeisle Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSEThe Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Sensitive Information Exposure in… | |
| CVE-2026-100107 | 2 Oct 2026 | CVSS 7.2 | extendthemes Kubio AI Page BuilderThe Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and… | |
| CVE-2026-93698 | 2 Oct 2026 | CVSS 9.9 | Webpros cPanelInsufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | |
| CVE-2026-97219 | 2 Oct 2026 | CVSS 4.3 | Unknown MStore APIThe MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with… | |
| CVE-2026-84740 | 2 Oct 2026 | CVSS 6.5 | Unknown The Events CalendarThe Events Calendar WordPress plugin before 6.17.5.1 does not validate or sanitise data submitted to an unauthenticated AJAX action before merging it… | |
| CVE-2026-85005 | 2 Oct 2026 | CVSS 5.4 | Unknown Popup Maker WPThe Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to… | |
| CVE-2026-90952 | 2 Oct 2026 | CVSS 5.3 | Unknown WP Edit Password ProtectedThe WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing… | |
| CVE-2026-90987 | 2 Oct 2026 | CVSS 5.3 | Unknown Easy PayPal & Stripe Buy Now ButtonThe Easy PayPal & Stripe Buy Now Button WordPress plugin before 2.0.6 does not derive the payment amount on the server, taking it from a… | |
| CVE-2026-91020 | 2 Oct 2026 | CVSS 5.3 | Unknown WebToffee Gift Cards for WooCommerceThe WebToffee Gift Cards for WooCommerce WordPress plugin before 1.3.1 does not validate a user-supplied gift card amount server-side before using it… | |
| CVE-2026-92924 | 2 Oct 2026 | CVSS 5.4 | Unknown Unlimited Elements for ElementorThe Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not check that a request to render widget output comes from a user allowed… | |
| CVE-2026-93029 | 2 Oct 2026 | CVSS 9.0 | Webpros cPanelThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. | |
| CVE-2026-93697 | 2 Oct 2026 | CVSS 9.0 | Webpros cPanelThere is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. | |
| CVE-2026-63567 | 2 Oct 2026 | CVSS 8.2 | Legion of the Bouncy Castle Inc. bc-csharpObservable discrepancy in IesEngine.DecryptBlock in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has captured… | |
| CVE-2026-63568 | 2 Oct 2026 | CVSS 8.7 | Legion of the Bouncy Castle Inc. bc-csharpAllocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc… | |
| CVE-2026-63569 | 2 Oct 2026 | CVSS 9.1 | Legion of the Bouncy Castle Inc. bc-csharpImproper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before… |
Page 126 of 168