[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100886 | 27 Sep 2026 | CVSS 10.0 | Seetong T8108A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown function of… | |
| CVE-2026-100883 | 27 Sep 2026 | CVSS 6.3 | Krayin laravel-crmA flaw has been found in Krayin laravel-crm up to 2.2.5. The affected element is an unknown function of the file… | |
| CVE-2026-100884 | 27 Sep 2026 | CVSS 4.3 | Krayin laravel-crmA vulnerability has been found in Krayin laravel-crm up to 2.2.5. The impacted element is the function Storage::download of the file… | |
| CVE-2026-100885 | 27 Sep 2026 | CVSS 7.3 | Krayin laravel-crmA vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file… | |
| CVE-2026-100882 | 27 Sep 2026 | CVSS 2.4 | Krayin laravel-crmA vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file… | |
| CVE-2026-96282 | 27 Sep 2026 | CVSS 3.1 | Red Hat Enterprise Linux 10A malicious Flatpak extension can probe the host filesystem to determine what files and directories exist at arbitrary paths, and host directory… | |
| CVE-2026-96283 | 27 Sep 2026 | CVSS 3.3 | Red Hat Enterprise Linux 10By calling org.freedesktop.Flatpak.SystemHelper.CancelPull on another user's pull, the pull is not actually cancelled but removed from internal… | |
| CVE-2026-100881 | 27 Sep 2026 | CVSS 2.6 | zhistaredu StarTrainingA security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file… | |
| CVE-2026-96280 | 27 Sep 2026 | CVSS 7.5 | Red Hat Enterprise Linux 10The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems)… | |
| CVE-2026-96281 | 27 Sep 2026 | CVSS 6.2 | Red Hat Enterprise Linux 10On a multi-user system, a user with an active local login session could downgrade a system-wide Flatpak app to an older version by removing the app's… | |
| CVE-2026-101090 | 27 Sep 2026 | CVSS 9.8 | nezhahq nezhaNezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the new optional dashboard_host setting is empty… | |
| CVE-2026-101065 | 27 Sep 2026 | CVSS 9.8 | obot-platform obotObot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970, the Docker quickstart command documented in the… | |
| CVE-2026-101084 | 27 Sep 2026 | CVSS 9.6 | obot-platform obotobot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect to… | |
| CVE-2026-101085 | 27 Sep 2026 | CVSS 6.5 | nezhahq nezhaNezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules… | |
| CVE-2026-101086 | 27 Sep 2026 | CVSS 6.5 | nezhahq nezhaNezha Dashboard versions before 2.3.5 fail to restrict service monitor task types to supported probe types, allowing authenticated users with… | |
| CVE-2026-101087 | 27 Sep 2026 | CVSS 4.3 | nezhahq nezhaNezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the denylist… | |
| CVE-2026-101088 | 27 Sep 2026 | CVSS 5.3 | nezhahq nezhaNezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go)… | |
| CVE-2026-101089 | 27 Sep 2026 | CVSS 3.1 | nezhahq nezhaNezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed password field… | |
| CVE-2026-100878 | 27 Sep 2026 | CVSS 6.3 | zhistaredu StarTrainingA vulnerability was identified in zhistaredu StarTraining up to 3.8.1. Affected by this issue is the function SysUser.isAdmin of the file… | |
| CVE-2026-100879 | 27 Sep 2026 | CVSS 4.3 | zhistaredu StarTrainingA security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file… | |
| CVE-2026-100880 | 27 Sep 2026 | CVSS 3.5 | zhistaredu StarTrainingA weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file… | |
| CVE-2026-101062 | 27 Sep 2026 | CVSS 8.8 | obot-platform obotObot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registration… | |
| CVE-2026-101063 | 27 Sep 2026 | CVSS 5.3 | obot-platform obotObot versions before v0.23.0 fail to enforce authentication on MCP Registry endpoints under /v0.1/* when registry authentication is enabled… | |
| CVE-2026-101064 | 27 Sep 2026 | CVSS 7.6 | obot-platform obotObot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server registration that allows privileged users to specify… | |
| CVE-2026-100877 | 27 Sep 2026 | CVSS 4.3 | mathurvishal CloudClassroom-PHP-ProjectA vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this… | |
| CVE-2026-96279 | 27 Sep 2026 | CVSS 6.5 | Red Hat Enterprise Linux 10A malicious OCI registry can hardlink arbitrary host files into the extraction directory when a user installs or updates a Flatpak application from… | |
| CVE-2026-100876 | 27 Sep 2026 | CVSS 6.3 | mathurvishal CloudClassroom-PHP-ProjectA vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function… | |
| CVE-2026-100875 | 27 Sep 2026 | CVSS 7.3 | mathurvishal CloudClassroom-PHP-ProjectA vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown… | |
| CVE-2026-100873 | 27 Sep 2026 | CVSS 4.3 | mathurvishal CloudClassroom-PHP-ProjectA vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an… | |
| CVE-2026-100874 | 27 Sep 2026 | CVSS 7.3 | mathurvishal CloudClassroom-PHP-ProjectA flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of… | |
| CVE-2026-101059 | 27 Sep 2026 | CVSS 7.1 | universal-tool-calling-protocol python-utcputcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential… | |
| CVE-2026-101060 | 27 Sep 2026 | CVSS 8.2 | universal-tool-calling-protocol python-utcppython-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the… | |
| CVE-2026-101061 | 27 Sep 2026 | CVSS 4.7 | universal-tool-calling-protocol python-utcputcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of… | |
| CVE-2026-101046 | 27 Sep 2026 | CVSS 4.3 | fleetdm fleetFleet before 4.89.0 contains an SQL injection vulnerability in the activity list endpoints (GET /api/v1/fleet/activities and GET… | |
| CVE-2026-101047 | 27 Sep 2026 | CVSS 5.3 | fleetdm fleetFleet before 4.87.0 does not protect the two endpoints that serve in-house iOS application packages and manifests (enterprise tier only) with the… | |
| CVE-2026-101048 | 27 Sep 2026 | CVSS 5.4 | cloudreveCloudreve before 4.17.0 registers the administrative node test endpoints (POST /api/v4/admin/node/test and POST /api/v4/admin/node/test/downloader)… | |
| CVE-2026-101051 | 27 Sep 2026 | CVSS 3.1 | cloudreveCloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files outside… | |
| CVE-2026-101056 | 27 Sep 2026 | CVSS 5.3 | cloudreveCloudreve before 4.16.1 fails to revalidate share access when restoring cached navigator state from a context_hint UUID. Attackers who previously had… | |
| CVE-2026-101057 | 27 Sep 2026 | CVSS 3.1 | universal-tool-calling-protocol python-utcputcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers… | |
| CVE-2026-101058 | 27 Sep 2026 | CVSS 6.9 | universal-tool-calling-protocol python-utcppython-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own… | |
| CVE-2026-101044 | 27 Sep 2026 | CVSS 7.1 | pnpmpacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate… | |
| CVE-2026-101045 | 27 Sep 2026 | CVSS 8.0 | fleetdm fleetFleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-08-19, the… | |
| CVE-2026-101043 | 27 Sep 2026 | CVSS 7.4 | pnpmpnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and… | |
| CVE-2026-88778 | 27 Sep 2026 | CVSS 7.5 | Citrix NetScaler ADCPredictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before… | Fix |
| CVE-2026-101050 | 27 Sep 2026 | CVSS 6.5 | heymrun heymHeym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or… | |
| CVE-2026-88771 | 27 Sep 2026 | CVSS 9.8 | Unauthenticated command execution in NetScaler ADC and GatewayImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before… | ExploitedFix |
| CVE-2026-88772 | 27 Sep 2026 | CVSS 8.1 | Memory flaw in NetScaler ADC and Gateway allows remote code executionVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37… | ExploitedFix |
| CVE-2026-88773 | 27 Sep 2026 | CVSS 10.0 | Citrix NetScaler ADCInconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway… | Fix |
| CVE-2026-88774 | 27 Sep 2026 | CVSS 7.2 | Citrix NetScaler ADCVulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37… | Fix |
| CVE-2026-88775 | 27 Sep 2026 | CVSS 9.8 | Citrix NetScaler ADCMemory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23… | Fix |
| CVE-2026-88776 | 27 Sep 2026 | CVSS 9.8 | Citrix NetScaler ADCMemory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before… | Fix |
| CVE-2026-88777 | 27 Sep 2026 | CVSS 9.8 | Citrix NetScaler ADCMemory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before… | Fix |
| CVE-2026-101042 | 27 Sep 2026 | CVSS 6.4 | parse-community parse-serverParse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication adapters… | |
| CVE-2026-101049 | 27 Sep 2026 | CVSS 6.5 | heymrun heymHeym before 0.0.53 fails to verify Slack request signatures when trigger nodes lack credential IDs or have empty signing secrets. Remote… | |
| CVE-2026-101041 | 27 Sep 2026 | CVSS 6.3 | vulnerability-lookupThe account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race… | |
| CVE-2026-101033 | 27 Sep 2026 | CVSS 4.3 | TomBursch kitchenowlKitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers… | |
| CVE-2026-101032 | 27 Sep 2026 | CVSS 7.0 | denisidoro navinavi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject shell… | |
| CVE-2026-100869 | 27 Sep 2026 | CVSS 5.9 | SyliusSylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on… | |
| CVE-2026-100870 | 27 Sep 2026 | CVSS 8.8 | SyliusSylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without… | |
| CVE-2026-100871 | 27 Sep 2026 | CVSS 8.8 | SyliusSylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate Admin… | |
| CVE-2026-100872 | 27 Sep 2026 | CVSS 7.5 | SyliusSylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify… | |
| CVE-2026-100867 | 27 Sep 2026 | CVSS 3.3 | spaceship-promptspaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt… | |
| CVE-2026-100868 | 27 Sep 2026 | CVSS 6.3 | penpotPenpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode… | |
| CVE-2026-100866 | 27 Sep 2026 | CVSS 3.3 | o2sh onefetchonefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape… | |
| CVE-2026-97165 | 27 Sep 2026 | CVSS 5.3 | svenbluege.de Event Gallery for JoomlaJoomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and… | |
| CVE-2026-100748 | 27 Sep 2026 | CVSS 8.8 | svenbluege.de Event Gallery for JoomlaJoomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 | |
| CVE-2026-100749 | 27 Sep 2026 | CVSS 5.1 | svenbluege.de Event Gallery for JoomlaJoomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts… | |
| CVE-2026-97164 | 27 Sep 2026 | CVSS 7.0 | svenbluege.de Event Gallery for JoomlaJoomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the… | |
| CVE-2026-100747 | 27 Sep 2026 | CVSS 6.5 | svenbluege.de Event Gallery for JoomlaJoomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site… | |
| CVE-2026-89134 | 27 Sep 2026 | CVSS 9.1 | wolfSSLA certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint… | Fix |
| CVE-2026-89135 | 27 Sep 2026 | CVSS 6.5 | wolfSSLA failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in every… | Fix |
| CVE-2026-89136 | 27 Sep 2026 | CVSS 8.3 | wolfSSLWhen using RPK (Raw Public Key), the client side of a TLS 1.2, 1.3 and DTLS 1.2 connection could accept an unsolicited server_cert_type=RawPublicKey… | |
| CVE-2026-93302 | 27 Sep 2026 | CVSS 8.2 | wolfSSLMatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macro… | Fix |
| CVE-2026-93304 | 27 Sep 2026 | CVSS 3.7 | wolfSSLA (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at that point… | Fix |
| CVE-2026-94417 | 27 Sep 2026 | CVSS 5.3 | wolfSSLWhen an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer… | |
| CVE-2026-89102 | 27 Sep 2026 | CVSS 6.5 | wolfSSLIn wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can lead to… | Fix |
| CVE-2026-89133 | 27 Sep 2026 | CVSS 5.3 | wolfSSLwolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstraints… | |
| CVE-2026-15442 | 27 Sep 2026 | CVSS 5.3 | wolfSSLIn all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could lead to… | |
| CVE-2026-94418 | 27 Sep 2026 | CVSS 7.5 | wolfSSLUnder WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory down, then… | |
| CVE-2026-94419 | 27 Sep 2026 | CVSS 5.4 | wolfSSLWithout NO_SESSION_CACHE_REF, wolfSSL_get_session() does not return a session object but a ClientSession reference of the form {row, index… | Fix |
| CVE-2026-100741 | 27 Sep 2026 | CVSS 9.8 | Progressive Robot Ltd hMailServerEval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, versions 6.0.0 through 6.3.3 on Windows, allows a… | |
| CVE-2026-96899 | 27 Sep 2026 | CVSS 6.8 | Unknown Optima Express IDXThe Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before… | |
| CVE-2026-97227 | 27 Sep 2026 | CVSS 5.9 | Unknown NextScripts: Social Networks Auto-PosterThe NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX… | |
| CVE-2026-97319 | 27 Sep 2026 | CVSS 6.8 | Unknown PowerPress Podcasting plugin by BlubrryThe PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a… | |
| CVE-2026-89003 | 27 Sep 2026 | CVSS 4.1 | Unknown WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and rendering… | |
| CVE-2026-89006 | 27 Sep 2026 | CVSS 6.8 | Unknown WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, allowing… | |
| CVE-2026-92436 | 27 Sep 2026 | CVSS 5.3 | Unknown Mailchimp for WooCommerceThe Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a… | |
| CVE-2026-92995 | 27 Sep 2026 | CVSS 5.3 | Unknown Verge3D Publishing and E-CommerceThe Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated… | |
| CVE-2026-96895 | 27 Sep 2026 | CVSS 6.8 | Unknown WP YouTube LyteThe WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML… | |
| CVE-2026-96896 | 27 Sep 2026 | CVSS 7.2 | Unknown Malcure Malware Shield — Removal, Repair, MonitorThe Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX… | |
| CVE-2026-96897 | 27 Sep 2026 | CVSS 5.3 | Unknown Optima Express IDXThe Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to… | |
| CVE-2026-89000 | 27 Sep 2026 | CVSS 4.1 | Unknown WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check or validate the destination of a user-supplied feed… | |
| CVE-2026-89001 | 27 Sep 2026 | CVSS 4.9 | Unknown WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish content or… | |
| CVE-2026-86841 | 27 Sep 2026 | CVSS 4.7 | Unknown Online Scheduling and Appointment Booking SystemThe Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not… | |
| CVE-2026-86609 | 27 Sep 2026 | CVSS 8.8 | Unknown Download ManagerThe Download Manager WordPress plugin before 7.5.6 does not sanitise and escape data submitted through its email-locked download subscription form… | |
| CVE-2026-86839 | 27 Sep 2026 | CVSS 3.8 | Unknown Online Scheduling and Appointment Booking SystemThe Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not verify that appointment and payment records requested… | |
| CVE-2026-85002 | 27 Sep 2026 | CVSS 6.8 | Unknown EmbedPressThe EmbedPress WordPress plugin before 4.6.7 does not escape one of its block attributes before outputting it inside an HTML attribute, which could… | |
| CVE-2026-84069 | 27 Sep 2026 | CVSS 5.3 | Unknown WebFacing™The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before… | |
| CVE-2026-82841 | 27 Sep 2026 | CVSS 5.3 | Unknown UpdraftPlus: WP Backup & Migration PluginThe UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before 1.26.8, UpdraftPlus: WP Backup & Migration Plugin WordPress plugin before… | |
| CVE-2026-81655 | 27 Sep 2026 | CVSS 7.5 | Unknown Ad InserterThe Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged… |
Page 147 of 168