[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-81539 | 24 Sep 2026 | CVSS 8.8 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of… | Fix |
| CVE-2026-81545 | 24 Sep 2026 | CVSS 8.8 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization… | Fix |
| CVE-2026-81547 | 24 Sep 2026 | CVSS 8.8 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal. | Fix |
| CVE-2026-81548 | 24 Sep 2026 | CVSS 8.8 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization… | Fix |
| CVE-2026-81549 | 24 Sep 2026 | CVSS 7.7 | IBM DataStage on Cloud Pak for DataIBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of… | Fix |
| CVE-2026-77825 | 24 Sep 2026 | CVSS 4.9 | IBM ContextForge MCP GatewayIBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint (`GET /v1/admin/logs/file`)… | Fix |
| CVE-2026-77874 | 24 Sep 2026 | CVSS 8.6 | IBM Enterprise Build of QuarkusIBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated… | |
| CVE-2026-77703 | 24 Sep 2026 | CVSS 5.9 | HAVELSAN Inc. Liman Render EngineKey exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue… | |
| CVE-2026-77707 | 24 Sep 2026 | CVSS 5.9 | HAVELSAN Inc. Liman Render EngineImproper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman… | |
| CVE-2026-73064 | 24 Sep 2026 | CVSS 2.9 | trustedfirmware Mbed TLSIn Mbed TLS 3.2.0 though 3.6.6 and 4.0.0 through 4.1.0, an attacker who can cause an entropy source to fail can remove or inject bytes into the start… | |
| CVE-2026-6544 | 24 Sep 2026 | CVSS 6.2 | IBM ConcertIBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of… | |
| CVE-2026-65422 | 24 Sep 2026 | CVSS 6.5 | Genetec Inc. Genetec Security CenterA flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video… | |
| CVE-2026-58007 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareUntrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory… | |
| CVE-2026-58008 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareStack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory… | |
| CVE-2026-56736 | 24 Sep 2026 | CVSS 8.2 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ SubmissionphpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows any… | Fix |
| CVE-2026-58004 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareOut-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted… | |
| CVE-2026-58005 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareOut-of-bounds read vulnerability in Altera Trusted Firmware on HPS allows Privilege Escalation and Overflow Buffers. This issue affects Trusted… | |
| CVE-2026-58006 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareUntrusted pointer dereference vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory… | |
| CVE-2026-51995 | 24 Sep 2026 | CVSS 7.5 | VulnerabilityAn issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the… | |
| CVE-2026-51996 | 24 Sep 2026 | CVSS 9.8 | VulnerabilityAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the… | |
| CVE-2026-51997 | 24 Sep 2026 | CVSS 8.8 | VulnerabilityAn issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions | |
| CVE-2026-52001 | 24 Sep 2026 | CVSS 7.5 | VulnerabilityAn issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSourceInit… | |
| CVE-2026-51994 | 24 Sep 2026 | CVSS 9.1 | Vulnerabilitymcp-remote versions 0.1.32 through 0.1.38 are vulnerable to Server-Side Request Forgery (SSRF) via the resource_metadata URL extracted from a remote… | |
| CVE-2026-18870 | 24 Sep 2026 | CVSS 4.3 | IBM PowerVM HypervisorIBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 could… | Fix |
| CVE-2026-19492 | 24 Sep 2026 | CVSS 3.2 | IBM PowerVM HypervisorIBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in a… | Fix |
| CVE-2026-13465 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareStack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory… | |
| CVE-2026-13466 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareIncorrect calculation of buffer size vulnerability in Altera Trusted Firmware on HPS allows Overflow Buffers. This issue affects Trusted Firmware… | |
| CVE-2026-13467 | 24 Sep 2026 | CVSS 8.1 | Altera Trusted FirmwareOut-of-bounds write vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memory Protections… | |
| CVE-2026-12559 | 24 Sep 2026 | CVSS 7.3 | OpenText Vendor Invoice Management for SAP SolutionsA Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Validation… | |
| CVE-2026-97061 | 24 Sep 2026 | CVSS 4.3 | blackcandy-org Black CandyBlack Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all… | |
| CVE-2026-97062 | 24 Sep 2026 | CVSS 5.4 | Webkul Aureus ERPAureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin, allowing… | |
| CVE-2026-97359 | 24 Sep 2026 | CVSS 10.0 | rejetto hfs2HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attackers to… | |
| CVE-2026-97360 | 24 Sep 2026 | CVSS 10.0 | rejetto hfs2HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write… | |
| CVE-2026-97057 | 24 Sep 2026 | CVSS 7.5 | NodeRedis redis-parserredis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught… | |
| CVE-2026-97059 | 24 Sep 2026 | CVSS 8.2 | OFFIS DCMTKDCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the PixelData… | |
| CVE-2026-95519 | 24 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar… | |
| CVE-2026-95521 | 24 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 10A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct… | |
| CVE-2026-88359 | 24 Sep 2026 | CVSS 6.5 | Vulnerabilitylibfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document containing a… | |
| CVE-2026-88360 | 24 Sep 2026 | CVSS 7.5 | Vulnerabilitylibvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multiple of… | |
| CVE-2026-91187 | 24 Sep 2026 | CVSS 9.3 | dashbit nimble_ztaImproper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authenticate as an… | |
| CVE-2026-77797 | 24 Sep 2026 | CVSS 3.6 | Rapid7 VelociraptorVelociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files. | |
| CVE-2026-77798 | 24 Sep 2026 | CVSS 6.5 | Rapid7 VelociraptorVelociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the user… | |
| CVE-2026-17503 | 24 Sep 2026 | CVSS 5.1 | IBM PowerVM HypervisorIBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is… | Fix |
| CVE-2026-17504 | 24 Sep 2026 | CVSS 4.4 | IBM PowerVM HypervisorIBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is… | Fix |
| CVE-2026-17511 | 24 Sep 2026 | CVSS 3.4 | IBM PowerVM HypervisorIBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is… | Fix |
| CVE-2026-18104 | 24 Sep 2026 | CVSS 3.3 | IBM Db2 Mirror for iIBM Db2 Mirror for i 7.6, 7.5, and 7.4 could allow a local attacker to obtain sensitive information due to the use of the AES Electronic Codebook… | Fix |
| CVE-2026-18857 | 24 Sep 2026 | CVSS 3.4 | IBM OPENBMCIBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC… | Fix |
| CVE-2026-17413 | 24 Sep 2026 | CVSS 5.1 | IBM PowerVM HypervisorIBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is… | Fix |
| CVE-2026-97182 | 24 Sep 2026 | CVSS 7.3 | halo-dev HaloA security vulnerability has been detected in halo-dev Halo up to 2.25.4/2.26.1. Affected is an unknown function of the file… | |
| CVE-2026-94416 | 24 Sep 2026 | CVSS 6.8 | Red Hat Ansible Automation Platform 2.6 for RHEL 9An authorization bypass was found in the Ansible Automation Platform (AAP) gateway. The gateway API allows an authenticated administrator to create a… | |
| CVE-2026-96515 | 24 Sep 2026 | CVSS 8.6 | Netlink ICT Pvt Ltd Netlink ICT HG323RW RouterThis vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script… | |
| CVE-2026-88916 | 24 Sep 2026 | CVSS 6.8 | TÜBİTAK ULAKBİM UlakPDFIncorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026. | |
| CVE-2026-88907 | 24 Sep 2026 | CVSS 7.4 | TÜBİTAK ULAKBİM UlakPDFIncorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026. | |
| CVE-2026-19072 | 24 Sep 2026 | CVSS 9.9 | Rapid7 VelociraptorVelociraptor stores the compiled VQL in the hunt object internally to avoid having to recompile the artifacts for each endpoint in the hunt. Although… | |
| CVE-2026-97311 | 24 Sep 2026 | CVSS 4.3 | Red Hat Build of KeycloakA flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with… | |
| CVE-2026-19532 | 24 Sep 2026 | CVSS 5.3 | HAVELSAN Inc. Liman MYSImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This… | |
| CVE-2026-3253 | 24 Sep 2026 | CVSS 4.3 | MailerLite – Signup forms (official)The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on… | |
| CVE-2026-4806 | 24 Sep 2026 | CVSS 6.5 | alexvtn Custom Thank You Page for WooCommerceThe Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability… | |
| CVE-2026-7169 | 24 Sep 2026 | CVSS 7.5 | Evope Collectora vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges… | |
| CVE-2026-16302 | 24 Sep 2026 | CVSS 4.3 | brainstormforce Spectra Legacy – Gutenberg BlocksThe Spectra Legacy – Gutenberg Blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… | |
| CVE-2026-97179 | 24 Sep 2026 | CVSS 4.3 | O2OAA security vulnerability has been detected in O2OA up to 9.5.3/10.0.2. This vulnerability affects the function list of the file… | |
| CVE-2026-79680 | 24 Sep 2026 | CVSS 4.5 | qtAuthentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC… | |
| CVE-2026-4638 | 24 Sep 2026 | CVSS 7.1 | Paessler GmbH PRTG Network MonitorPRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a… | |
| CVE-2026-57590 | 24 Sep 2026 | CVSS 8.1 | Apache Software Foundation Apache DolphinSchedulerA missing authorization vulnerability exists in the Task Group APIs of Apache DolphinScheduler. The affected APIs do not properly verify whether the… | |
| CVE-2026-92905 | 24 Sep 2026 | CVSS 5.3 | Zohocorp ManageEngine EventLog AnalyzerZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log… | |
| CVE-2026-18335 | 24 Sep 2026 | CVSS 5.4 | themeum Kirki – Freeform Page Builder, Website Builder & CustomizerThe Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all… | |
| CVE-2026-4637 | 24 Sep 2026 | CVSS 5.1 | Paessler GmbH PRTG Network MonitorPaessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is… | |
| CVE-2026-15731 | 24 Sep 2026 | CVSS 6.4 | magazine3 WP Multilang – Translation and Multilingual PluginThe WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all… | |
| CVE-2026-12227 | 24 Sep 2026 | CVSS 9.8 | visualcomposer Visual Composer Website BuilderThe Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the… | |
| CVE-2026-78308 | 24 Sep 2026 | CVSS 9.8 | Deltaww DIAEnergieImproper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022. | |
| CVE-2026-78309 | 24 Sep 2026 | CVSS 8.8 | Deltaww DIAEnergieSQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | |
| CVE-2026-78310 | 24 Sep 2026 | CVSS 4.3 | Deltaww DIAEnergieAuthorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | |
| CVE-2026-78311 | 24 Sep 2026 | CVSS 8.8 | Deltaww DIAEnergieSQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | |
| CVE-2026-78312 | 24 Sep 2026 | CVSS 9.1 | Deltaww DIAEnergiePath Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | |
| CVE-2026-78313 | 24 Sep 2026 | CVSS 6.5 | Deltaww DIAEnergieImproper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | |
| CVE-2026-85682 | 24 Sep 2026 | CVSS 8.8 | yourownprogrammer YOP PollThe YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the plugin… | |
| CVE-2026-97185 | 24 Sep 2026 | CVSS 7.8 | Red Hat Enterprise Linux 8A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices… | |
| CVE-2026-77193 | 24 Sep 2026 | CVSS 7.5 | eesywp eesy_ID2WP – Publish InDesign HTML5The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the… | |
| CVE-2026-97181 | 24 Sep 2026 | CVSS 5.3 | ezGlobal GPM LIGHTGPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs. | |
| CVE-2026-87739 | 24 Sep 2026 | CVSS 6.9 | PaperCut NG/MFAn improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting… | Fix |
| CVE-2026-81645 | 24 Sep 2026 | CVSS 5.9 | Huawei HarmonyOSOut-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. | |
| CVE-2026-82077 | 24 Sep 2026 | CVSS 7.3 | PaperCut NG/MFAn improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and… | Fix |
| CVE-2026-11744 | 24 Sep 2026 | CVSS 3.8 | PaperCut HiveAn input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sanitize… | Fix |
| CVE-2026-93662 | 24 Sep 2026 | CVSS 4.3 | Unknown Events ManagerThe Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own… | |
| CVE-2026-97176 | 24 Sep 2026 | CVSS 4.2 | Red Hat Build of KeycloakA flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when… | |
| CVE-2026-97177 | 24 Sep 2026 | CVSS 6.6 | Red Hat Build of KeycloakA flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to… | |
| CVE-2026-88843 | 24 Sep 2026 | CVSS 7.2 | Unknown MasterStudy LMS WordPress PluginThe MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a… | |
| CVE-2026-88845 | 24 Sep 2026 | CVSS 4.3 | Unknown MasterStudy LMS WordPress PluginThe MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance… | |
| CVE-2026-88846 | 24 Sep 2026 | CVSS 5.3 | Unknown MasterStudy LMS WordPress PluginThe MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating… | |
| CVE-2026-88847 | 24 Sep 2026 | CVSS 4.3 | Unknown MasterStudy LMS WordPress PluginThe MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson… | |
| CVE-2026-89002 | 24 Sep 2026 | CVSS 6.8 | Unknown WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before… | |
| CVE-2026-89004 | 24 Sep 2026 | CVSS 2.7 | Unknown WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not verify ownership or authorization before returning a campaign's stored… | |
| CVE-2026-89005 | 24 Sep 2026 | CVSS 6.8 | Unknown WPeMatico RSS Feed FetcherThe WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitise and escape one of its campaign configuration fields when a certain… | |
| CVE-2026-93661 | 24 Sep 2026 | CVSS 2.7 | Unknown Events ManagerThe Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized… | |
| CVE-2026-80338 | 24 Sep 2026 | CVSS 6.8 | Unknown CMB2The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as… | |
| CVE-2026-80513 | 24 Sep 2026 | CVSS 7.5 | Unknown wpForo ForumThe wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field… | |
| CVE-2026-82195 | 24 Sep 2026 | CVSS 6.5 | Unknown 10Web BoosterThe 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud… | |
| CVE-2026-82849 | 24 Sep 2026 | CVSS 4.3 | Unknown Masteriyo LMSThe Masteriyo LMS WordPress plugin before 3.4.2 does not verify that the user making the request owns the course-progress records being returned… | |
| CVE-2026-82850 | 24 Sep 2026 | CVSS 4.3 | Unknown Masteriyo LMSThe Masteriyo LMS WordPress plugin before 3.4.2 does not restrict access to quiz answer keys, allowing any authenticated user, such as a student, to… | |
| CVE-2026-84151 | 24 Sep 2026 | CVSS 3.5 | Unknown The Post GridThe Post Grid WordPress plugin before 7.9.5 does not limit an expansion of the WordPress allowed-HTML list to its own markup and applies it… |
Page 162 of 168