[ Latest · 16,702 CVEs ]
Newly published CVEs.
Every CVE the NVD lists as published in the last 30 days, newest first. Rows marked green on the left are on the matters-most list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-114400 | 21 Oct 2026 | CVSS 5.9 | polonel trudeskTrudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to download private ticket attachments… | |
| CVE-2026-114401 | 21 Oct 2026 | CVSS 5.3 | polonel trudeskTrudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to enumerate usernames by… | |
| CVE-2026-114402 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated… | |
| CVE-2026-114403 | 21 Oct 2026 | CVSS 8.1 | PHPOffice PHPPresentationPHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects… | |
| CVE-2026-114404 | 21 Oct 2026 | CVSS 6.1 | PHPOffice PHPPresentationPHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers who supply presentation… | |
| CVE-2026-114394 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other users by… | |
| CVE-2026-114395 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages as other… | |
| CVE-2026-114396 | 21 Oct 2026 | CVSS 7.1 | polonel trudeskTrudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a MongoDB $where… | |
| CVE-2026-114397 | 21 Oct 2026 | CVSS 7.4 | polonel trudeskTrudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthenticated… | |
| CVE-2026-114398 | 21 Oct 2026 | CVSS 5.4 | polonel trudeskTrudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place HTML or SVG files in the public… | |
| CVE-2026-114388 | 21 Oct 2026 | CVSS 5.3 | chamilo-lmsChamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in GradebookController that allows… | |
| CVE-2026-114389 | 21 Oct 2026 | CVSS 4.3 | chamilo-lmsChamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in AiController::openAnswerGrade that allows any… | |
| CVE-2026-114390 | 21 Oct 2026 | CVSS 5.3 | chamilo-lmsChamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers under public/main/inc/ajax/… | |
| CVE-2026-114391 | 21 Oct 2026 | CVSS 7.1 | easysoft zentaopmsZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets logged-in users skip group-based ACL… | |
| CVE-2026-114392 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups via GET… | |
| CVE-2026-114393 | 21 Oct 2026 | CVSS 4.3 | polonel trudeskTrudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their groups via… | |
| CVE-2026-114245 | 21 Oct 2026 | CVSS 7.3 | dhikshitha29 Insurance-Management-SystemA weakness has been identified in dhikshitha29 Insurance-Management-System… | |
| CVE-2026-114248 | 21 Oct 2026 | CVSS 5.3 | dhikshitha29 Insurance-Management-SystemA security vulnerability has been detected in dhikshitha29 Insurance-Management-System… | |
| CVE-2026-114386 | 21 Oct 2026 | CVSS 4.8 | pydantic-ai-harnessPydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from run_code in the CodeMode… | |
| CVE-2026-114387 | 21 Oct 2026 | CVSS 8.8 | shopperlabs shopperShopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding only access_dashboard to create… | |
| CVE-2026-111849 | 21 Oct 2026 | CVSS 5.3 | Magepeople inc. WpTravellyMissing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control… | |
| CVE-2026-114120 | 21 Oct 2026 | CVSS 5.4 | WPDeveloper SchedulePressSchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's… | |
| CVE-2026-114243 | 21 Oct 2026 | CVSS 7.3 | dhikshitha29 Insurance-Management-SystemA security flaw has been discovered in dhikshitha29 Insurance-Management-System… | |
| CVE-2026-80463 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUnbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to… | |
| CVE-2026-81755 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory… | |
| CVE-2026-78048 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCA reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms… | |
| CVE-2026-78058 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated… | |
| CVE-2026-78066 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCResource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the… | |
| CVE-2026-78334 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCMissing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server… | |
| CVE-2026-79704 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCAn out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client… | |
| CVE-2026-59562 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDBMissing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are… | |
| CVE-2026-61902 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCApache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in… | |
| CVE-2026-61916 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCOut-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned… | |
| CVE-2026-66392 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCApache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the… | |
| CVE-2026-74755 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCAn integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by… | |
| CVE-2026-74757 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the… | |
| CVE-2026-74758 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCA heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by… | |
| CVE-2026-54425 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a… | |
| CVE-2026-54426 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by… | |
| CVE-2026-54427 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF… | |
| CVE-2026-56386 | 21 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache bRPCInteger underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause… | |
| CVE-2026-56387 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who… | |
| CVE-2026-56388 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a… | |
| CVE-2026-58064 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete… | |
| CVE-2026-59229 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDBThe Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion… | |
| CVE-2026-48830 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCImproper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin… | |
| CVE-2026-114242 | 21 Oct 2026 | CVSS 7.3 | dhikshitha29 Insurance-Management-SystemA vulnerability was identified in dhikshitha29 Insurance-Management-System… | |
| CVE-2026-87095 | 21 Oct 2026 | CVSS 9.1 | Acronis Cyber InfrastructureSensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber… | |
| CVE-2026-87096 | 21 Oct 2026 | CVSS 3.3 | Acronis Cyber InfrastructureSensitive information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber… | |
| CVE-2026-41114 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDB JDBC driverUncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11… | |
| CVE-2026-58663 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDBAn authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users… | |
| CVE-2026-110369 | 21 Oct 2026 | CVSS 8.8 | GS Plugins WordPress Team Members – GS PluginsDeserialization of Untrusted Data vulnerability in GS Plugins WordPress Team Members – GS Plugins gs-team-members allows Object Injection.This issue… | |
| CVE-2026-110370 | 21 Oct 2026 | CVSS 8.8 | GS Plugins GS Pins for PinterestDeserialization of Untrusted Data vulnerability in GS Plugins GS Pins for Pinterest gs-pinterest-portfolio allows Object Injection.This issue affects… | |
| CVE-2026-110884 | 21 Oct 2026 | CVSS 7.1 | geekontheroad Live Summary for Gravity FormsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in geekontheroad Live Summary for Gravity Forms… | |
| CVE-2026-105923 | 21 Oct 2026 | CVSS 4.0 | QtA malicious SVG can trigger an integer overflow which in turn triggers a null-pointer dereference in VectorImage QML Type. | |
| CVE-2026-85683 | 21 Oct 2026 | CVSS 8.8 | Unknown Jane MenuThe Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by… | |
| CVE-2026-96405 | 21 Oct 2026 | CVSS 5.3 | NLnet Labs UnboundNLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no… | |
| CVE-2026-97206 | 21 Oct 2026 | CVSS 7.5 | NLnet Labs UnboundNLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under… | |
| CVE-2026-14556 | 21 Oct 2026 | CVSS 5.4 | Unknown HappyFormsThe HappyForms WordPress plugin before 1.26.15 does not sanitise or escape a user-controlled referral value before embedding it in the form… | |
| CVE-2026-35501 | 21 Oct 2026 | CVSS 3.7 | NLnet Labs UnboundWhen NLnet Labs Unbound 1.0.1 up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an… | |
| CVE-2026-50106 | 21 Oct 2026 | CVSS 6.5 | NLnet Labs UnboundWhen NLnet Labs Unbound up to and including version 1.26.1 is configured with both a root trust anchor and an additional 'trust-anchor:' for an… | |
| CVE-2026-70386 | 21 Oct 2026 | CVSS 8.5 | OnePlus OxygenOSImproper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization vulnerability in OnePlus… | |
| CVE-2026-70387 | 21 Oct 2026 | CVSS 8.4 | OnePlus OxygenOSExposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android. The olc2 logging HAL exposes a binder… | |
| CVE-2026-104642 | 21 Oct 2026 | CVSS 2.7 | Unknown Simple Shopping CartThe Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only the site owner can set, allowing… | |
| CVE-2026-105256 | 21 Oct 2026 | CVSS 5.3 | Unknown LatePointThe LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is charged for a booking against the… | |
| CVE-2026-107447 | 21 Oct 2026 | CVSS 5.3 | Unknown Contest GalleryThe Contest Gallery WordPress plugin before 34.0.1 does not reliably validate the visitor identity used to enforce its one-vote-per-entry… | |
| CVE-2026-109125 | 21 Oct 2026 | CVSS 5.3 | NLnet Labs UnboundIn NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0'… | |
| CVE-2026-110938 | 21 Oct 2026 | CVSS 8.7 | Eclipse Foundation Eclipse OpenJ9In Eclipse OpenJ9 versions up to 0.63.0, the JITServer component is vulnerable to denial of service due to improper boundary checks during protocol… | |
| CVE-2026-114236 | 21 Oct 2026 | CVSS 3.3 | Red Hat Confidential Compute Attestationstorage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded… | |
| CVE-2026-101138 | 21 Oct 2026 | CVSS 5.3 | Unknown CMP – Coming Soon & MaintenanceThe CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages added to its page whitelist by… | |
| CVE-2026-103301 | 21 Oct 2026 | CVSS 5.3 | Unknown Payment Gateway for TelcellThe Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret… | |
| CVE-2026-104641 | 21 Oct 2026 | CVSS 5.3 | Unknown Simple Shopping CartThe Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site… | |
| CVE-2026-17557 | 21 Oct 2026 | CVSS 6.5 | Red Hat OpenShift AI (RHOAI)A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could… | |
| CVE-2026-110899 | 21 Oct 2026 | CVSS 7.1 | Kevin Stover Ninja FormsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows… | |
| CVE-2026-111074 | 21 Oct 2026 | CVSS 8.7 | Eclipse Foundation Eclipse OpenJ9In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing… | |
| CVE-2026-111075 | 21 Oct 2026 | CVSS 8.7 | Eclipse Foundation Eclipse OpenJ9In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`… | |
| CVE-2026-107435 | 21 Oct 2026 | CVSS 7.1 | WP Chill Strong TestimonialsImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials… | |
| CVE-2026-93856 | 21 Oct 2026 | CVSS 4.3 | OpenStack CinderIn OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped… | |
| CVE-2026-96901 | 21 Oct 2026 | CVSS 3.7 | Unknown Cart Abandonment Recovery for WooCommerceThe Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on… | |
| CVE-2026-85642 | 21 Oct 2026 | CVSS 7.5 | Unknown Formidable FormsThe Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit… | |
| CVE-2026-86611 | 21 Oct 2026 | CVSS 4.3 | Unknown Download ManagerThe Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places… | |
| CVE-2026-87837 | 21 Oct 2026 | CVSS 5.3 | Unknown Wava Payment PluginThe Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who… | |
| CVE-2026-87838 | 21 Oct 2026 | CVSS 6.5 | Unknown Wava Payment PluginThe Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST… | |
| CVE-2026-88784 | 21 Oct 2026 | CVSS 7.5 | Unknown Translate WordPress with Weglot 2.0The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a… | |
| CVE-2026-92997 | 21 Oct 2026 | CVSS 8.6 | Unknown Click n Chat (Chat Widget Integration)The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column… | |
| CVE-2026-92998 | 21 Oct 2026 | CVSS 8.6 | Unknown Click n Chat (Chat Widget Integration)The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY… | |
| CVE-2026-92999 | 21 Oct 2026 | CVSS 5.3 | Unknown Click n Chat (Chat Widget Integration)The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing… | |
| CVE-2026-71195 | 21 Oct 2026 | CVSS 9.9 | OpenStack ManilaIn OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers… | |
| CVE-2026-79627 | 21 Oct 2026 | CVSS 7.1 | Unknown Advanced File ManagerThe Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing… | |
| CVE-2026-81812 | 21 Oct 2026 | CVSS 6.4 | Unknown Elementor Website BuilderThe Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the… | |
| CVE-2026-81813 | 21 Oct 2026 | CVSS 6.8 | Unknown Elementor Website BuilderThe Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and… | |
| CVE-2026-110982 | 21 Oct 2026 | CVSS 4.9 | Unknown AI EngineThe AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and… | |
| CVE-2026-111574 | 21 Oct 2026 | CVSS 7.5 | Unknown Redirection for Contact Form 7The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before… | |
| CVE-2026-111596 | 21 Oct 2026 | CVSS 5.3 | Unknown Kliken: Ads + Pixel for MetaThe Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's… | |
| CVE-2026-111947 | 21 Oct 2026 | CVSS 5.5 | Unknown Pricing Table WordPress PluginThe Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table… | |
| CVE-2026-111948 | 21 Oct 2026 | CVSS 7.1 | Unknown User Profile BuilderThe User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of… | |
| CVE-2026-111949 | 21 Oct 2026 | CVSS 7.5 | Unknown miniOrange 2FAThe miniOrange 2FA WordPress plugin before 6.3.1 does not prevent a pending passkey login from registering an additional passkey on an account that… | |
| CVE-2026-111955 | 21 Oct 2026 | CVSS 6.5 | Unknown WholesaleXThe WholesaleX WordPress plugin before 3.0.9 does not check that a stored account confirmation code is set before comparing it with the one supplied… | |
| CVE-2026-111956 | 21 Oct 2026 | CVSS 5.9 | Unknown WholesaleXThe WholesaleX WordPress plugin before 3.0.9 does not protect or remove the user-import file it keeps in a publicly accessible location under a… | |
| CVE-2026-111957 | 21 Oct 2026 | CVSS 5.3 | Unknown SUMIT Payment Gateway for WooCommerceThe SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not bind the payment it confirms with the provider to the order being… |
Page 9 of 168