106,194 indexed
CVECVE vulnerabilities
106,194 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 11,801–11,850 of 106,194 · page 237 of 2124
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81797 | CVE-2026-81797 CVSS 9.8 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. |
| CVE-2026-81796 | CVE-2026-81796 CVSS 7.3 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue af… |
| CVE-2026-81795 | CVE-2026-81795 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions. |
| CVE-2026-81794 | CVE-2026-81794 CVSS 7.5 | Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. |
| CVE-2026-81793 | CVE-2026-81793 CVSS 6.5 | Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Securit… |
| CVE-2026-81792 | CVE-2026-81792 CVSS 6.5 | Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privile… |
| CVE-2026-81791 | CVE-2026-81791 CVSS 6.5 | Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. |
| CVE-2026-81790 | CVE-2026-81790 CVSS 7.5 | Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Se… |
| CVE-2026-8179 | CVE-2026-8179 CVSS 8.8ibm | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera … |
| CVE-2026-81789 | CVE-2026-81789 CVSS 8.6 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce … |
| CVE-2026-81788 | CVE-2026-81788 CVSS 6.3 | Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. |
| CVE-2026-81787 | CVE-2026-81787 CVSS 6.5 | Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. |
| CVE-2026-81786 | CVE-2026-81786 CVSS 7.5 | Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions. |
| CVE-2026-81785 | CVE-2026-81785 CVSS 6.5 | Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions. |
| CVE-2026-81784 | CVE-2026-81784 CVSS 8.1 | Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2. |
| CVE-2026-81783 | CVE-2026-81783 CVSS 7.1 | Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. |
| CVE-2026-81782 | CVE-2026-81782 CVSS 6.5 | Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. |
| CVE-2026-81781 | CVE-2026-81781 CVSS 7.1 | Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This … |
| CVE-2026-81780 | CVE-2026-81780 CVSS 10.0 | Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions. |
| CVE-2026-8178 | CVE-2026-8178 CVSS 8.1 | An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when proc… |
| CVE-2026-81779 | CVE-2026-81779 CVSS 10.0 | Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspaper… |
| CVE-2026-81778 | CVE-2026-81778 CVSS 6.5 | Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions. |
| CVE-2026-81777 | CVE-2026-81777 CVSS 5.3 | Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons fo… |
| CVE-2026-81776 | CVE-2026-81776 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. |
| CVE-2026-81775 | CVE-2026-81775 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. |
| CVE-2026-81774 | CVE-2026-81774 CVSS 7.5 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dotstore WooCommerce Product Attachment woo-product-attachment allo… |
| CVE-2026-81773 | CVE-2026-81773 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. |
| CVE-2026-81772 | CVE-2026-81772 CVSS 8.8 | Unauthenticated PHP Object Injection in Ninja Forms - Layout & Styles <= 3.0.31 versions. |
| CVE-2026-81771 | CVE-2026-81771 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions. |
| CVE-2026-81770 | CVE-2026-81770 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. |
| CVE-2026-8177 | CVE-2026-8177 CVSS 7.5 | XML::LibXML versions through 2.0210 for Perl read out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name… |
| CVE-2026-81769 | CVE-2026-81769 CVSS 8.8 | Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1. |
| CVE-2026-81768 | CVE-2026-81768 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. |
| CVE-2026-81767 | CVE-2026-81767 CVSS 7.5 | Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. |
| CVE-2026-81766 | CVE-2026-81766 CVSS 6.6 | The Really Simple Security WordPress plugin before 9.8.0 does not check that the user is allowed to install Really Simple Security WordPress plugin before 9.… |
| CVE-2026-81765 | CVE-2026-81765 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. |
| CVE-2026-81764 | CVE-2026-81764 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Email Essentials <= 6.0.6 versions. |
| CVE-2026-81763 | CVE-2026-81763 CVSS 9.3 | Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. |
| CVE-2026-81762 | CVE-2026-81762 CVSS 6.5 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions. |
| CVE-2026-81761 | CVE-2026-81761 CVSS 4.3 | Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. |
| CVE-2026-81760 | CVE-2026-81760 CVSS 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue af… |
| CVE-2026-8176 | CVE-2026-8176 CVSS 7.5 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up … |
| CVE-2026-81759 | CVE-2026-81759 CVSS 5.4 | Contributor Broken Access Control in WpEvently <= 5.5.0 versions. |
| CVE-2026-81758 | CVE-2026-81758 CVSS 6.3 | Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. |
| CVE-2026-81757 | CVE-2026-81757 CVSS 7.2 | Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions. |
| CVE-2026-81756 | CVE-2026-81756 CVSS 9.3 | Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions. |
| CVE-2026-81754 | CVE-2026-81754 CVSS 7.2 | The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Age… |
| CVE-2026-81753 | CVE-2026-81753 | Affected versions of Flowintel render Mermaid blocks contained in stored case notes without sufficiently neutralizing attacker-controlled markup. Because Merma… |
| CVE-2026-8175 | CVE-2026-8175 CVSS 9.8ibm | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera … |
| CVE-2026-81743 | CVE-2026-81743 | Affected versions of Flowintel allow the LOG_FILE configuration value to be modified through system settings without restricting it to a filename inside the in… |