110,684 indexed
CVECVE vulnerabilities
110,684 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 12,301–12,350 of 110,684 · page 247 of 2214
| ID | Title | Summary |
|---|---|---|
| CVE-2026-81825 | CVE-2026-81825 CVSS 7.2 | The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, an… |
| CVE-2026-81824 | CVE-2026-81824 CVSS 4.7 | The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was socially engineered … |
| CVE-2026-81823 | CVE-2026-81823 CVSS 5.3 | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in informatio… |
| CVE-2026-81822 | CVE-2026-81822 CVSS 8.4 | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ app-native passwords … |
| CVE-2026-81821 | CVE-2026-81821 CVSS 8.4 | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive information. |
| CVE-2026-81820 | CVE-2026-81820 | Affected versions of Flowintel construct timeline HTML using attacker-controllable MISP object fields such as: * object UUID; * object name; *… |
| CVE-2026-8182 | CVE-2026-8182 CVSS 8.8langflow | IBM Langflow OSS 1.0.0 through 1.10.3 installations allow anyone on the internet to execute arbitrary code on the server without any credentials via 2 HTTP req… |
| CVE-2026-81819 | CVE-2026-81819 | Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying … |
| CVE-2026-81818 | CVE-2026-81818 | Affected versions of Flowintel contain an authorization flaw in the administrative user-edit API. The existing authorization check correctly prevented an org… |
| CVE-2026-81817 | CVE-2026-81817 | Affected versions of Flowintel contain an insecure direct object reference / broken object-level authorization issue across numerous task endpoints. The rout… |
| CVE-2026-81814 | CVE-2026-81814 | Affected versions of Flowintel render calendar event titles using innerHTML. Because those titles are derived from case titles, a user able to create or modify… |
| CVE-2026-81810 | CVE-2026-81810 CVSS 7.2 | The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on … |
| CVE-2026-8181 | CVE-2026-8181 CVSS 9.8 | The Burst Statistics – Privacy-Friendly WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Authentication Bypass in versi… |
| CVE-2026-81809 | CVE-2026-81809 CVSS 7.5 | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the … |
| CVE-2026-81807 | CVE-2026-81807 CVSS 8.8 | The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbit… |
| CVE-2026-81806 | CVE-2026-81806 CVSS 7.2 | Server-Side Request Forgery (SSRF) vulnerability in John Darrel Hide My WP Ghost allows Server Side Request Forgery. This issue affects Hide My WP Ghost: from… |
| CVE-2026-81805 | CVE-2026-81805 CVSS 8.1 | Unauthenticated Privilege Escalation in SiteSkite <= 2.1.5 versions. |
| CVE-2026-81804 | CVE-2026-81804 CVSS 7.5 | Unauthenticated Sensitive Data Exposure in ZHBackup – Backup, Restore & Migration <= 2.4.2 versions. |
| CVE-2026-81803 | CVE-2026-81803 CVSS 7.5 | Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions. |
| CVE-2026-81802 | CVE-2026-81802 CVSS 6.5 | Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions. |
| CVE-2026-81801 | CVE-2026-81801 CVSS 8.1 | Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. |
| CVE-2026-81800 | CVE-2026-81800 CVSS 9.3 | Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions. |
| CVE-2026-8180 | CVE-2026-8180 CVSS 7.5ibm | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera … |
| CVE-2026-81799 | CVE-2026-81799 CVSS 7.5 | Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions. |
| CVE-2026-81798 | CVE-2026-81798 CVSS 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affec… |
| CVE-2026-81797 | CVE-2026-81797 CVSS 9.8 | Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions. |
| CVE-2026-81796 | CVE-2026-81796 CVSS 7.3 | Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploitation.This issue af… |
| CVE-2026-81795 | CVE-2026-81795 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions. |
| CVE-2026-81794 | CVE-2026-81794 CVSS 7.5 | Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. |
| CVE-2026-81793 | CVE-2026-81793 CVSS 6.5 | Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Securit… |
| CVE-2026-81792 | CVE-2026-81792 CVSS 6.5 | Incorrect Privilege Assignment vulnerability in MultiVendorX Product Catalog Enquiry for WooCommerce by MultiVendorX woocommerce-catalog-enquiry allows Privile… |
| CVE-2026-81791 | CVE-2026-81791 CVSS 6.5 | Subscriber Cross Site Scripting (XSS) in EventON <= 2.5.7 versions. |
| CVE-2026-81790 | CVE-2026-81790 CVSS 7.5 | Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Se… |
| CVE-2026-8179 | CVE-2026-8179 CVSS 8.8ibm | IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera … |
| CVE-2026-81789 | CVE-2026-81789 CVSS 8.6 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extended for WooCommerce … |
| CVE-2026-81788 | CVE-2026-81788 CVSS 6.3 | Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. |
| CVE-2026-81787 | CVE-2026-81787 CVSS 6.5 | Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. |
| CVE-2026-81786 | CVE-2026-81786 CVSS 7.5 | Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions. |
| CVE-2026-81785 | CVE-2026-81785 CVSS 6.5 | Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions. |
| CVE-2026-81784 | CVE-2026-81784 CVSS 8.1 | Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2. |
| CVE-2026-81783 | CVE-2026-81783 CVSS 7.1 | Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. |
| CVE-2026-81782 | CVE-2026-81782 CVSS 6.5 | Subscriber Cross Site Scripting (XSS) in WP Docs <= 2.3.1 versions. |
| CVE-2026-81781 | CVE-2026-81781 CVSS 7.1 | Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This … |
| CVE-2026-81780 | CVE-2026-81780 CVSS 10.0 | Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions. |
| CVE-2026-8178 | CVE-2026-8178 CVSS 8.1 | An issue exists in Amazon Redshift JDBC Driver versions prior to 2.2.2. Under certain conditions, the driver could load and execute arbitrary classes when proc… |
| CVE-2026-81779 | CVE-2026-81779 CVSS 10.0 | Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspaper… |
| CVE-2026-81778 | CVE-2026-81778 CVSS 6.5 | Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions. |
| CVE-2026-81777 | CVE-2026-81777 CVSS 5.3 | Authentication Bypass by Spoofing vulnerability in WPDeveloper Essential Addons for Elementor allows Identity Spoofing. This issue affects Essential Addons fo… |
| CVE-2026-81776 | CVE-2026-81776 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. |
| CVE-2026-81775 | CVE-2026-81775 CVSS 7.1 | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. |