CVE-database
126.505 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-107320 MEDIUM · 5.3 The GamiPress WordPress plugin before 8.0.6 does not properly authorize access to private activity log entries, allowing unauthenticated users to retrieve the private activity logs…
- CVE-2026-107319 MEDIUM · 4.3 The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authenticated…
- CVE-2026-107178 MEDIUM · 6.8 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.16 does not escape gallery lightbox configuration values before printing them into an inline script…
- CVE-2026-107160 MEDIUM · 5.3 De WordPress-plug-in LTL Freight Quotes vóór 4.2.19 voert geen autorisatiecontrole of invoerontsmetting uit voordat bepaalde waarden van een verzoek worden opgeslagen, waardoor niet-geverifieerde gebruikers HTML…
- CVE-2026-107158 MEDIUM · 5.3 The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to…
- CVE-2026-107126 HIGH · 8.8 The WP Booking System WordPress plugin before 2.1.0.1 does not sanitise and escape a client-controllable request value before storing it and later outputting it in…
- CVE-2026-106646 MEDIUM · 5.9 The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references…
- CVE-2026-106469 NONE De Gutenverse Form WordPress-plugin vóór versie 3.0.11 zuivert de SVG-pictogrammarkup die in de formulierblokken is opgeslagen niet voordat deze wordt gedecodeerd en in de pagina…
- CVE-2026-106166 MEDIUM · 5.3 The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing unauthenticated attackers to overwrite,…
- CVE-2026-106099 MEDIUM · 5.3 The WP Data Access WordPress plugin before 5.5.84 does not restrict its database table export action to authorized users, gating it only with a token…
- CVE-2026-106098 MEDIUM · 5.3 The WP Data Access WordPress plugin before 5.5.77 does not correctly check authorization on one of its application REST endpoints, verifying only read permission before…
- CVE-2026-105975 MEDIUM · 5.3 The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from…
- CVE-2026-105969 MEDIUM · 5.3 The CodeAtoZ B2B Suite for WooCommerce WordPress plugin before 1.6.1 does not properly restrict access to guest-submitted quotes, allowing unauthenticated users to retrieve another guest's…
- CVE-2026-105261 MEDIUM · 6.8 The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist…
- CVE-2026-104751 MEDIUM · 5.3 De Rank Math SEO WordPress-plugin vóór versie 1.0.280 voert geen controle uit op toegangsrechten of nonce voordat de opgeslagen SEO-analysedata worden gewist, waardoor niet-geauthenticeerde gebruikers…
- CVE-2026-104644 MEDIUM · 6.8 The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline…
- CVE-2026-103307 HIGH · 8.6 The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement,…
- CVE-2026-94370 NONE Een defect in de Qt voor MCU's core string handling veroorzaakt heap geheugenbeschadiging. Wanneer een toepassing tekst doorgeeft aan Qt Quick Ultralite met behulp van…
- CVE-2026-50218 HIGH · 8.5 Akamai GPA (Guardicore Platform Agent) client on all platforms before 7.4 improperly validates JWT tokens used for seeding. By convincing a user to interact with…
- CVE-2026-50217 MEDIUM · 4.7 A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged user to cause a denial of…
- CVE-2026-50216 MEDIUM · 5.3 An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platform Agent (GPA) for macOS, whereby…
- CVE-2026-110459 HIGH · 8.6 Een kwaadwillende actor met toegang tot het netwerk kan misbruik maken van een kwetsbaarheid voor ongepast toegangscontrole die is gevonden in UniFi Protect AI Key…
- CVE-2026-110458 LOW · 3.7 A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to…
- CVE-2026-110457 LOW · 3.7 A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to…
- CVE-2026-107153 MEDIUM · 6.6 Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot (AVB) functionality. With physical access to the affected device,…
- CVE-2026-50215 MEDIUM · 4.4 A use-after-free exists in the Windows WFP packet-capture driver shipped with Akamai Guardicore Platform Agent (GPA) before 7.4. When an IPv6 proxy/redirect rule is active,…
- CVE-2026-46449 MEDIUM · 6.7 The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptunneld component. The vulnerability is…
- CVE-2026-110456 MEDIUM · 5.3 A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key…
- CVE-2026-110455 HIGH · 8.1 A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key…
- CVE-2026-110454 MEDIUM · 5.3 Een kwaadwillende gebruiker met toegang tot het netwerk zou een beveiligingslek in de UniFi Protect AI Key (Improper Access Control) kunnen misbruiken om via het…
- CVE-2026-110453 MEDIUM · 4.3 Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients.
- CVE-2026-110452 MEDIUM · 4.0 The multi-user installer in Nix before 2.35.3 sets the ownership of store contents to the user (who invoked the installer) even though it should be…
- CVE-2026-110451 MEDIUM · 4.3 Nix before 2.35.3 and Lix before 2.95.4 on macOS allow a Seatbelt sandbox escape (for an unconfined build) because a certain size threshold is mishandled.
- CVE-2026-110450 HIGH · 8.0 Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before…
- CVE-2026-105429 HIGH · 8.0 Improper neutralization of special elements in the NetBird client SSH configuration manager (client/ssh/config/manager.go) in NetBird versions 0.60.0 through 0.74.6 allows a malicious or compromised peer…
- CVE-2026-103369 MEDIUM · 6.4 The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions…
- CVE-2026-101926 MEDIUM · 6.5 De Hyyan WooCommerce Polylang-integratieplug-in voor WordPress is kwetsbaar voor SQL-injectie via de parameter 'variation_ids' van de Ajax-actie 'woocommerce_remove_variations' in versies tot en met 1.5.0 vanwege…
- CVE-2026-101924 HIGH · 7.2 The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on…
- CVE-2026-97471 MEDIUM · 5.3 The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.16.1 via the 'args[link_target]' parameter.…
- CVE-2026-97398 HIGH · 7.2 The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including,…
- CVE-2026-97020 MEDIUM · 6.4 The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due…
- CVE-2026-96661 HIGH · 7.5 The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1…
- CVE-2026-95816 HIGH · 7.2 The Smart Forms – when you need more than just a contact form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formString'…
- CVE-2026-95808 HIGH · 7.5 The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to blind SQL Injection via the 'inputs'…
- CVE-2026-95807 MEDIUM · 6.4 The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7…
- CVE-2026-94377 HIGH · 7.2 The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including,…
- CVE-2026-93885 HIGH · 7.2 The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up…
- CVE-2026-87855 CRITICAL · 9.8 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.3 via the saveImage() function.…
- CVE-2026-83592 HIGH · 7.2 The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to,…
- CVE-2026-78193 HIGH · 7.5 The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to time-based SQL Injection via 'product.push' Identity Endpoint in all versions up to, and including, 2.4.3…