CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-42723 CRITICAL · 9.8 Unauthenticated PHP Object Injection in CleanSkin
- CVE-2026-42722 HIGH · 7.6 Administrator SQL Injection in Frontend Admin by DynamiApps
- CVE-2026-42719 CRITICAL · 9.8 Subscriber PHP Object Injection in Dynamic User Directory
- CVE-2026-42718 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Booster for WooCommerce
- CVE-2026-42717 HIGH · 7.6 Administrator SQL Injection in Leyka
- CVE-2026-42716 CRITICAL · 9.8 Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway
- CVE-2026-42715 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web
- CVE-2026-42712 HIGH · 8.5 Subscriber SQL Injection in Qode Tours
- CVE-2026-42711 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web
- CVE-2026-42709 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce
- CVE-2026-42706 HIGH · 7.5 Unauthenticated Broken Access Control in DK
- CVE-2026-42705 HIGH · 7.5 Unauthenticated Broken Access Control in Grand News
- CVE-2026-42704 HIGH · 8.1 Unauthenticated Local File Inclusion in Kids Care
- CVE-2026-42702 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a…
- CVE-2026-42699 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in FV Player 8
- CVE-2026-42697 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue…
- CVE-2026-42696 CRITICAL · 10.0 Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue…
- CVE-2026-42693 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Jannah
- CVE-2026-42633 HIGH · 8.5 Subscriber SQL Injection in Events Manager
- CVE-2026-42632 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate
- CVE-2026-42631 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Qode Music
- CVE-2026-42630 HIGH · 7.5 Unauthenticated Sensitive Data Exposure in Web Plura Backup & Restore Manager
- CVE-2026-42419 MEDIUM · 5.9 Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup
- CVE-2026-40808 MEDIUM · 6.5 Subscriber Broken Access Control in Jetpack VideoPress
- CVE-2026-40805 HIGH · 7.7 Subscriber Arbitrary File Deletion in PeepSo
- CVE-2026-40803 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Jotform – AI Chatbot
- CVE-2026-40802 HIGH · 7.6 Missing Authorization vulnerability in pubjet Pubjet | پابجت pubjet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pubjet | پابجت: from n/a through…
- CVE-2026-40801 HIGH · 8.1 Subscriber Broken Access Control in Wordable
- CVE-2026-40800 CRITICAL · 9.3 Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes
- CVE-2026-40777 HIGH · 8.1 Subscriber Broken Access Control in WPSection
- CVE-2026-39802 HIGH · 8.1 Unauthenticated Remote Code Execution (RCE) in Everest Backup
- CVE-2026-39801 CRITICAL · 9.8 Subscriber Privilege Escalation in AIWU
- CVE-2026-39800 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce
- CVE-2026-39799 HIGH · 7.1 Unauthenticated Cross Site Scripting (XSS) in WP File Download
- CVE-2026-27350 HIGH · 7.2 Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.
- CVE-2026-108604 MEDIUM · 6.3 Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only…
- CVE-2026-108603 LOW · 3.3 slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers…
- CVE-2026-108602 MEDIUM · 4.3 Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using…
- CVE-2026-107434 MEDIUM · 5.4 Subscriber Bypass Vulnerability in MicroPayments
- CVE-2026-107420 MEDIUM · 5.3 Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway
- CVE-2026-103685 MEDIUM · 4.3 Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects…
- CVE-2026-96341 HIGH · 8.2 Onjuiste kwetsbaarheid Privilege Assignment in WPMU DEV FORMINATOR FORMINATOR staat Privilege Escalation toe. Dit probleem heeft invloed op Forminator: van n.v.t. tot en met 1.57.3.
- CVE-2026-94590 MEDIUM · 6.5 Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a…
- CVE-2026-57806 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects…
- CVE-2026-108600 MEDIUM · 4.7 open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root…
- CVE-2026-108599 MEDIUM · 4.7 phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission…
- CVE-2026-108598 CRITICAL · 9.8 Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can…
- CVE-2026-108597 MEDIUM · 4.8 Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers…
- CVE-2026-108596 MEDIUM · 5.3 OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know…
- CVE-2026-108595 MEDIUM · 5.3 Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to…