CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-103501 NONE Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in LIST mode, from either a byte…
- CVE-2026-108506 MEDIUM · 5.5 ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve…
- CVE-2026-106139 MEDIUM · 5.4 In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as…
- CVE-2026-106138 MEDIUM · 5.4 In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without…
- CVE-2026-91136 HIGH · 7.5 The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the…
- CVE-2026-4791 MEDIUM · 6.4 The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to,…
- CVE-2026-108505 LOW · 3.3 ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.
- CVE-2026-107657 HIGH · 7.2 The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all…
- CVE-2026-104722 MEDIUM · 4.9 The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in…
- CVE-2026-97396 MEDIUM · 6.4 The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions…
- CVE-2026-97340 MEDIUM · 6.4 The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social…
- CVE-2026-96765 HIGH · 7.2 De plug-in WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via de parameter 'id_token' in…
- CVE-2026-96662 HIGH · 7.5 De Appointment Booking Plugin – LatePoint | Calendar & Scheduling voor WordPress-plug-in voor WordPress is kwetsbaar voor generieke SQL-injectie via 'booking[service_id]' -parameter in alle versies…
- CVE-2026-96653 MEDIUM · 6.5 De WP Directory Kit-plug-in voor WordPress is kwetsbaar voor op tijd gebaseerde SQL-injectie via 'display_name' -profielveld (tweede bestelling) in alle versies tot en met 1.5.9…
- CVE-2026-96563 MEDIUM · 6.4 De plug-in Motors – Car Dealership & Classified Listings Plugin voor WordPress is kwetsbaar voor Stored Cross-Site Scripting via de parameter 'stm_f_s' in alle versies…
- CVE-2026-96278 HIGH · 7.2 The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including,…
- CVE-2026-93951 HIGH · 7.1 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.
- CVE-2026-93950 HIGH · 7.5 Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.
- CVE-2026-93949 HIGH · 7.1 Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from…
- CVE-2026-93945 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in Axiomthemes Balance balance allows Object Injection.This issue affects Balance: from n/a through 1.12.0.
- CVE-2026-93944 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Camelia camelia allows Object Injection.This issue affects Camelia: from n/a through 1.2.15.
- CVE-2026-93943 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Convex convex allows Object Injection.This issue affects Convex: from n/a through 1.16.0.
- CVE-2026-93942 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Dwell dwell allows Object Injection.This issue affects Dwell: from n/a through 1.16.0.
- CVE-2026-93941 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Edema edema allows Object Injection.This issue affects Edema: from n/a through 1.2.2.2.
- CVE-2026-93940 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Greeny greeny allows Object Injection.This issue affects Greeny: from n/a through 2.10.0.
- CVE-2026-93938 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hogwords hogwords allows Object Injection.This issue affects Hogwords: from n/a through 1.2.7.
- CVE-2026-93937 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Hygia hygia allows Object Injection.This issue affects Hygia: from n/a through 1.21.0.
- CVE-2026-93936 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.
- CVE-2026-93935 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Let's Play playhockey allows Object Injection.This issue affects Let's Play: from n/a through 1.1.15.
- CVE-2026-93934 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Partiso partiso allows Object Injection.This issue affects Partiso: from n/a through 1.1.13.
- CVE-2026-93933 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda: from n/a through 1.2.4.
- CVE-2026-93932 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Casa: from n/a through 1.0.12.
- CVE-2026-93931 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a through 1.12.0.
- CVE-2026-93930 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a through 2.9.0.
- CVE-2026-93929 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: from n/a through 1.1.16.
- CVE-2026-93927 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1.6.0.
- CVE-2026-93746 HIGH · 7.5 The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up…
- CVE-2026-62046 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype: from n/a through 2.1.12.
- CVE-2026-62045 CRITICAL · 9.8 Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklovers: from n/a through 2.13.0.
- CVE-2026-108504 MEDIUM · 5.5 ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method…
- CVE-2026-106606 HIGH · 7.2 Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.
- CVE-2026-104803 CRITICAL · 9.8 The WPCOM Member plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.7.27 via the `uuid` and `code` parameters…
- CVE-2026-104759 HIGH · 8.1 The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Authentication Bypass via OIDC Nonce Replay in all…
- CVE-2026-104728 MEDIUM · 4.3 The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up…
- CVE-2026-103478 MEDIUM · 6.4 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkout[billing][phone] (and state / taxid /…
- CVE-2026-102774 MEDIUM · 6.4 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post…
- CVE-2026-102291 MEDIUM · 5.4 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and…
- CVE-2026-101921 MEDIUM · 4.7 The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected…
- CVE-2026-101920 HIGH · 7.2 The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment…
- CVE-2026-100178 HIGH · 7.2 The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'adverts_location' parameter in all versions up to, and including,…