CVE-database
126.123 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-118637 LOW · 2.7 The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its shortcodes, allowing users…
- CVE-2026-118523 MEDIUM · 5.3 The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other…
- CVE-2026-118422 HIGH · 7.1 The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream endpoint, allowing unauthenticated visitors to redirect…
- CVE-2026-118407 MEDIUM · 5.4 The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any authenticated user…
- CVE-2026-118404 MEDIUM · 5.3 The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping cart, allowing any unauthenticated user…
- CVE-2026-118403 LOW · 3.7 The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allowing unauthenticated visitors who…
- CVE-2026-115426 MEDIUM · 5.5 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create…
- CVE-2026-115262 MEDIUM · 4.8 The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collation rewrite to schema statements during a…
- CVE-2026-115257 MEDIUM · 5.3 The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing unauthenticated attackers to…
- CVE-2026-115250 MEDIUM · 6.8 The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a…
- CVE-2026-115243 MEDIUM · 6.7 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores when handling an…
- CVE-2026-115242 MEDIUM · 5.5 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only…
- CVE-2026-115241 MEDIUM · 6.5 The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snapshot it actually created…
- CVE-2026-114431 MEDIUM · 6.4 The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that…
- CVE-2026-112244 MEDIUM · 5.3 The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not prevent direct access to some of its bundled PHP files, which initialise…
- CVE-2026-112243 MEDIUM · 5.8 The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its…
- CVE-2026-111962 LOW · 3.7 The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the public web…
- CVE-2026-111740 LOW · 2.7 The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for…
- CVE-2026-110964 MEDIUM · 6.5 The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleting it, allowing a…
- CVE-2026-110692 MEDIUM · 4.1 The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL before using it in a…
- CVE-2026-108068 LOW · 3.8 The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migration functions, which is protected by…
- CVE-2026-108067 LOW · 3.8 The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting stored video and meta records, allowing…
- CVE-2026-108041 HIGH · 7.1 The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed…
- CVE-2026-106649 MEDIUM · 6.8 The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary…
- CVE-2026-106000 MEDIUM · 5.3 The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured to require online payment,…
- CVE-2026-105413 HIGH · 7.5 The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on its submissions admin page, allowing…
- CVE-2026-105191 MEDIUM · 4.3 The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an AJAX action…
- CVE-2026-104719 MEDIUM · 6.4 The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing…
- CVE-2026-101166 LOW · 3.7 The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order for it through its PayPal…
- CVE-2026-101165 LOW · 3.7 The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway before removing a configured…
- CVE-2025-11229 HIGH · 7.2 The system fails to properly enforce scope authorization when the `authorize_all_scopes` configuration is enabled. This allows applications using the client credentials grant type to obtain…
- CVE-2026-105296 MEDIUM · 5.4 Multiple Akeeba products lack the anti-CSRF check on some actions. If the user access a malicious page while logged into the product, unintended operations may…
- CVE-2026-80335 HIGH · 7.6 Memory Corruption when processing firmware update data in Download mode due to a missing bounds check.
- CVE-2026-79405 HIGH · 7.5 Transient DOS when processing a malformed NR RRC configuration message due to improper input validation.
- CVE-2026-121803 NONE Rejected reason: This CVE ID is a duplicate of CVE-2026-80335 (VULN-002 dl_download_midst) and has been rejected.
- CVE-2026-121802 CRITICAL · 9.1 @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), because it signs a caller-supplied state value without checking whether…
- CVE-2026-121618 MEDIUM · 5.3 A weakness has been identified in Linksys E5600 1.1.0.26. This affects an unknown part of the file /cgi-bin/fqc.cgi of the component Factory Quality Control. This…
- CVE-2026-121617 HIGH · 7.5 A security flaw has been discovered in Linksys E5600 1.1.0.26. Affected by this issue is the function init_multipart of the file /cgi-bin/upload_fw.cgi of the component…
- CVE-2026-121616 MEDIUM · 5.3 A vulnerability was identified in Linksys E5600 1.1.0.26. Affected by this vulnerability is the function strcpy of the file /cgi-bin/mesh_login.cgi of the component JSON Request…
- CVE-2026-121615 CRITICAL · 10.0 A vulnerability was determined in Linksys E5600 1.1.0.26. Affected is an unknown function of the file /cgi-bin/mesh_login.cgi of the component Login Handler. Executing a manipulation…
- CVE-2026-84730 NONE Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with root privileges via a crafted device name.…
- CVE-2026-84729 NONE Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or potentially cause a denial-of-service (DoS)…
- CVE-2026-121610 HIGH · 7.3 A security flaw has been discovered in funadmin 7.1.0. Impacted is the function Curd::selectList of the file /frontend/ajax/index of the component Frontend List Endpoint. The…
- CVE-2026-121609 CRITICAL · 10.0 A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.1566. This issue affects the function Home of the file /etc/init.d/mpt of the component…
- CVE-2026-121608 HIGH · 7.3 A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.2. This vulnerability affects the function on_push_message of the file /fs2/bin/iscm of…
- CVE-2026-121607 CRITICAL · 10.0 A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.9. This affects the function testspeed_command of the file /fs2/bin/iscm. Performing…
- CVE-2026-112116 NONE An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arbitrary physical memory through…
- CVE-2026-110464 NONE Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry location with Local System privileges, or…
- CVE-2026-121606 CRITICAL · 10.0 A vulnerability has been found in Qihoo 360 D621-2, D603-2, D600-2, D619, D606-6 and D706 up to 6.4.9. Affected by this issue is the function…
- CVE-2026-121600 CRITICAL · 9.9 A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function setMacFilterRules of the file /cgi-bin/cstecgi.cgi of the component MAC…