CVE-database
126.581 CVEs in database. Zoek op product (bv. fortinet, exchange) of CVE-ID.
- CVE-2026-71889 NONE In Bouncy Castle voor Java vóór 1.86, noch kopie van PKIXCertPathReviewer - org.bouncycastle.pkix.jcajce.PKIXCertPathReviewer noch de legacy org.bouncycastle.x509.PKIXCertPathReviewer - heeft X.509 naambeperkingen toegepast op het eindentiteitscertificaat.…
- CVE-2026-71888 NONE In Bouncy Castle voor Java vóór 1.86 accepteerde de streaming CMS AuthenticatedData parser een bericht waarvan de digestAlgorithm en authAttrs velden het oneens waren over…
- CVE-2026-71887 NONE In Bouncy Castle for Java before 1.86, the high-level OpenPGP API accepted a data signature made by a signing subkey whose Subkey Binding signature carried…
- CVE-2026-71886 NONE In Bouncy Castle for Java before 1.86, the high-level OpenPGP certificate API accepted a third-party certification or trust delegation from any component key of the…
- CVE-2026-71885 NONE In Bouncy Castle voor Java vóór 1.86 bindt de implementatie van Messaging Layer Security (MLS, RFC 9420) geen X.509-referentie aan de signature_key van een LeafNode.…
- CVE-2026-71883 NONE In Bouncy Castle for Java LTS before 2.73.13, the one-shot native packet ciphers for AES-CBC, CCM, CFB, CTR, GCM and GCM-SIV released the caller's key,…
- CVE-2026-18040 NONE In Bouncy Castle for Java before 1.86, HQC leaked secret-derived data through two side channels: its GF(2^8) arithmetic used lookup tables indexed by field elements,…
- CVE-2026-92767 MEDIUM · 6.4 The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5…
- CVE-2026-92084 CRITICAL · 9.1 The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up…
- CVE-2026-104982 MEDIUM · 4.3 A flaw has been found in Linux Mint Xreader up to 4.6.5. This issue affects the function setup_document_content_list/g_strdup_printf of the file backend/epub/epub-document.c of the component…
- CVE-2026-97660 HIGH · 7.2 The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all…
- CVE-2026-97343 MEDIUM · 4.3 The Burst Statistics – Simple WordPress Analytics (Google Analytics Alternative) plugin for WordPress is vulnerable to Improper Authentication leading to Account Persistence in all versions…
- CVE-2026-96267 HIGH · 7.5 The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to generic SQL Injection via the 'fullRef' parameter in all versions up to,…
- CVE-2026-94505 HIGH · 8.1 The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,…
- CVE-2026-93896 MEDIUM · 6.1 The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the…
- CVE-2026-93889 HIGH · 7.2 The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up…
- CVE-2026-92974 MEDIUM · 6.1 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions…
- CVE-2026-87115 CRITICAL · 9.1 The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in…
- CVE-2026-75028 HIGH · 7.5 The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up…
- CVE-2026-18443 HIGH · 8.8 The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in…
- CVE-2026-15795 MEDIUM · 6.4 The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up…
- CVE-2026-11601 MEDIUM · 5.3 The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to,…
- CVE-2026-104313 MEDIUM · 6.1 The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versions up to,…
- CVE-2026-103519 MEDIUM · 5.4 The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due…
- CVE-2026-103421 MEDIUM · 5.4 The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter…
- CVE-2026-100157 MEDIUM · 6.5 The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.3. This is due…
- CVE-2026-97344 MEDIUM · 6.4 The Wp Social Login and Register Social Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Alt Attribute via Arbitrary User Meta…
- CVE-2026-97341 HIGH · 7.2 The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to,…
- CVE-2026-97337 HIGH · 7.5 The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via…
- CVE-2026-96962 LOW · 3.7 The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to…
- CVE-2026-96650 HIGH · 7.2 The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platform_user_photo' Custom Field in all versions up to, and including, 3.3.11 due…
- CVE-2026-96575 HIGH · 7.2 The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder in…
- CVE-2026-96564 HIGH · 7.2 The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Author Display Name in all versions…
- CVE-2026-94239 MEDIUM · 6.8 The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing…
- CVE-2026-94238 MEDIUM · 6.8 The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users granted the Loco Translate…
- CVE-2026-93430 HIGH · 7.2 The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX in all versions…
- CVE-2026-92923 MEDIUM · 6.3 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise and escape a parameter before using it in a SQL statement, allowing users…
- CVE-2026-92437 MEDIUM · 5.3 The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication, a nonce or an ownership check before it acts on a customer's abandoned-cart…
- CVE-2026-91108 MEDIUM · 4.3 The Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin for WordPress is vulnerable to authorization bypass in all versions…
- CVE-2026-91078 HIGH · 8.2 The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be…
- CVE-2026-89236 HIGH · 8.6 The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL…
- CVE-2026-88783 HIGH · 8.8 The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the…
- CVE-2026-88782 MEDIUM · 6.8 The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link…
- CVE-2026-87091 HIGH · 7.2 The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Settlement Notification Parameters in all versions up to, and including, 2.12.2 due…
- CVE-2026-86834 LOW · 3.7 The MetForm WordPress plugin before 4.3.1 does not properly restrict access to a debug file it writes to the web root on every form submission…
- CVE-2026-86832 MEDIUM · 5.3 The MetForm WordPress plugin before 4.3.1 does not properly restrict access to form submission data, allowing unauthenticated attackers to view submitter information through the REST…
- CVE-2026-85568 MEDIUM · 6.8 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not correctly handle a search value before rewriting an already prepared SQL statement, allowing unauthenticated…
- CVE-2026-85015 MEDIUM · 6.6 The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not sanitise file paths inside uploaded archives before extracting them, allowing authenticated users with access…
- CVE-2026-80518 LOW · 3.7 The WP Ultimate CSV Importer WordPress plugin before 9.2 does not use a site-specific secret when deriving the storage location of the import logs it…
- CVE-2026-80517 LOW · 3.5 The WP Ultimate CSV Importer WordPress plugin before 9.2 does not properly validate the file types contained in an uploaded archive nor sanitise their content…