CVEs
Browse the synced catalog, newest first.
- RUSTSEC-2026-0466`build_dep` was removed from crates.io for malicious codebuild_dep
- RUSTSEC-2026-0467`top_level_crate` was removed from crates.io for malicious codetop_level_crate
- RUSTSEC-2026-0468`shinchina` was removed from crates.io for malicious codeshinchina
- RUSTSEC-2026-0471`sec-gemini` was removed from crates.io for malicious codesec-gemini
- RUSTSEC-2026-0472`shinchina-test` was removed from crates.io for malicious codeshinchina-test
- CVE-2026-85111Apache James: Denial of service upon MIME parsingApache Software Foundation Apache James · Apache Software F…
- CVE-2026-85108Apache James MIME4J: Denial of service due to Allocation of Resources Without Limits or ThrottlingApache Software Foundation org.apache.james:apache-mime4j-c…
- CVE-2026-123655Moodle: missing access checks on h5p content filesmoodle
- CVE-2026-76168Apache James: ManageSieve file implementation cross-user path traversalApache Software Foundation Apache James
- CVE-2026-74756Apache James: WebAdmin exposed without authentication on official Docker defaultApache Software Foundation Apache James
- CVE-2026-76171Apache James: SSRF filter bypass in the JMAP PushSubscription web-push clientApache Software Foundation Apache James
- CVE-2026-49939Apache James: Negative IMAP ACL administer authorization bypass through JMAP protocolApache Software Foundation Apache James
- CVE-2025-66621Apache James: SASL OAUTHBEARER do not validate aud in JWT payload if misconfigredApache Software Foundation Apache James
- CVE-2026-103908AMP for WP <= 1.1.18 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Author Biographical Infomohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2026-120035RSS Aggregator by Feedzy <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting via Feed Item Titlethemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2026-107658BuddyForms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via 'bf_post_type' Parameter via Post-Type Confusionthemekraft BuddyForms
- CVE-2026-119178Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restorationshark986 Smart Cookie Kit
- CVE-2026-92895Live2DWebCanvas <= 2.2.1 - Unauthenticated Arbitrary File Upload via 'modelApi' Parameterjiangweifang Live2DWebCanvas
- CVE-2026-116624Advanced Members for ACF <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation via Account Change-Password Formdanbilabs Advanced Members for ACF
- CVE-2026-116545All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Fieldplugins360 All-in-One Video Gallery – Video Player & Galler…
- CVE-2026-119211AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hookprogressplanner AAA Autoload Optimizer
- CVE-2026-116551WP Customer Area <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameteraguilatechnologies WP Customer Area
- CVE-2026-104010WPSyncSheets For Contact Form 7 <= 1.8.0 - Unauthenticated PHP Object Injection to Remote Code Execution via Untrusted CF7 Submission…creativewerkdesigns WPSyncSheets For Contact Form 7 – CF7 G…
- CVE-2026-107622BuddyForms <= 2.10.5 - Unauthenticated Privilege Escalation to Form-Type Confusion via 'bf_post_type' Parameterthemekraft BuddyForms
- CVE-2026-114630ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.8 - Unauthenticated Arbitrary File Deletion via 'ticket_attachment_path'…elextensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2026-89101Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP…wpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2026-103479Pubjet | پابجت <= 5.4.8 - Authenticated (Subscriber+) Privilege Escalation to 'check-token' AJAX ActionPubjet | پابجت
- CVE-2026-84161Authenticated remote denial of service through unbounded zlib decompression in storeAnalysisStatisticsEricsson CodeChecker
- CVE-2026-84164Stored XSS in the static HTML report export, because json.dumps does not escape the markup characterEricsson CodeChecker
- CVE-2026-115701Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustionninenines cowboy · cowboy