CVEs
Browse the synced catalog, newest first.
- CVE-2026-124426Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Fieldcraftcms cms
- CVE-2026-124425Parse Server 9.10.6-alpha.1 before 9.10.7-alpha.2 Information Disclosure via Save Responseparse-community parse-server
- CVE-2026-124424WWBN AVideo Path Traversal Arbitrary VTT File Write via receiveAsync.json.phpWWBN AVideo
- CVE-2026-124330FlowCI flow-core-x LocalFileManager LocalFileManager.java remove path traversalFlowCI flow-core-x
- CVE-2026-124329FlowCI flow-core-x FileHelper.java FileHelper.unzip path traversalFlowCI flow-core-x
- CVE-2026-124328FlowCI flow-core-x Groovy Script Evaluation ConditionManagerImpl.java ConditionManagerImpl.run code injectionFlowCI flow-core-x
- CVE-2026-124326DataLinkDC Dinky Catalogue Upload CatalogueController.java file.getOriginalFilename path traversalDataLinkDC Dinky
- CVE-2026-110963Userplace <= 1.2.0 - Unauthenticated Privilege EscalationUserplace
- CVE-2026-110132Sync Post With Other Site 1.9.3 - Contributor+ Arbitrary Custom Post Type Creation and ModificationSync Post With Other Site
- CVE-2026-109925Productive Commerce < 1.1.54 - Unauthenticated SQLi via Wishlist and Compare HandlersProductive Commerce
- CVE-2026-106015Ecommerce Affiliate <= 1.0.0 - Unauthenticated Account Takeover via Email OTP Brute ForceEcommerce Affiliate
- CVE-2026-105970BCK Auto-confirm Bank Transfer <= 2.0.1 - Unauthenticated WooCommerce Order Payment ConfirmationThanh Toán Quét Mã QR Code Tự Động
- CVE-2026-104639Razorpay for WooCommerce < 4.8.9 - Admin+ SQLi via WebhookRazorpay for WooCommerce
- CVE-2026-104338Razorpay for WooCommerce < 4.8.9 - Unauthenticated User Context Switch via 1cc Coupon RouteRazorpay for WooCommerce
- CVE-2026-104337Razorpay for WooCommerce < 4.8.9 - Unauthenticated Order Data Disclosure via 1CC Coupon ApplyRazorpay for WooCommerce
- CVE-2026-104307BackUpWordPress < 3.15 - Subscriber+ Backup Directory File Deletion via hmbkp_dismiss_errorBackUpWordPress
- CVE-2026-103303Turisbook Booking System <= 1.3.8 - Unauthenticated Stored XSS via Cart Background SettingTurisbook Booking System
- CVE-2026-114432Contact Form 7 6.2 - 6.2.3 - Unauthenticated Arbitrary File Upload via Invalid UTF-8 FilenameContact Form
- CVE-2026-96963Pie Register <= 3.8.4.15 - Contributor+ Invitation Code ModificationPie Register
- CVE-2026-96961Pie Register <= 3.8.4.15 - Unauthenticated Plugin Settings Reset and Redirect Data DestructionPie Register
- CVE-2026-103375Antom Payments <= 2.0.11 - Unauthenticated WooCommerce Order Data DisclosureAntom Payments
- CVE-2026-97195Secure Custom Fields < 6.9.8 - Admin+ Stored XSS via HTML Attribute Name Injection into Field DefinitionSecure Custom Fields
- CVE-2026-97194Secure Custom Fields < 6.9.8 - Contributor+ Unpublished Post Title and Status Disclosure via Relational FieldsSecure Custom Fields
- CVE-2026-97193Secure Custom Fields < 6.9.8 - Contributor+ Relationship Field Update on Arbitrary Objects via IDORSecure Custom Fields
- CVE-2026-97192Secure Custom Fields < 6.9.8 - Contributor+ Admin-Restricted Custom Field Update via Post Save PathSecure Custom Fields
- CVE-2026-85344FV Player < 7.5.57.7212 - Subscriber+ Bulk Post Modification via Missing AuthorizationFV Flowplayer Video Player
- CVE-2026-122085Event Tickets Manager for WooCommerce < 1.6.0 - Unauthenticated Ticket Transfer and Attendee PII DisclosureEvent Tickets Manager for WooCommerce
- CVE-2026-122062Pronamic Pay & Pronamic Pay doneren met Mollie - Unauthenticated Form Submission Disclosure via REST APIPronamic Pay
- CVE-2026-122060WP Recipe Maker < 10.9.2 - Unauthenticated Password-Protected Recipe DisclosureWP Recipe Maker
- CVE-2026-114713The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies…UnrealIRCd