CVEs
Browse the synced catalog, newest first.
- CVE-2026-76981Authenticated Second-Order SQL InjectionZohocorp ADAudit Plus
- CVE-2026-105948In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own…Octopus Deploy Octopus Server
- CVE-2026-111190ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME HeaderARforms
- CVE-2026-12427ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' ParameterARforms
- CVE-2026-12424ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer HeaderARforms
- CVE-2026-15785Joinchat <= 6.3.1 - Reflected Cross-Site Scripting via '{HREF}' Dynamic Variablecreapuntome Joinchat – Enhanced “click to chat”
- CVE-2026-93487In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project…Octopus Deploy Octopus Server
- CVE-2026-96414In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of…Octopus Deploy Octopus Server
- CVE-2026-88813YITH WooCommerce Gift Cards <= 4.39.0 - Unauthenticated Gift Card Balance Inflation via Discounted PurchaseYITH WooCommerce Gift Cards
- CVE-2026-123705Security For WooCommerce <= 1.0.16 - Unauthenticated Server Configuration Information DisclosureSecurity For WooCommerce
- CVE-2026-123704Security For WooCommerce <= 1.0.16 - Unauthenticated Administrator Email Address DisclosureSecurity For WooCommerce
- CVE-2026-123703Security For WooCommerce <= 1.0.16 - Unauthenticated Arbitrary User Logout via usfw_user_force_logoutSecurity For WooCommerce
- CVE-2026-123702Security For WooCommerce <= 1.0.16 - Unauthenticated wp-config Keys and Salts Reset and Denial of ServiceSecurity For WooCommerce
- CVE-2026-123701Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings ResetSecurity For WooCommerce
- CVE-2026-123700Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment DeletionSecurity For WooCommerce
- CVE-2026-123699Security For WooCommerce <= 1.0.16 - Unauthenticated Forced Plugin, Theme and Core UpdatesSecurity For WooCommerce
- CVE-2026-123698Security For WooCommerce <= 1.0.16 - Unauthenticated Plugin Settings Disclosure via REST APISecurity For WooCommerce
- CVE-2026-123697Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret DisclosureSecurity For WooCommerce
- CVE-2026-123696Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication ResetSecurity For WooCommerce
- CVE-2026-123695Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token DisclosureSecurity For WooCommerce
- CVE-2026-123667Photo Engine < 6.6.2 - Author+ Stored XSS via Keyword NamesPhoto Engine
- CVE-2026-123666Photo Engine < 6.6.2 - Author+ Media Deletion via Collection DeletionPhoto Engine
- CVE-2026-123661ProfilePress 4.16.13 - 4.17.3 - Subscriber+ Inactive Membership Plan Subscription via Plan-Change CheckoutProfilePress
- CVE-2026-123657ProfilePress < 4.17.6 - Unauthenticated Inactive Membership Plan Enrollment via Negative Plan IDProfilePress
- CVE-2026-123656ProfilePress < 4.17.6 - Unauthenticated Restricted Content Disclosure via REST APIProfilePress
- CVE-2026-123134Smoove Abandoned Cart Trigger for WooCommerce 4.0.0 - 4.3.5 - Unauthenticated Stored XSSSmoove abandoned cart trigger for WooCommerce
- CVE-2026-122087Event Tickets < 5.30.3.1 - Unauthenticated Private Event Attendee Disclosure via post_status Filter Bypass in Attendees REST APIEvent Tickets and Registration
- CVE-2026-122061Event Tickets < 5.30.3.1 - Unauthenticated Attendee Name Disclosure via Single Attendee REST EndpointEvent Tickets and Registration
- CVE-2026-121998iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDORiChart
- CVE-2026-121873Redirection for Contact Form 7 2.6.0 - 3.2.15 - Unauthenticated Forged Personal Data Request CreationRedirection for Contact Form