CVEs published February 20, 2026
376 CVEs were published on February 20, 2026: 50 critical, 208 high.
- Published
- 376
- Critical
- 50
- High
- 208
- Medium
- 112
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 65
Most affected products
- Owl opds
- 10
- librenms · librenms/librenms
- 7
- D-Link DWR-M960
- 5
- GIMP
- 5
- sa2blv SVXportal
- 5
- GetSimpleCMS-CE
- 4
- GFI Archiver
- 4
- Jinan USR IOT Technology Limited (PUSR) USR-W610
- 4
- sveltejs svelte · svelte
- 4
- yeqifu warehouse
- 4
Critical 50
- CVE-2019-25441thesystem 1.0 Command Injection via run_command endpointkostasmitroglou thesystem
- CVE-2026-2635MLflow Use of Default Password Authentication Bypass VulnerabilityMLflow
- CVE-2026-27112Kargo has an Authorization Bypass Vulnerability in Batch Resource Creation API Endpointsakuity kargo · github.com/akuity/kargo
- CVE-2026-25896fast-xml-parser has an entity encoding bypass via regex injection in DOCTYPE entity namesNaturalIntelligence fast-xml-parser · fast-xml-parser
- CVE-2026-2333Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opdsOwl opds
- CVE-2026-25715Jinan USR IOT Technology Limited (PUSR) USR-W610 Weak Password RequirementsJinan USR IOT Technology Limited (PUSR) USR-W610
- CVE-2026-24956WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerabilityShahjada Download Manager Addons for Elementor
- CVE-2026-22384WordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerabilityleafcolor Applay - Shortcodes
- CVE-2025-69405WordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerabilityThemeREX Lorem Ipsum | Books & Media Store
- CVE-2025-69404WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerabilityThemeREX Extreme Store
- CVE-2025-69403WordPress Bravis Addons plugin <= 1.3.0 - Arbitrary File Upload vulnerabilityBravis-Themes Bravis Addons
- CVE-2025-69382WordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerabilityThemesflat Elementor
- CVE-2025-69372WordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerabilityAncoraThemes SevenHills
- CVE-2025-69371WordPress KindlyCare theme <= 1.6.1 - PHP Object Injection vulnerabilityAncoraThemes KindlyCare
- CVE-2025-69370WordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerabilityThemeGoods Capella
- CVE-2025-69366WordPress Emerce Core plugin <= 1.8 - SQL Injection vulnerabilityTeconceTheme Emerce Core
- CVE-2025-69365WordPress Uroan Core plugin <= 1.4.4 - SQL Injection vulnerabilityTeconceTheme Uroan Core
- CVE-2025-69337WordPress Wolmart Core plugin <= 1.9.6 - SQL Injection vulnerabilitydon-themes Wolmart Core
- CVE-2025-69329WordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerabilityJthemes Prestige
- CVE-2025-69310WordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerabilityTeconceTheme Woodly Core
- CVE-2025-69309WordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerabilityTeconceTheme Saasplate Core
- CVE-2025-69308WordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerabilityTeconceTheme Nestbyte Core
- CVE-2025-69307WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerabilityTeconceTheme Medinik Core
- CVE-2025-69306WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerabilityTeconceTheme Electio Core
- CVE-2025-69305WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerabilityTeconceTheme Crete Core
- CVE-2025-69304WordPress Allmart plugin <= 1.1 - SQL Injection vulnerabilityTeconceTheme Allmart
- CVE-2025-69301WordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerabilityThemeGoods PhotoMe
- CVE-2025-69295WordPress Coven Core plugin <= 1.3 - SQL Injection vulnerabilityTeconceTheme Coven Core
- CVE-2025-68549WordPress Wiguard theme < 2.0.1 - Arbitrary File Upload vulnerabilityzozothemes Wiguard
- CVE-2025-68541WordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerabilityBoldThemes Ippsum
- CVE-2025-67997WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerabilityBoldThemes Travelicious
- CVE-2025-67996WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerabilityBoldThemes Nestin
- CVE-2025-67995WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerabilityLoftOcean PatioTime
- CVE-2025-67979WordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerabilityWesternDeal WPForms Google Sheet Connector
- CVE-2026-21627Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomlatassos.gr Novarain/Tassos Framework · tassos.gr Convert… +4
- CVE-2025-10970SQLi in Kolay Software's TalenticsKolay Software Talentics
- CVE-2026-26065calibre: Path Traversal can Lead to Arbitrary File Write and Potential Code Executionkovidgoyal calibre
- CVE-2026-26064calibre: Path Traversal Vulnerability Enables Arbitrary File Write and Remote Code Executionkovidgoyal calibre
- CVE-2026-26988LibreNMS: SQL Injection in ajax_table.php spreads through a covert data streamlibrenms · librenms/librenms
- CVE-2026-26980Ghost has a SQL Injection in its Content APITryGhost Ghost · ghost
- CVE-2025-30416Sensitive data disclosure and manipulation due to missing authorization.Acronis Cyber Protect
- CVE-2025-30410Sensitive data disclosure and manipulation due to missing authentication.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2025-30412Sensitive data disclosure and manipulation due to improper authentication.Acronis Cyber Protect
- CVE-2025-30411Sensitive data disclosure and manipulation due to improper authentication.Acronis Cyber Protect
- CVE-2021-35402PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip PROLiNK PRC2402M
- CVE-2025-70831A Remote Code Execution (RCE) vulnerability was found in Smanga 3.2.7 in the /php/path/rescan.php interface.
- CVE-2025-70833An Authentication Bypass vulnerability in Smanga 3.2.7 allows an unauthenticated attacker to reset the password of any user (including the a
- CVE-2026-26722An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN compon
- CVE-2026-26725An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the A
- CVE-2026-26747A Host Header Poisoning vulnerability exists in Monica 4.1.2 due to improper handling of the HTTP Host header in app/Providers/AppServicePro
High 208
- CVE-2026-27170OpenSift: SSRF risk in URL ingestion endpointOpenSift
- CVE-2026-27169OpenSift: Persistent XSS Chat Tool RenderingOpenSift
- CVE-2026-27168SAIL: Heap-based Buffer Overflow in Sail-codecs-xwdHappySeaFox sail
- CVE-2026-27203eBay API MCP Server Affected by Environment Variable InjectionYosefHayim ebay-mcp · ebay-mcp
- CVE-2026-27202GetSimple CMS: Uploaded Files (feature) Arbitrary File Read VulnerabilityGetSimpleCMS-CE
- CVE-2026-27161Unauthenticated Information Disclosure via .htaccess Reliance in Sensitive DirectoriesGetSimpleCMS-CE
- CVE-2026-27146GetSimple CMS: Cross-Site Request Forgery (CSRF) in File Upload Allows Arbitrary UploadsGetSimpleCMS-CE
- CVE-2026-27134Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autenticationstrimzi-kafka-operator
- CVE-2019-25438LabCollector 5.423 SQL Injection via login.phpLabCollector
- CVE-2019-25435Sricam DeviceViewer 3.12.0.1 Local Buffer Overflow DEP BypassSricam DeviceViewer
- CVE-2019-25432Part-DB 0.4 Authentication Bypass via login.phpPart-DB
- CVE-2019-25431delpino73 Blue-Smiley-Organizer 1.32 SQL Injection via datetimedelpino73 Blue-Smiley-Organizer
- CVE-2018-25158Chamilo LMS 1.11.8 Arbitrary File Upload via elfinderChamilo Chamillo LMS
- CVE-2026-2048GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityGIMP
- CVE-2026-2047GIMP ICNS File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-2045GIMP XWD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityGIMP
- CVE-2026-2044GIMP PGM File Parsing Uninitialized Memory Remote Code Execution VulnerabilityGIMP
- CVE-2026-2492TensorFlow HDF5 Library Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityTensorFlow
- CVE-2026-2041Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution VulnerabilityNagios Host
- CVE-2026-2043Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution VulnerabilityNagios Host
- CVE-2026-2042Nagios Host monitoringwizard Command Injection Remote Code Execution VulnerabilityNagios Host
- CVE-2026-2040PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation VulnerabilityPDF-XChange Editor
- CVE-2026-2039GFI Archiver MArc.Store Missing Authorization Authentication Bypass VulnerabilityGFI Archiver
- CVE-2026-2036GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution VulnerabilityGFI Archiver
- CVE-2026-2038GFI Archiver MArc.Core Missing Authorization Authentication Bypass VulnerabilityGFI Archiver
- CVE-2026-2037GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution VulnerabilityGFI Archiver
- CVE-2026-2034Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution VulnerabilitySante DICOM Viewer Pro
- CVE-2026-2033MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution VulnerabilityMLflow
- CVE-2026-0777Xmind Attachment Insufficient UI Warning Remote Code Execution VulnerabilityXmind
- CVE-2026-0797GIMP ICO File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityGIMP
- CVE-2026-2857D-Link DWR-M960 Port Forwarding Configuration Endpoint formPortFw sub_423E00 stack-based overflowD-Link DWR-M960
- CVE-2026-24892openITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog HandlingopenITCOCKPIT
- CVE-2026-27190Deno has a Command Injection via Incomplete shell metacharacter blocklist in node:child_processdenoland deno · deno
- CVE-2026-2856D-Link DWR-M960 Filter Configuration Endpoint formFilter sub_424AFC stack-based overflowD-Link DWR-M960
- CVE-2026-2855D-Link DWR-M960 DDNS Settings formDdns sub_4648F0 stack-based overflowD-Link DWR-M960
- CVE-2026-2473Bucket Squatting in Vertex AI Experiments leads to RCE and Model Theft.Google Cloud Vertex AI Experiments · google-cloud-aiplatform
- CVE-2026-2472Stored Cross-Site Scripting (XSS) in Vertex AI Python SDK VisualizationGoogle Cloud Vertex AI SDK for Python · google-cloud-aiplat…
- CVE-2026-2854D-Link DWR-M960 NTP Configuration Endpoint formNtp sub_4611CC stack-based overflowD-Link DWR-M960
- CVE-2026-2853D-Link DWR-M960 System Log Configuration Endpoint formSysLog sub_462E14 stack-based overflowD-Link DWR-M960
- CVE-2019-25444Fiverr Clone Script 1.2.2 SQL Injection via page ParameterPhpscriptsmall Fiverr Clone Script
- CVE-2026-24891openITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object InjectionopenITCOCKPIT
- CVE-2026-27115ADB Explorer is Vulnerable to Arbitrary Directory Deletion via Command-Line ArgumentAlex4SSB ADB-Explorer
- CVE-2026-26102Incorrect Permission Assignment for Critical Resource in Owl opdsOwl opds
- CVE-2026-26101Incorrect Permission Assignment for Critical Resource in Owl opdsOwl opds
- CVE-2026-26099Uncontrolled Search Path Element in Owl opdsOwl opds
- CVE-2026-26098Uncontrolled Search Path Element in Owl opdsOwl opds
- CVE-2026-26097Uncontrolled Search Path Element in Owl opdsOwl opds
- CVE-2026-26096Incorrect Permission Assignment for Critical Resource in Owl opdsOwl opds
- CVE-2026-26095Incorrect Permission Assignment for Critical Resource in Owl opdsOwl opds
- CVE-2026-26093Improper Neutralization of Special Elements used in a Command ('Command Injection') in Owl opdsOwl opds
- CVE-2026-24790Welker OdorEyes EcoSystem Pulse Bypass System with XL4 Controller Missing Authentication for Critical FunctionWelker OdorEyes EcoSystem Pulse Bypass System with XL4 Cont…
- CVE-2026-26048Jinan USR IOT Technology Limited (PUSR) USR-W610 Missing Authentication for Critical FunctionJinan USR IOT Technology Limited (PUSR) USR-W610
- CVE-2026-2818Zip Slip Path Traversal in Snapshot Archive Extraction (Windows-Specific)VMware Spring Data Geode · VMware Spring Data Gemfire
- CVE-2026-24455Jinan USR IOT Technology Limited (PUSR) USR-W610 Cleartext Transmission of Sensitive InformationJinan USR IOT Technology Limited (PUSR) USR-W610
- CVE-2026-27072WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.2.0.1 - Cross Site Scripting (XSS) vulnerabilityPixelYourSite – Your smart PIXEL (TAG) Manager
- CVE-2026-24959WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerabilityJoomSky JS Help Desk
- CVE-2026-24955WordPress Whizz Plugins plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityfox-themes Whizz Plugins
- CVE-2026-24950WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerabilitythemeplugs Authorsy
- CVE-2026-24949WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerabilityThemeGoods PhotoMe
- CVE-2026-24948WordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityfox-themes Reflector
- CVE-2026-24943WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerabilityThemeGoods Grand Conference
- CVE-2026-24941WordPress WP Job Portal plugin <= 2.4.4 - Broken Access Control vulnerabilitywpjobportal WP Job Portal
- CVE-2026-22383WordPress PawFriends - Pet Shop and Veterinary WordPress theme theme <= 1.3 - Insecure Direct Object References (IDOR) vulnerabilityMikado-Themes PawFriends - Pet Shop and Veterinary WordPres…
- CVE-2026-22381WordPress PawFriends - Pet Shop and Veterinary WordPress Theme theme <= 1.3 - Local File Inclusion vulnerabilityMikado-Themes PawFriends - Pet Shop and Veterinary WordPres…
- CVE-2026-22380WordPress UnlimHost theme <= 1.2.3 - Local File Inclusion vulnerabilityAncoraThemes UnlimHost
- CVE-2026-22379WordPress Netmix theme <= 1.0.10 - Local File Inclusion vulnerabilityAncoraThemes Netmix
- CVE-2026-22378WordPress Blabber theme <= 1.7.0 - Local File Inclusion vulnerabilityAncoraThemes Blabber
- CVE-2026-22377WordPress Saveo theme <= 1.1.2 - Local File Inclusion vulnerabilityAncoraThemes Saveo
- CVE-2026-22376WordPress Parkivia theme <= 1.1.9 - Local File Inclusion vulnerabilityAncoraThemes Parkivia
- CVE-2026-22375WordPress Impacto Patronus theme <= 1.2.3 - Local File Inclusion vulnerabilityAncoraThemes Impacto Patronus
- CVE-2026-22374WordPress Zio Alberto theme <= 1.2.2 - Local File Inclusion vulnerabilityAncoraThemes Zio Alberto
- CVE-2026-22373WordPress Fooddy theme <= 1.3.10 - Local File Inclusion vulnerabilityAncoraThemes Fooddy
- CVE-2026-22372WordPress Isida theme <= 1.4.2 - Local File Inclusion vulnerabilityAncoraThemes Isida
- CVE-2026-22371WordPress Gustavo theme <= 1.2.2 - Local File Inclusion vulnerabilityAncoraThemes Gustavo
- CVE-2026-22370WordPress Marveland theme <= 1.3.0 - Local File Inclusion vulnerabilityaxiomthemes Marveland
- CVE-2026-22369WordPress Ironfit theme <= 1.5 - Local File Inclusion vulnerabilityAncoraThemes Ironfit
- CVE-2026-22368WordPress Redy theme <= 1.0.2 - Local File Inclusion vulnerabilityaxiomthemes Redy
- CVE-2026-22367WordPress Coworking theme <= 1.6.1 - Local File Inclusion vulnerabilityAncoraThemes Coworking
- CVE-2026-22366WordPress Jude theme <= 1.3.0 - Local File Inclusion vulnerabilityaxiomthemes Jude
- CVE-2026-22365WordPress Soleng theme <= 1.0.5 - Local File Inclusion vulnerabilityaxiomthemes Soleng
- CVE-2026-22364WordPress SevenTrees theme <=1.0.2 - Local File Inclusion vulnerabilityaxiomthemes SevenTrees
- CVE-2026-22363WordPress Rhodos theme <= 1.3.3 - Local File Inclusion vulnerabilityaxiomthemes Rhodos
- CVE-2026-22362WordPress Photolia theme <= 1.0.3 - Local File Inclusion vulnerabilityaxiomthemes Photolia
- CVE-2026-22361WordPress A-Mart theme <= 1.0.2 - Local File Inclusion vulnerabilityaxiomthemes A-Mart
- CVE-2026-22357WordPress Link Whisper Free plugin <= 0.9.2 - Cross Site Scripting (XSS) vulnerabilitySpencer Haws Link Whisper Free
- CVE-2026-22356WordPress Jetpack CRM plugin <= 6.7.0 - Local File Inclusion vulnerabilityAutomattic Jetpack CRM
- CVE-2026-22354WordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerabilityDotstore Woocommerce Category Banner Management
- CVE-2026-22352WordPress Persian Woocommerce SMS plugin <= 7.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityPersianScript Persian Woocommerce SMS
- CVE-2026-22351WordPress WP FullCalendar plugin <= 1.6 - Broken Access Control vulnerabilityMarcus (aka @msykes) WP FullCalendar
- CVE-2026-22346WordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerabilityA WP Life Slider Responsive Slideshow – Image slider, Galle…
- CVE-2026-22345WordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerabilityA WP Life Image Gallery – Lightbox Gallery, Responsive Phot…
- CVE-2026-22344WordPress FiveStar theme <= 1.7 - Local File Inclusion vulnerabilityMikado-Themes FiveStar
- CVE-2025-69410WordPress Belletrist theme <= 1.2 - Local File Inclusion vulnerabilityEdge-Themes Belletrist
- CVE-2025-69409WordPress PJ | Life & Business Coaching theme <= 3.0.0 - Local File Inclusion vulnerabilityaxiomthemes PJ | Life & Business Coaching
- CVE-2025-69408WordPress HealthFirst theme <= 1.0.1 - Local File Inclusion vulnerabilityMikado-Themes HealthFirst
- CVE-2025-69407WordPress Struktur theme <= 2.5.1 - Local File Inclusion vulnerabilitySelect-Themes Struktur
- CVE-2025-69406WordPress FreightCo theme <= 1.1.7 - Local File Inclusion vulnerabilityThemeREX FreightCo
- CVE-2025-69402WordPress R&F theme <= 1.5 - Local File Inclusion vulnerabilityThemeREX R&F
- CVE-2025-69401WordPress WooODT Lite plugin <= 2.5.2 - Payment Bypass Vulnerability vulnerabilitymdalabar WooODT Lite
- CVE-2025-69400WordPress Yokoo theme <= 1.1.11 - Local File Inclusion vulnerabilityThemeREX Yokoo
- CVE-2025-69399WordPress Cobble theme <= 1.7 - Local File Inclusion vulnerabilityThemeREX Cobble
- CVE-2025-69398WordPress Plank theme <= 1.7 - Local File Inclusion vulnerabilityThemeREX Plank
- CVE-2025-69397WordPress Tint theme <= 1.7 - Local File Inclusion vulnerabilityThemeREX Tint
- CVE-2025-69396WordPress Splendour theme <= 1.23 - Local File Inclusion vulnerabilityThemeREX Splendour
- CVE-2025-69395WordPress Gable theme <= 1.5 - Local File Inclusion vulnerabilityThemeREX Gable
- CVE-2025-69394WordPress Cnvrse plugin < 026.02.10.20 - Insecure Direct Object References (IDOR) vulnerabilityCnvrse
- CVE-2025-69393WordPress Exzo theme <= 1.2.4 - Broken Access Control vulnerabilityJthemes Exzo
- CVE-2025-69392WordPress iMoney plugin <= 0.36 - Reflected Cross Site Scripting (XSS) vulnerabilityitex iMoney
- CVE-2025-69391WordPress Diamond theme <= 2.4.8 - Reflected Cross Site Scripting (XSS) vulnerabilityGT3themes Diamond
- CVE-2025-69390WordPress Business Template Blocks for WPBakery (Visual Composer) Page Builder plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitythemebon Business Template Blocks for WPBakery (Visual Comp…
- CVE-2025-69389WordPress Visitor Maps Extended Referer Field plugin <= 1.2.6 - Reflected Cross Site Scripting (XSS) vulnerabilityHugh Mungus Visitor Maps Extended Referer Field
- CVE-2025-69387WordPress Simple Retail Menus plugin <= 4.2.1 - Local File Inclusion vulnerabilitywhatwouldjessedo Simple Retail Menus
- CVE-2025-69386WordPress RVCFDI para Woocommerce plugin <= 8.1.8 - Reflected Cross Site Scripting (XSS) vulnerabilityrealvirtualmx RVCFDI para Woocommerce
- CVE-2025-69384WordPress Timeline Event History plugin <= 3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitywpdiscover Timeline Event History
- CVE-2025-69383WordPress WP shop plugin <= 2.6.1 - Local File Inclusion vulnerabilityAgence web Eoxia - Montpellier WP shop
- CVE-2025-69381WordPress WooCommerce Bulk Product Editor plugin <= 3.0 - Broken Access Control vulnerabilityvanquish WooCommerce Bulk Product Editor
- CVE-2025-69380WordPress Upload Files Anywhere plugin <= 2.8 - Arbitrary File Download vulnerabilityvanquish Upload Files Anywhere
- CVE-2025-69379WordPress Upload Files Anywhere plugin <= 2.8 - Arbitrary File Deletion vulnerabilityvanquish Upload Files Anywhere
- CVE-2025-69378WordPress Product Filter for WooCommerce plugin <= 9.1.2 - Privilege Escalation vulnerabilityXforWooCommerce Product Filter for WooCommerce
- CVE-2025-69377WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerabilityvanquish User Extra Fields
- CVE-2025-69376WordPress User Extra Fields plugin <= 17.0 - Arbitrary File Deletion vulnerabilityvanquish User Extra Fields
- CVE-2025-69375WordPress Portfolio Builder plugin <= 1.2.5 - Local File Inclusion vulnerabilitySolverWp Portfolio Builder
- CVE-2025-69374WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 2.0.3 - Local File Inclusion vulnerabilitySolverWp Eleblog – Elementor Blog And Magazine Addons
- CVE-2025-69373WordPress VidoRev theme <= 2.9.9.9.9.9.7 - Local File Inclusion vulnerabilitybeeteam368 VidoRev
- CVE-2025-69368WordPress SOHO - Photography WordPress Theme theme <= 3.0.3 - Cross Site Scripting (XSS) vulnerabilityGT3themes SOHO - Photography WordPress Theme
- CVE-2025-69367WordPress Oyster - Photography WordPress Theme theme <= 4.4.3 - Cross Site Scripting (XSS) vulnerabilityGT3themes Oyster - Photography WordPress Theme
- CVE-2025-69330WordPress Prestige theme < 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityJthemes Prestige
- CVE-2025-69328WordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerabilitymagepeopleteam Booking and Rental Manager
- CVE-2025-69326WordPress NEX-Forms plugin <= 9.1.7 - Reflected Cross Site Scripting (XSS) vulnerabilityBasix NEX-Forms
- CVE-2025-69324WordPress NEX-Forms plugin <= 9.1.7 - Cross Site Scripting (XSS) vulnerabilityBasix NEX-Forms
- CVE-2025-69323WordPress Slimstat Analytics plugin <= 5.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityVeronaLabs Slimstat Analytics
- CVE-2025-69322WordPress PeakShops theme < 1.5.9 - Local File Inclusion vulnerabilityfuelthemes PeakShops
- CVE-2025-69303WordPress ModelTheme Framework plugin < 2.0.0 - Broken Access Control vulnerabilityModelTheme Framework
- CVE-2025-69302WordPress DesignThemes Core Features plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerabilityDesignThemes Core Features
- CVE-2025-69299WordPress Oxygen theme <= 6.0.8 - Server Side Request Forgery (SSRF) vulnerabilityLaborator Oxygen
- CVE-2025-69298WordPress Gauge theme <= 6.56.4 - Broken Access Control vulnerabilityGhostPool Gauge
- CVE-2025-69297WordPress Aardvark Plugin plugin <= 2.19 - Broken Access Control vulnerabilityGhostPool Aardvark Plugin
- CVE-2025-69296WordPress Aardvark theme <= 4.6.3 - Reflected Cross Site Scripting (XSS) vulnerabilityGhostPool Aardvark
- CVE-2025-69294WordPress PeakShops theme <= 1.5.9 - PHP Object Injection vulnerabilityfuelthemes PeakShops
- CVE-2025-69063WordPress New User Approve plugin <= 3.2.0 - Broken Access Control vulnerabilitySaad Iqbal New User Approve
- CVE-2025-68880WordPress Simple Archive Generator plugin <= 5.2 - Reflected Cross Site Scripting (XSS) vulnerabilitypeterwsterling Simple Archive Generator
- CVE-2025-68863WordPress iContact for Gravity Forms plugin <= 1.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilityZack Katz iContact for Gravity Forms
- CVE-2025-68862WordPress Woo File Dropzone plugin <= 1.1.7 - Arbitrary File Deletion vulnerabilityMurtaza Bhurgri Woo File Dropzone
- CVE-2025-68856WordPress Mopinion Feedback Form plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitykeeswolters Mopinion Feedback Form
- CVE-2025-68854WordPress ID Arrays plugin <= 2.1.2 - POST-Based Reflected Cross Site Scripting (XSS) vulnerabilityharman79 ID Arrays
- CVE-2025-68853WordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerabilityKleor Contact Manager
- CVE-2025-68852WordPress Court Reservation plugin <= 1.10.13 - Cross Site Scripting (XSS) vulnerabilitywebmuehle Court Reservation
- CVE-2025-68848WordPress amr cron manager plugin <= 2.3 - Reflecte dCross Site Scripting (XSS) vulnerabilityanmari amr cron manager
- CVE-2025-68847WordPress iSape plugin <= 0.72 - Reflected Cross Site Scripting (XSS) vulnerabilityitex iSape
- CVE-2025-68846WordPress Asynchronous Javascript plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerabilityParis Holley Asynchronous Javascript
- CVE-2025-68845WordPress eDS Responsive Menu plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityaThemeArt Translations eDS Responsive Menu
- CVE-2025-68844WordPress Membee Login plugin <= 2.3.6 - Cross Site Scripting (XSS) vulnerabilityDaleAB Membee Login
- CVE-2025-68843WordPress FeedWordPress Advanced Filters plugin <= 0.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityBas Schuiling FeedWordPress Advanced Filters
- CVE-2025-68842WordPress Widget Logic Visual plugin <= 1.52 - Reflected Cross Site Scripting (XSS) vulnerabilitytotalbounty Widget Logic Visual
- CVE-2025-68841WordPress TopperPack – Complete Elementor Addons, theme & CPT Builder plugin <= 1.2.1 - Local File Inclusion vulnerabilityThemepul TopperPack – Complete Elementor Addons, Theme & CP…
- CVE-2025-68834WordPress Sync Master Sheet – Product Sync with Google Sheet for WooCommerce plugin <= 1.1.3 - Broken Access Control vulnerabilitySaiful Islam Sync Master Sheet – Product Sync with Google S…
- CVE-2025-68552WordPress WooCommerce Coming Soon Product with Countdown plugin <= 5.0 - Local File Inclusion vulnerabilityWebCodingPlace WooCommerce Coming Soon Product with Countdo…
- CVE-2025-68545WordPress Nika theme <= 1.2.14 - Local File Inclusion vulnerabilitythembay Nika
- CVE-2025-68543WordPress Diza theme <= 1.3.15 - Local File Inclusion vulnerabilitythembay Diza
- CVE-2025-68539WordPress Fana theme <= 1.1.35 - Local File Inclusion vulnerabilitythembay Fana
- CVE-2025-68536WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerabilitythembay Zota
- CVE-2025-68531WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerabilityModelTheme Addons for WPBakery and Elementor
- CVE-2025-68526WordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerabilityA WP Life Modal Popup Box
- CVE-2025-68501WordPress Mollie Payments for WooCommerce plugin <= 8.1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMollie Payments for WooCommerce
- CVE-2025-68495WordPress JetEngine plugin <= 3.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityCrocoblock JetEngine
- CVE-2025-68069WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerabilitywpWax Directorist
- CVE-2025-68051WordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerabilityShiprocket
- CVE-2025-68048WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerabilityXLPlugins NextMove Lite
- CVE-2025-68043WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerabilityLottieFiles
- CVE-2025-68037WordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerabilityAtlas Gondal Export Media URLs
- CVE-2025-68031WordPress افزونه پیامک حرفه ای فراز اس ام اس plugin <= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilityfaraz sms افزونه پیامک حرفه ای فراز اس ام اس
- CVE-2025-68022WordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerabilitysoporteblue Plugin BlueX for WooCommerce
- CVE-2025-67998WordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerabilitykamleshyadav Miraculous Elementor
- CVE-2025-67994WordPress YayCurrency plugin <= 3.3 - Arbitrary Content Deletion vulnerabilityYayCommerce YayCurrency
- CVE-2025-67992WordPress PatioTime theme < 2.1 - Local File Inclusion vulnerabilityLoftOcean PatioTime
- CVE-2025-67991WordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerabilityvanquish User Extra Fields
- CVE-2025-67990WordPress GMap Targeting plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityRealMag777 GMap Targeting
- CVE-2025-67988WordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerabilityLoftOcean CozyStay
- CVE-2025-67987WordPress Quiz And Survey Master plugin <= 10.3.1 - SQL Injection vulnerabilityExpressTech Systems Quiz And Survey Master
- CVE-2025-67984WordPress NPS computy plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerabilitycalliko NPS computy
- CVE-2025-67982WordPress Urna theme <= 2.5.12 - Local File Inclusion vulnerabilitythembay Urna
- CVE-2025-67981WordPress Besa theme <= 2.3.15 - Local File Inclusion vulnerabilitythembay Besa
- CVE-2025-67980WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerabilitythembay Hara
- CVE-2025-67978WordPress Educare plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerabilityFixBD Educare
- CVE-2025-67977WordPress HAPPY plugin <= 1.0.8 - Broken Access Control vulnerabilityVillaTheme HAPPY
- CVE-2025-67974WordPress WPLegalPages plugin <= 3.5.4 - Broken Access Control vulnerabilityWP Legal Pages WPLegalPages
- CVE-2025-67971WordPress FluentCart plugin < 1.3.0 - Cross Site Scripting (XSS) vulnerabilityWPManageNinja FluentCart
- CVE-2025-60087WordPress Extensive VC Addons for WPBakery page builder plugin <= 1.9.1 - Local File Inclusion vulnerabilityNenad Obradovic Extensive VC Addons for WPBakery page build…
- CVE-2025-53237WordPress WP Wizard Cloak Plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilitySoflyy WP Wizard Cloak
- CVE-2025-53233WordPress Storyform plugin <= 0.6.14 - Cross Site Scripting (XSS) VulnerabilityRylanH Storyform
- CVE-2025-53231WordPress Easy Taxonomy Images plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerabilitywpdevstudio Easy Taxonomy Images
- CVE-2025-53228WordPress bbpress Simple Advert Units Plugin <= 0.41 - Cross Site Scripting (XSS) Vulnerabilityjezza101 bbpress Simple Advert Units
- CVE-2025-53217WordPress AIO WP Builder Plugin <= 2.0.2 - Broken Access Control Vulnerabilitystaviravn AIO WP Builder
- CVE-2025-52744WordPress Inpersttion For Theme plugin <= 1.0 - Arbitrary Code Execution vulnerabilityInpersttion For Theme
- CVE-2026-20761EnOcean SmartServer IoT Command InjectionEnOcean Edge SmartServer IoT
- CVE-2026-2847UTT HiPER 520 Web Management formReleaseConnect sub_44EFB4 os command injectionUTT HiPER
- CVE-2026-2846UTT HiPER 520 Web Management formPdbUpConfig sub_44D264 os command injectionUTT HiPER
- CVE-2026-26050The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead toRicoh Company ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール
- CVE-2026-26996minimatch has a ReDoS via repeated wildcards with non-matching literal in patternisaacs minimatch · minimatch
- CVE-2026-26990LibreNMS has Time-Based Blind SQL Injection in address-search.inc.phplibrenms · librenms/librenms
- CVE-2026-26960node-tar has Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in Extractionisaacs node-tar · tar
- CVE-2026-26975Music Assistant Server Path Traversal in Playlist Update API Allows Remote Code Executionmusic-assistant server
- CVE-2026-26974Sylde has Improper Control of Generation of CodeTygo-van-den-Hurk Slyde · @tygo-van-den-hurk/slyde
- CVE-2026-26967PJSIP has a Heap-based Buffer Overflow vulnerability in its H.264 unpacketizerpjsip pjproject
- CVE-2026-26721An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via t
- CVE-2026-26723Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v.
- CVE-2026-26724Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v.
- CVE-2026-26746OpenSourcePOS 3.4.1 contains a Local File Inclusion (LFI) vulnerability in the Sales.php::getInvoice() function.
Medium, low and unrated 118
- CVE-2026-27147GetSimple CMS: Stored Cross-Site Scripting (XSS) via SVG File Upload (Authenticated)GetSimpleCMS-CE
- CVE-2019-25454phpMoAdmin 1.1.5 Stored Cross-Site Scripting via collection ParameterphpMoAdmin
- CVE-2019-25453phpMoAdmin 1.1.5 Reflected Cross-Site Scripting via moadmin.phpphpMoAdmin
- CVE-2019-25451phpMoAdmin 1.1.5 Cross-Site Request Forgery via moadmin.phpphpMoAdmin
- CVE-2019-25449OrientDB 3.0.17 Reflected Cross-Site Scripting via document endpointOrientDB
- CVE-2019-25448OrientDB 3.0.17 Stored Cross-Site Scripting via User CreationOrientDB
- CVE-2019-25447OrientDB 3.0.17 Cross-Site Request ForgeryOrientDB
- CVE-2019-25437Foscam Video Management System 1.1.6.6 Buffer Overflow Denial of ServiceFoscam Video Management System
- CVE-2019-25436Sricam DeviceViewer 3.12.0.1 Password Change Security BypassSricam DeviceViewer
- CVE-2019-25434SpotAuditor 5.3.1.0 Denial of Service via Registration Name FieldNsasoft Nsauditor SpotAuditor
- CVE-2026-27133Strimzi All CAs from CA chain will be trusted in Kafka Connect and Kafka MirrorMaker 2 target clustersstrimzi-kafka-operator
- CVE-2026-27125Svelte SSR attribute spreading includes inherited properties from prototype chainsveltejs svelte · svelte
- CVE-2026-27122Svelte SSR does not validate dynamic element tag names in `<svelte:element>`sveltejs svelte · svelte
- CVE-2026-27121Svelte affected by cross-site scripting via spread attributes in Svelte SSRsveltejs svelte · svelte
- CVE-2026-27119Svelte affected by XSS in SSR `<option>` elementsveltejs svelte · svelte
- CVE-2026-2490RustDesk Client for Windows Transfer File Link Following Information Disclosure VulnerabilityRustDesk Client for Windows
- CVE-2026-2035Deciso OPNsense diag_backup.php filename Command Injection Remote Code Execution VulnerabilityDeciso OPNsense
- CVE-2026-27113Liquid Prompt arbitrary command injection via crafted Git branch names in gitstatusd backendliquidprompt
- CVE-2026-2858wren-lang wren Source File wren_compiler.c peekChar out-of-boundswren-lang wren
- CVE-2026-27120Leaf-kit html escaping does not work on characters that are part of extended grapheme clustervapor leaf-kit
- CVE-2026-27118Cache poisoning in @sveltejs/adapter-vercelsveltejs kit · @sveltejs/adapter-vercel
- CVE-2026-27111Kargo has Missing Authorization Vulnerabilities in Approval & Promotion REST API Endpointsakuity kargo · github.com/akuity/kargo
- CVE-2026-27026pypdf possibly has long runtimes for malformed FlateDecode streamspy-pdf pypdf · pypdf
- CVE-2026-27025pypdf has possible long runtimes/large memory usage for large /ToUnicode streamspy-pdf pypdf · pypdf
- CVE-2026-27024pypdf has a possible infinite loop when processing TreeObjectpy-pdf pypdf · pypdf
- CVE-2026-27022RediSearch Query Injection in @langchain/langgraph-checkpoint-redislangchain-ai langgraphjs · @langchain/langgraph-checkpoint-…
- CVE-2026-27020Photobooth has a XSS vulnerability in user inputlukas12000 photobooth
- CVE-2025-62326HCL Digital Experience is susceptible to stored cross-site scripting (XSS)HCLSoftware Digital Experience
- CVE-2026-2852yeqifu warehouse Sales Endpoint SalesController.java deleteSales access controlyeqifu warehouse
- CVE-2019-25445Fiverr Clone Script 1.2.2 Cross-Site Scripting via search-results.phpPhpscriptsmall Fiverr Clone Script
- CVE-2026-2832Certain Samsung MultiXpress Multifunction Printers Firmware – Potential Information DisclosureHP Samsung MultiXpress SL-X7600LXR, SL-X7500LXR, SL-X740… +2
- CVE-2026-2851yeqifu warehouse Inport Endpoint InportController.java deleteInport access controlyeqifu warehouse
- CVE-2026-2850yeqifu warehouse Customer Endpoint CustomerController.java deleteCustomer access controlyeqifu warehouse
- CVE-2026-26100Incorrect Permission Assignment for Critical Resource in Owl opdsOwl opds
- CVE-2026-27506SVXportal <= 2.5 Profile Update Stored XSSsa2blv SVXportal
- CVE-2026-27505SVXportal <= 2.5 admin/user_action.php Stored XSSsa2blv SVXportal
- CVE-2026-27504SVXportal <= 2.5 radiomobile_front.php stationid Reflected XSSsa2blv SVXportal
- CVE-2026-27503SVXportal <= 2.5 admin/log.php Search Reflected XSSsa2blv SVXportal
- CVE-2026-27502SVXportal <= 2.5 log.php Search Reflected XSSsa2blv SVXportal
- CVE-2025-15583detronetdip E-commerce function.php get_safe_value cross site scriptingdetronetdip E-commerce
- CVE-2025-15582detronetdip E-commerce Product Management Update authorizationdetronetdip E-commerce
- CVE-2026-1842HyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized AccessSoftIron HyperCloud
- CVE-2026-26049Jinan USR IOT Technology Limited (PUSR) USR-W610 Insufficiently Protected CredentialsJinan USR IOT Technology Limited (PUSR) USR-W610
- CVE-2026-2849yeqifu warehouse Cache Sync CacheController.java syncCache access controlyeqifu warehouse
- CVE-2026-2848SourceCodester Simple Responsive Tourism Website Registration Master.php sql injectionSourceCodester Simple Responsive Tourism Website
- CVE-2026-24953WordPress Simple File List plugin <= 6.1.15 - Arbitrary File Download vulnerabilityMitchell Bennis Simple File List
- CVE-2026-24946WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerabilitytychesoftwares Print Invoice & Delivery Notes for WooCommer…
- CVE-2026-24944WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerabilityweDevs Subscribe2
- CVE-2026-22350WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.3.1 - Broken Access Control vulnerabilityadd-ons.org PDF for Elementor Forms + Drag And Drop Templat…
- CVE-2026-22341WordPress Booked plugin <= 3.0.0 - Account Takeover vulnerabilityCase-Themes Booked
- CVE-2025-69388WordPress Cliengo – Chatbot plugin <= 3.0.4 - Broken Access Control vulnerabilityCliengo – Chatbot
- CVE-2025-69385WordPress Cartify - WooCommerce Gutenberg WordPress Theme theme <= 1.3 - Arbitrary Content Deletion vulnerabilityAgniHD Cartify - WooCommerce Gutenberg WordPress Theme
- CVE-2025-69325WordPress Primer MyData for Woocommerce plugin <= 4.2.8 - Path Traversal vulnerabilityprimersoftware Primer MyData for Woocommerce
- CVE-2025-69011WordPress Cool Tag Cloud plugin <= 2.29 - Cross Site Scripting (XSS) vulnerabilityWPKube Cool Tag Cloud
- CVE-2025-68895WordPress AhaChat Messenger Marketing plugin <= 1.1 - Broken Authentication vulnerabilityAhaChat Messenger Marketing
- CVE-2025-68855WordPress JobBoard Job listing plugin <= 1.2.8 - Sensitive Data Exposure vulnerabilitythemeglow JobBoard Job listing
- CVE-2025-68837WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.5 - Broken Access Control vulnerabilityELEXtensions ELEX WordPress HelpDesk & Customer Ticketing S…
- CVE-2025-68564WordPress Sendy plugin <= 3.4.2 - Broken Access Control vulnerabilitySendy
- CVE-2025-68542WordPress Checkout Gateway for IRIS plugin <= 1.3 - Broken Access Control vulnerabilityvgdevsolutions Checkout Gateway for IRIS
- CVE-2025-68534WordPress PDF for WPForms plugin <= 6.3.0 - Broken Access Control vulnerabilityadd-ons.org PDF for WPForms
- CVE-2025-68514WordPress Paid Member Subscriptions plugin <= 2.16.8 - Insecure Direct Object References (IDOR) vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2025-68050WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerabilityLeadpages
- CVE-2025-68042WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerabilityTravelpayouts
- CVE-2025-68032WordPress Advanced WC Analytics plugin <= 3.19.0 - Settings Change vulnerabilityPassionate Brains Advanced WC Analytics
- CVE-2025-68028WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerabilityPassionate Brains GA4WP: Google Analytics for WordPress
- CVE-2025-68026WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerabilityNiaj Morshed LC Wizard
- CVE-2025-68025WordPress Addonify Floating Cart For WooCommerce plugin <= 1.2.17 - Broken Access Control vulnerabilityAddonify Floating Cart For WooCommerce
- CVE-2025-68024WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerabilityAddonify – WooCommerce Wishlist
- CVE-2025-68023WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerabilityAddonify – Compare Products For WooCommerce
- CVE-2025-68021WordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerabilityConveyThis
- CVE-2025-68005WordPress Easy Hotel Booking plugin <= 1.9.2 - Broken Access Control vulnerabilitythemewant Easy Hotel Booking
- CVE-2025-68002WordPress Open User Map plugin <= 1.4.16 - Arbitrary File Download vulnerability100plugins Open User Map
- CVE-2025-68000WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerabilityPickPlugins Testimonial Slider
- CVE-2025-67993WordPress Atarim plugin <= 4.2.1 - Broken Access Control vulnerabilityVito Peleg Atarim
- CVE-2025-67975WordPress aDirectory plugin <= 3.0.3 - Broken Access Control vulnerabilityaDirectory
- CVE-2025-67973WordPress Sunshine Photo Cart plugin <= 3.5.6.2 - Broken Access Control vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2025-67972WordPress Zoho ZeptoMail plugin <= 3.2.9 - Broken Access Control vulnerabilityZoho Mail Zoho ZeptoMail
- CVE-2025-67970WordPress Schedula plugin <= 1.0 - Broken Access Control vulnerabilityvertim Schedula
- CVE-2025-67969WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.5.1 - Broken Access Control vulnerabilityknitpay UPI QR Code Payment Gateway for WooCommerce
- CVE-2025-67624WordPress Optimize More! – Images plugin <= 1.1.3 - Broken Access Control vulnerabilityArya Dhiratara Optimize More! – Images
- CVE-2025-67547WordPress Konte theme <= 2.4.6 - Broken Access Control vulnerabilityuixthemes Konte
- CVE-2025-60183WordPress Silencesoft RSS Reader Plugin <= 0.6 - Cross Site Scripting (XSS) VulnerabilitySilencesoft RSS Reader
- CVE-2024-56208WordPress NewsMash theme <= 1.0.71 - Cross Site Scripting (XSS) vulnerabilitydesertthemes NewsMash
- CVE-2024-54222WordPress Seraphinite Accelerator plugin <= 2.22.15 - Authenticated Sensitive Data Exposure vulnerabilitySeraphinite Solutions Seraphinite Accelerator
- CVE-2024-52387WordPress Master Addons plugin <= 2.0.9.9.4 - Cross Site Scripting (XSS) vulnerabilityLiton Arefin Master Addons for Elementor
- CVE-2024-51915WordPress LiteSpeed Cache plugin <= 6.5.2 - Cross Site Scripting (XSS) vulnerabilityLiteSpeed Technologies LiteSpeed Cache
- CVE-2024-50555WordPress Elementor Website Builder plugin <= 3.29.0 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder
- CVE-2024-50452WordPress Nexter Blocks plugin <= 3.3.3 - Cross Site Scripting (XSS) vulnerabilityPOSIMYTH Nexter Blocks
- CVE-2024-43228WordPress SecuPress Free plugin <= 2.2.5.3 - Broken Access Control vulnerabilitySecuPress Free
- CVE-2024-34438WordPress Shared Files plugin <= 1.7.19 - Broken Access Control vulnerabilityAnssi Laitila Shared Files
- CVE-2026-22885EnOcean SmartServer IoT Out-of-bounds ReadEnOcean Edge SmartServer IoT
- CVE-2025-52603HCL Connections is vulnerable to information disclosureHCLSoftware Connections
- CVE-2025-14055Integer underflow in Secure NCP hostsilabs.com Simplicity SDK, Gecko SDK
- CVE-2025-14547ECJ-PAKE Integer Underflow Vulnerability in Silicon Labs PSA Crypto and SE Manager APIssilabs.com Simplicity SDK · silabs.com Gecko SDK
- CVE-2026-2486Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'litonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2026-21620TFTP Path TraversalErlang OTP
- CVE-2025-59819Authenticated Arbitrary File Read via filepath parameterzenitel alphacom_xe_audio_server
- CVE-2026-26370WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability.Ays Pro Survey Maker
- CVE-2026-2825rachelos WeRSS we-mp-rss Article fix.py fix_html cross site scriptingrachelos WeRSS we-mp-rss
- CVE-2026-2824Comfast CF-E7 webmggnt mbox-config sub_441CF4 command injectionComfast CF-E7
- CVE-2026-2823Comfast CF-E7 webmggnt mbox-config sub_41ACCC command injectionComfast CF-E7
- CVE-2026-2739This affects versions of the package bn.js before 5.2.3.bn.js
- CVE-2026-2822JeecgBoot Backend airag_app,1,create_by sql injectionJeecgBoot
- CVE-2026-26994uTLS ServerHellos are accepted without checking TLS 1.3 downgrade canariesrefraction-networking utls · github.com/refraction-networki…
- CVE-2026-27017uTLS has a Chrome Parrot Fingerprint Vulnerability due to GREASE ECH Cipher Suite Mismatchrefraction-networking utls · github.com/refraction-networki…
- CVE-2026-26993Flare has XSS vulnerability in Raw File PreviewFlintSH Flare
- CVE-2026-2821Fujian Smart Integrated Management Platform System XCamera.ashx sql injectionFujian Smart Integrated Management Platform System
- CVE-2026-26992LibreNMS has Stored Cross-Site Scripting via unsanitized /port-groups namelibrenms · librenms/librenms
- CVE-2026-2384Quiz Maker <= 6.7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeays-pro Quiz Maker
- CVE-2026-26991LibreNMS vulnerable to Stored Cross-site Scripting through unsanitized /device-groups namelibrenms · librenms/librenms
- CVE-2026-2820Fujian Smart Integrated Management Platform System XAccessPermissionPlus.ashx sql injectionFujian Smart Integrated Management Platform System
- CVE-2026-27016LibreNMS has Stored XSS in Custom OID - unit parameter missing strip_tags()librenms · librenms/librenms
- CVE-2026-2819Dromara RuoYi-Vue-Plus Workflow deleteByInstanceIds SaServletFilter authorizationDromara RuoYi-Vue-Plus
- CVE-2026-26989LibreNMS has Stored XSS in Alert Rulelibrenms · librenms/librenms
- CVE-2026-26987LibreNMS affected by reflected XSS via email fieldlibrenms · librenms/librenms
- CVE-2026-26977Frappe Learning Management System exposes details of unpublished courses to unauthorized usersfrappe lms
- CVE-2025-67438A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaS@sync-in/server
- CVE-2026-26745OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field.