415128CVEs tracked
4633Last 7 days
16419Last 30 days
1756CISA KEV
Recently published CVEs
4633 results| CVE | CVSS | Attack conditions / Impact | EPSS | Summary | Published |
|---|---|---|---|---|---|
| CVE-2026-116050 | 6.9
CNA v4.0 |
NetworkNo authNo interaction
PoC
C:LI:LA:L
|
— | krupalshah Employee Recruitment System Registration registerform3.php sql injection A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the compo… |
2026-10-25 |
| CVE-2026-116049 | 6.9
CNA v4.0 |
NetworkNo authNo interaction
PoC
C:LI:LA:L
|
— | krupalshah EmployeeRecruitmentSystem Registration Wizard registerform2.php mysql_query sql… A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php o… |
2026-10-25 |
| CVE-2026-116048 | 6.9
CNA v4.0 |
NetworkNo authNo interaction
PoC
C:LI:LA:L
|
— | krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql inject… A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/regi… |
2026-10-25 |
| CVE-2026-116047 | 5.3
CNA v4.0 |
NetworkNo authUser action
PoC
C:NI:LA:N
|
— | Privoce Vocechat Query Parameter widget.html cross site scripting A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the … |
2026-10-25 |
| CVE-2026-116046 | 4.8
CNA v4.0 |
LocalLoginNo interaction
C:LI:LA:L
|
— | eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Cus… |
2026-10-25 |
| CVE-2026-116045 | 5.3
CNA v4.0 |
NetworkLoginNo interaction
PoC
C:LI:NA:N
|
— | 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP … |
2026-10-25 |
| CVE-2026-94295 | — | Not scored | — | Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forger… The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated or… |
2026-10-25 |
| CVE-2026-115251 | — | Not scored | — | Duplicator 1.5.17 - Multisite Subsite Admin+ Network-Wide PHP Code Execution via One-Click… The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routin… |
2026-10-25 |
| CVE-2026-115214 | — | Not scored | — | Datawiza Proxy Auth Plugin 1.1.0 - Unauthenticated Privilege Escalation via X-User and Rol… The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenti… |
2026-10-25 |
| CVE-2026-115183 | — | Not scored | — | Qi Addons For Elementor < 1.11.2 - Contributor+ Content Injection via Animated Text Widget The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to … |
2026-10-25 |
| CVE-2026-114743 | — | Not scored | — | InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settin… The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowin… |
2026-10-25 |
| CVE-2026-114742 | — | Not scored | — | WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and pu… |
2026-10-25 |
| CVE-2026-114741 | — | Not scored | — | WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and m… |
2026-10-25 |
| CVE-2026-114740 | — | Not scored | — | WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizar… The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publi… |
2026-10-25 |
| CVE-2026-111981 | — | Not scored | — | GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_ad… The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit… |
2026-10-25 |
| CVE-2026-111980 | — | Not scored | — | GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability … The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages… |
2026-10-25 |
| CVE-2026-111979 | — | Not scored | — | GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custo… |
2026-10-25 |
| CVE-2026-111978 | — | Not scored | — | GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal… |
2026-10-25 |
| CVE-2026-111976 | — | Not scored | — | GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Rou… The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the c… |
2026-10-25 |
| CVE-2026-110285 | — | Not scored | — | WP Stripe Checkout < 1.2.2.62 - Unauthenticated Forged Payment Completion via an Unset Web… The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attacker… |
2026-10-25 |
| CVE-2025-15705 | — | Not scored | — | Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when a… |
2026-10-25 |
| CVE-2026-116044 | 5.3
CNA v4.0 |
NetworkLoginNo interaction
PoC
C:LI:LA:L
|
— | prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL Fi… |
2026-10-25 |
| CVE-2026-116007 | 3.7
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
PoC
C:LI:NA:N
|
— | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification SmsCodeServiceImpl.java SmsCodeSe… A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of … |
2026-10-25 |
| CVE-2026-116006 | 7.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
PoC
C:LI:LA:L
|
— | YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper auth… A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. Th… |
2026-10-25 |
| CVE-2026-116004 | 3.5
CNA (via NVD) v3.1 |
NetworkLoginUser action
PoC
C:NI:LA:N
|
— | onyx-dot-app Onyx PreviewTab.tsx cross site scripting A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation lead… |
2026-10-25 |
| CVE-2026-116000 | 7.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
PoC
C:LI:LA:L
|
— | Zylon PrivateGPT URI Artifact Loader uri_loader.py load_file_from_uri server-side request … A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI… |
2026-10-25 |
| CVE-2026-115999 | 7.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:LI:LA:L
|
— | mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument log… |
2026-10-25 |
| CVE-2026-115997 | 6.3
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
PoC
C:LI:LA:L
|
— | pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterAr… |
2026-10-25 |
| CVE-2026-89284 REJECTED | — | Not scored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-24 |
| CVE-2026-115996 | 3.7
CNA (via NVD) v3.1 |
NetworkNo authNo interactionConditions
C:NI:LA:N
|
— | Unitree Robotics Unitree Go2 chat_go websocket.py WebSocketClient.connect certificate vali… A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Perfor… |
2026-10-24 |
| CVE-2026-115995 | 9.6
CNA (via NVD) v3.1 |
NetworkNo authUser action
Scope change
C:HI:HA:H
|
— | Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such mani… |
2026-10-24 |
| CVE-2026-111326 REJECTED | — | Not scored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-24 |
| CVE-2026-109111 REJECTED | — | Not scored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-24 |
| CVE-2026-115982 | 4.3
CNA (via NVD) v3.1 |
NetworkNo authUser action
PoC
C:NI:LA:N
|
— | phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Perfor… |
2026-10-24 |
| CVE-2026-115981 | 2.4
CNA (via NVD) v3.1 |
NetworkAdminUser action
PoC
C:NI:LA:N
|
— | phpIPAM index.php cross site scripting A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_U… |
2026-10-24 |
| CVE-2026-115973 | 7.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:LI:LA:L
|
— | FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Co… |
2026-10-24 |
| CVE-2026-114820 | 9.1
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:HA:N
|
— | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u… | 2026-10-24 |
| CVE-2026-115972 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:NI:LA:N
|
— | FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAut… |
2026-10-24 |
| CVE-2026-115971 | 5.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
PoC
C:NI:NA:L
|
— | Travisun Opptrix preParsing handler webhook Buffer.concat denial of service A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in… |
2026-10-24 |
| CVE-2026-115970 | 7.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
PoC
C:LI:LA:L
|
— | Travisun Opptrix Import Endpoint import code injection A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injec… |
2026-10-24 |
| CVE-2026-115969 | 7.3
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
PoC
C:LI:LA:L
|
— | Travisun Opptrix Schedule API setup command injection A flaw has been found in Travisun Opptrix 0.4.0. This affects an unknown function of the file /api/auth/setup of the component Schedule API. This manipulation causes command injection. It is possible … |
2026-10-24 |
| CVE-2026-115933 | 9.9
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
Scope change
C:HI:HA:H
|
— | Forged signed tokens let any registered user take over other users and organizations Postiz signs its session, invitation and password reset tokens with one shared secret and without any marker of what a token is for. A route that refreshes the credentials of a browser-extension chann… |
2026-10-24 |
| CVE-2026-115557 | 9.4
CNA (via NVD) v4.0 |
NetworkNo authUser action
Scope change
C:HI:HA:H
|
— | Distrust compromised intermediate certificates in ssl module Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatical… |
2026-10-24 |
| CVE-2026-114704 | 7.2
CNA (via NVD) v3.1 |
NetworkAdminNo interaction
C:HI:HA:H
|
— | WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4. |
2026-10-24 |
| CVE-2026-114629 | — | Not scored | — | Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length h… Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application… |
2026-10-24 |
| CVE-2026-114192 | 6.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:LI:LA:N
|
— | WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability Missing Authorization vulnerability in Magepeople inc. WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpEvently: from n/a through … |
2026-10-24 |
| CVE-2026-114191 | 7.5
CNA (via NVD) v3.1 |
NetworkNo authNo interaction
C:HI:NA:N
|
— | WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Cont… Missing Authorization vulnerability in Knit Pay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.… |
2026-10-24 |
| CVE-2026-115932 | 9.6
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
Scope change
C:HI:HA:N
|
— | Path traversal in post media lets any registered user read server files When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user c… |
2026-10-24 |
| CVE-2026-116020 | 5.4
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:LI:LA:N
|
— | BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with a… |
2026-10-24 |
| CVE-2026-116019 | 8.8
CNA (via NVD) v3.1 |
NetworkLoginNo interaction
C:HI:HA:H
|
— | Grav 2.0.15 before 2.2.13 Allowlist Bypass via Flex Form Override Directives Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer key… |
2026-10-24 |