Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

402,131 vulnerabilities match.

CVESeveritySummary
CVE-2026-828445.3 MediumWPForms Lite 1.10.0.1 - 2.0.2.1 - Unauthenticated Payment Bypass via PayPal Commerce
CVE-2026-1033086.5 MediumVisma Pay for WooCommerce < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure via Gateway Return Endpoint
CVE-2026-1013015.3 MediumWPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass
CVE-2026-1039048.6 HighStored XSS Vulnerability in JTL-Shop
CVE-2026-737956.4 MediumHPE NonStop TMF Auditread2 - Denial of Service vulnerability
CVE-2026-1002296.5 MediumGstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: out-of-bounds write in gst_h266_parser_parse_dci() due to off-by-one array bound check
CVE-2026-888423.3 LowBusybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption
CVE-2026-1099714.7 MediumClevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool
CVE-2026-1099704.7 MediumClevis: clevis: pkcs#11 token pin written to world-readable file
CVE-2026-1099694.7 MediumClevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask
CVE-2026-1002316.1 MediumGstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: heap out-of-bounds write in asfmux due to incorrect utf-16 size calculation for non-bmp characters
CVE-2026-888297.2 HighBusybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy
CVE-2026-909547.8 HighBusybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush
CVE-2026-864768.4 HighGstreamer1-plugins-base: gst-plugins-base: heap buffer overflow via unvalidated gstvideometa plane extents in gst_video_frame_map_id and video_meta_deserialize
CVE-2026-737944.6 MediumHPE NonStop MODULAR NSJ - Vulnerability in Random Number Generation
CVE-2026-737937.9 HighHPE NonStop Middleware - Secret key handling vulnerability
CVE-2026-737923.8 LowHPE NonStop Java JToolkit - Command Injection and buffer overflow vulnerability
CVE-2026-737912.0 LowHPE NonStop Hpjmeter - Buffer overflow vulnerability
CVE-2026-737908.2 HighHPE NonStop iTP WebServer - Memory corruption vulnerability
CVE-2026-148519.2 CriticalUnauthorised disclosure of information on Copart’s online billing service
CVE-2026-1036715.3 MediumExternal control of assumed-Immutable web parameter issue exists in EC-CUBE plugin (for EC-CUBE 4 series) "AmazonPay Plugin". If exploited, the user may be redirected to an arbitrary website during the ordering process. As a result, user's…
CVE-2026-1074287.1 HighWordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability
CVE-2026-923928.1 HighHTTP/2 upload Use-After-Free
CVE-2026-1077574.9 MediumGallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
CVE-2026-1049098.1 HighMang Board <= 2.4.3 - Unauthenticated Local File Inclusion via '<mode>_type' Parameter
CVE-2026-1047647.2 HighPost Export Import with Media <= 1.17.1 - Authenticated (Administrator+) PHP Object Injection via 'page_data[meta]' Parameter
CVE-2026-1047489.8 CriticalSimpleForm <= 3.10.0 - Unauthenticated Privilege Escalation to wp_capabilities Mass Assignment via simpleform_wp_register
CVE-2026-1076506.4 MediumGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title
CVE-2026-1039076.5 MediumJeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action
CVE-2026-1076317.2 HighRecord of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter
CVE-2026-1077517.2 HighMang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter
CVE-2026-1077566.4 MediumMeow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name
CVE-2026-1047616.4 MediumMang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter
CVE-2026-1102847.5 HighLifterLMS <= 10.3.1 - Authenticated (Contributor+) Local File Inclusion via 'lifterlms_checkout' Shortcode Attributes
CVE-2026-1033678.1 HighShopMagic <= 4.9.0 - Unauthenticated Local File Inclusion via 'billing.first_name' Parameter
CVE-2025-93736.4 MediumPeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
CVE-2026-1033804.3 MediumAppointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
CVE-2026-1033667.5 HighAppointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
CVE-2026-1001637.4 HighAppointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
CVE-2026-1077546.4 MediumGeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title
CVE-2026-1051077.2 HighKoha SQL injection in reports/cat_issues_top.pl via the Criteria, Filter and Limit request parameters
CVE-2026-1051068.8 HighKoha authenticated OS command injection in tools/scheduler.pl via the jobid parameter when deleting a scheduled task
CVE-2026-1102275.3 MediumWordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability
CVE-2026-1099018.5 HighWordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability
CVE-2026-1071716.9 MediumAn Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users.
CVE-2026-893109.4 CriticalSQL Command Injection Vulnerability in JTL-WMS
CVE-2026-1104675.3 MediumWisdomGarden｜Tronclass - Insecure Direct Object Reference
CVE-2026-1104665.3 MediumWisdomGarden｜Tronclass - Sensitive Data Exposure
CVE-2026-1104655.3 MediumWisdomGarden｜Tronclass - Insecure Direct Object Reference
CVE-2026-969045.3 MediumAWP Classifieds < 4.4.9 - Unauthenticated Listing Contact Email Disclosure via Place Ad Page

Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.