Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,619 vulnerabilities match.

CVESeveritySummary
CVE-2026-1159506.5 MediumWordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1159516.5 MediumWordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1162566.9 Mediumgeesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery
CVE-2026-1159488.5 HighWordPress Media LIbrary Assistant plugin <= 3.42 - SQL Injection vulnerability
CVE-2026-1147096.5 MediumWordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1159496.5 MediumWordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability
CVE-2026-1156145.3 MediumWordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability
CVE-2026-972555.3 MediumWordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-972546.5 MediumWordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability
CVE-2026-972954.3 MediumWordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-1128656.5 MediumWordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1162556.9 MediumPGYER codefever URI Sanitizer doc.php _detail path traversal
CVE-2026-1103775.3 MediumWordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability
CVE-2026-1156026.5 MediumWordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1156136.5 MediumWordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1159585.3 MediumWordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability
CVE-2026-43165.1 MediumReflected Cross-Site Scripting in software IsMyGym by Zuinq Studio
CVE-2026-1162546.9 Mediumrathena FluxCP PayPal IPN PaymentNotifyRequest.php verifyiprange origin validation
CVE-2026-1122504.4 MediumCleartext Storage of Windows Service Account Password in BRAIN2 Setup Log Files
CVE-2026-1162536.9 MediumDedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection
CVE-2026-1033775.1 MediumReflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha
CVE-2026-1162379.3 CriticalOray Pugongying X5 Pro Dnsmasq crlf injection
CVE-2026-1162368.6 HighOray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload
CVE-2026-829477.1 HighMultiple Out-of-Bounds Reads in Frame Processing
CVE-2026-1134386.9 MediumPleasanter provided fails to properly verify passwords in LDAP authentication when processing specially crafted requests under certain configurations. If exploited, an attacker may bypass LDAP authentication by providing only a valid…
CVE-2026-829466.5 MediumNull Pointer Dereference in Mailbox Error Handling
CVE-2026-829456.5 MediumMemory Corruption via FMMU Configuration Table Overflow
CVE-2026-956285.4 MediumApache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)
CVE-2026-829448.8 HighBuffer Overflow in CoE SDO Upload Multi-Segment Data Transfers
CVE-2026-1103764.3 MediumWordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability
CVE-2026-1118418.8 HighWordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability
CVE-2026-1128284.3 MediumWordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability
CVE-2026-1162359.4 CriticalOray Pugongying X5 Pro L2TP Authentication crlf injection
CVE-2026-956295.4 MediumApache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory
CVE-2026-956634.8 MediumApache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry
CVE-2026-829436.5 MediumOut-of-Bounds Read via Unchecked Length Values
CVE-2026-956645.4 MediumApache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions
CVE-2026-1012595.3 MediumApache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions
CVE-2026-1163727.7 HighMISP mispguard: Feed responses with 2xx status codes other than 200 bypass filtering rules
CVE-2026-703888.3 HighMemory Corruption via Integer Underflow in Message Length Validation
CVE-2026-1162349.4 CriticalOray Pugongying X5 Pro IPsec Policy ipsec.conf crlf injection
CVE-2026-1162339.4 CriticalOray Pugongying X5 Pro Dnsmasq crlf injection
CVE-2026-1154255.6 MediumMultiple cross-site scripting (XSS) in OPNsense
CVE-2026-1162329.4 CriticalOray Pugongying X5 Pro SNMP snmp_set crlf injection
CVE-2026-1162319.4 CriticalOray Pugongying X5 Pro Ser2net crlf injection
CVE-2026-1162305.3 MediumNdemic Creations Plague Inc Evolved Workshop Scenario Loader deserialization
CVE-2026-965817.6 HighAn upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records
CVE-2026-1162295.1 Mediumffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting
CVE-2026-1033005.3 MediumEurobank WooCommerce Payment Gateway <= 2.1.1 - Unauthenticated Order Payment Forgery via Unverified Callback
CVE-2026-1119745.3 MediumGiveWP < 4.19.0.1 - Unauthenticated Donation Amount Restriction Bypass via Currency

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.