Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,118 vulnerabilities match.

CVESeveritySummary
CVE-2026-908659.0 CriticalCommand Injection via FTP Notification Variables in Progress WS_FTP Server
CVE-2026-908649.1 CriticalHost Administrator Path Containment Bypass in Progress WS_FTP Server
CVE-2026-908639.1 CriticalPrivilege Escalation via Missing Authorization in WS_FTP Manager
CVE-2026-908624.3 MediumWeb Transfer Module Multi-Factor Authentication Bypass in Progress WS_FTP Server
CVE-2026-908616.6 MediumPassword Disclosure via Activity Logs Enabling Administrator Privilege Escalation in WS_FTP Server
CVE-2026-842966.8 MediumSSH Multi-Factor Authentication Bypass in Progress WS_FTP Server
CVE-2026-8429510.0 CriticalImproper Authentication in Progress WS_FTP Server
CVE-2026-1157938.7 HighResource exhaustion from RPC sessions kept for requests to unknown interface
CVE-2026-1157942.3 LowAlarm data length not validated against received frame length
CVE-2026-1157955.3 MediumOut-of-bounds read of DCP block header in DCP Set and Identify request parsing
CVE-2026-1117368.7 HighNULL pointer dereference on implicit read of user specific record index
CVE-2026-1122008.7 HighResource exhaustion from unreleased AR and RPC session on RPC requests with incorrect endianness
CVE-2026-842947.7 HighInformation Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
CVE-2026-1117357.1 HighInteger underflow leads to out-of-bounds read in pf_cpm_c_data_ind()
CVE-2026-1117347.1 HighMissing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()
CVE-2026-1117338.7 HighNULL pointer dereference on implicit read of AR specific record index
CVE-2026-1117329.3 CriticalOut-of-bounds write when parsing AR Vendor Block requests
CVE-2026-1117318.7 HighInfinite loop when reading PDPortDataCheck record of subslot 0
CVE-2026-1117307.2 HighOut-of-bounds write in CheckPeers block parser due to unvalidated peer station name length
CVE-2026-1122569.2 CriticalLogon bypass (trust of attacker-controlled completed-methods list)
CVE-2026-1122552.9 LowEndpoint credential minting (insecure default allow-list)
CVE-2026-1180846.5 MediumWordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability
CVE-2026-1180837.5 HighWordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability
CVE-2026-1180828.8 HighWordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability
CVE-2026-1180818.8 HighWordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability
CVE-2026-1180808.8 HighWordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability
CVE-2026-1180797.2 HighWordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability
CVE-2026-1180787.2 HighWordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability
CVE-2026-1180777.2 HighWordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability
CVE-2026-1180768.8 HighWordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability
CVE-2026-1180758.8 HighWordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability
CVE-2026-1180747.2 HighWordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability
CVE-2026-1180738.8 HighWordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability
CVE-2026-1168697.2 HighWordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability
CVE-2026-1168688.8 HighWordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability
CVE-2026-1168678.8 HighWordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability
CVE-2026-1168668.8 HighWordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability
CVE-2026-1168657.2 HighWordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability
CVE-2026-1168647.2 HighWordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability
CVE-2026-1084947.1 HighWordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-621319.8 CriticalWordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability
CVE-2026-620189.8 CriticalWordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability
CVE-2026-620179.8 CriticalWordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability
CVE-2026-620169.8 CriticalWordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability
CVE-2026-620159.8 CriticalWordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability
CVE-2026-620149.8 CriticalWordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability
CVE-2026-620139.8 CriticalWordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability
CVE-2026-620129.8 CriticalWordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability
CVE-2026-620119.8 CriticalWordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability
CVE-2026-620109.8 CriticalWordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.