Riskcovery

Vulnerabilities

Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.

398,692 vulnerabilities match.

CVESeveritySummary
CVE-2026-1159945.4 MediumBOLA Allows Cross-Project Target Tampering
CVE-2026-1159936.8 MediumStored XSS in the “Notes” field of project checklists
CVE-2026-1141969.8 CriticalWordPress Paytium plugin <= 5.0.5 - PHP Object Injection vulnerability
CVE-2026-1146957.1 HighWordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1146947.1 HighWordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1146936.5 MediumWordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1108926.5 MediumWordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
CVE-2026-1146977.1 HighWordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1141787.1 HighWordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1141905.9 MediumWordPress LiteSpeed Cache plugin <= 7.9 - Sensitive Data Exposure vulnerability
CVE-2026-1128669.3 CriticalWordPress Product Filter by WBW plugin <= 3.4.6 - SQL Injection vulnerability
CVE-2026-940759.8 CriticalWordPress Newsletters plugin <= 4.18.1 - PHP Object Injection vulnerability
CVE-2026-1128697.1 HighWordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1114029.3 CriticalWordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability
CVE-2026-1128447.1 HighWordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1141797.1 HighWordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
CVE-2026-1159757.1 HighBroken access control in JiraController
CVE-2026-1158035.3 MediumScada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
CVE-2026-1158025.3 MediumInternScience InternAgent LoRA Loading experiment.py train inclusion of functionality from untrusted control sphere
CVE-2026-1080136.8 MediumHCL BigFix Platform is affected by security vulnerability around intermediate CA certificate bundle (CVE ID)
CVE-2026-1144296.8 MediumWP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
CVE-2026-1136743.7 LowGeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
CVE-2026-1136737.2 HighGeoDirectory < 2.8.194 - Admin+ RCE via DB Text Export
CVE-2026-1134936.8 MediumGeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
CVE-2026-1134925.3 MediumGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Recently Viewed Listings AJAX Action
CVE-2026-1134916.4 MediumGeoDirectory < 2.8.194 - Subscriber+ Media File Disclosure and Deletion via Path Traversal
CVE-2026-1134905.3 MediumGeoDirectory < 2.8.194 - Unauthenticated Non-Public Listing Disclosure via Marker Popup REST Endpoint
CVE-2026-1134894.3 MediumGeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
CVE-2026-1122077.1 HighDownload Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
CVE-2026-1109569.8 CriticalasVereinbase < 1.1.8 - Unauthenticated Authentication Bypass via 2FA Validation
CVE-2026-1051996.8 MediumPixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
CVE-2026-973535.4 MediumNews Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form
CVE-2026-973524.3 MediumNews Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer
CVE-2026-1079076.5 MediumMAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
CVE-2026-878356.5 MediumFront End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment
CVE-2026-1078875.4 MediumAdvanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme
CVE-2026-1158069.8 CriticalPrime Mover <= 2.2.1 - Unauthenticated PHP Object Injection via Base64-Encoded Comment during Migration Search-and-Replace
CVE-2026-1158077.1 HighUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.3 - Authenticated (Author+) Limited Privilege Escalation via Gutenberg Block 'Assigned Role' Attribute
CVE-2026-1159297.6 HighMongoDB Compass trusts certificates issued by recoverable eMudhra intermediate CAs
CVE-2026-1159319.9 CriticalArbitrary file read and backend crash through unrestricted provider method calls
CVE-2026-1159388.7 HighLow privilege condition filter escapes Twig sandbox, recovers "securityKey" and reaches RCE
CVE-2026-1159378.7 HighUnauthenticated payment reuse allows unpaid orders to be marked as paid
CVE-2026-1158014.8 MediumKakao khaiii JSON Config File Linear.cpp open out-of-bounds
CVE-2026-1159358.7 HighControl panel only API response emulation replaces "securityKey" and reaches server RCE
CVE-2026-1158972.1 LowSerialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
CVE-2026-1158958.8 HighHappy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
CVE-2026-1158939.9 CriticalWasmtime: Cranelift backend on aarch64 can jump to incorrect target on large Wasm `br_table` instruction
CVE-2026-1158925.7 MediumWasmtime: Panic lowering a host-created component model stream into a guest that expects a different payload type
CVE-2026-1158899.9 CriticalWasmtime: Bit-packing in Cranelift compiler causes silent overflow and miscompilation
CVE-2026-1158877.5 Highgraphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.