Search vulnerabilities

Expected end of text, found '—' (at char 53), (line:1, col:54)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,899

CVE-2026-112865

WordPress Royal Elementor Addons plugin <= 1.7.1069 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-112828

WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-111979

GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that execute in the browser of any visitor or administrator who opens the affected donation form.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Givewp
CVE-2026-111978

GiveWP < 4.19.0.1 - Give Manager+ Path Traversal via Core Settings Import

The GiveWP WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and overwrite the GiveWP WordPress plugin before 4.19.0.1's stored configuration.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Givewp
CVE-2026-111976

GiveWP < 4.19.0.1 - Unauthenticated Unpublished Donation Form Disclosure via Form View Route

The GiveWP WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donation forms that WordPress core otherwise keeps non-public.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Givewp
CVE-2026-111841

WordPress FunnelKit Automations plugin <= 3.8.5.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Cross Site Request Forgery.This issue affects FunnelKit Automations: from n/a through 3.8.5.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-110377

WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme Bopo – WooCommerce Product Bundle Builder bopo-woo-product-bundle-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bopo – WooCommerce Product Bundle Builder: from n/a through 1.2.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-110376

WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in VillaTheme DEPART depart-deposit-and-part-payment-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DEPART: from n/a through 1.0.10.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-103381

Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery

The Mintpay for WooCommerce WordPress plugin through 2.2.3 does not verify the authenticity of the payment callback it processes, allowing unauthenticated attackers to mark arbitrary orders as paid, to cancel arbitrary orders, and to disclose order details including customer contact information.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-103306

iKhokha Payment Gateway < 3.0.4 - Unauthenticated Order Payment Forgery via Callback

The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-15705

Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS

The Contact Form by Supsystic WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-16824

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Powervm Vios Vios
CVE-2026-46497

SSRF via sitemap-derived URLs in Crawlee for Python

Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Apify
Products
Crawlee-python
CVE-2026-54309

n8n: n8n MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated caller can access browser-control capabilities including navigation, JavaScript evaluation, and cookie and storage access against the user's real browser profile. This issue only affects instances where @n8n/mcp-browser is run with the HTTP transport (--transport http). This vulnerability is fixed in 2.25.7 and 2.26.2.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
N8n
Products
N8n
CVE-2026-52755

Ghidra < 12.0.4 - Path Traversal via Zip Slip in Theme Import

Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Nsa
Products
Ghidra
CVE-2026-16829

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a NULL pointer dereference.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Powervm Vios Vios
CVE-2026-16825

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an out-of-bounds write.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Powervm Vios Vios
CVE-2026-16822

Vulnerabilities in IBM AIX and PowerVM VIOS

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to impersonate the TNC policy server and modify traffic due to improper certificate validation.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Aix Powervm Vios Vios
CVE-2026-7516

Clipboard Overwrite via Malicious Website in Lenovo Android Application

A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Lenovo
Products
Application