Search vulnerabilities

Expected end of text, found '/' (at char 34), (line:1, col:35)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,645

CVE-2026-65570

WordPress Login with phone number plugin <= 1.8.70 - Bypass vulnerability vulnerability

Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-65578

WordPress Agora theme <= 1.9 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-66379

Authenticated users may view private Puppet module metadata

An authenticated user may view private Puppet module metadata without repository read access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jfrog
Products
Artifactory
CVE-2026-58247

Memory Corruption vulnerability in SAP ABAP Platform

SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sap
Products
Abap Platform
CVE-2026-67589

Apache Qpid ProtonJ2: Type size/count handling can lead to excessive allocation pre-authentication

A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Qpid Proton-j Qpid Protonj2
CVE-2026-65551

WordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Soflyy Wordpress
Products
Breakdance Wordpress
CVE-2026-66709

WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability

Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Webappick Wordpress
Products
Ctx Feed Wordpress
CVE-2026-65933

BT122 malformed packet with increased length field causes memory leak

A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Silabs.com
Products
Bt122
CVE-2026-99046

gve: fix XSK buffer leak on error descriptor

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the buf_state and its attached buffer should be freed. In the case of AF_XDP ZC, the XSK buffer was not freed, leading to a leak. This issue was caught by LLM.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-99051

fsverity: RCU-delay the freeing of struct fsverity_info

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverity_info __fsverity_get_info() calls rhashtable_lookup_fast(), which just uses rcu_read_lock() and doesn't directly synchronize with fsverity_remove_info(). For the same inode this isn't a problem: its fsverity_info is removed only at inode eviction time or upon failure to enable verity, when the inode no longer needs its fsverity_info and it will no longer be accessed via that inode. However, this is broken and can cause a use-after-free for concurrent __fsverity_get_info() for *different* inodes. Those rely on following fsverity_info::rhash_head in the rhashtable under rcu_read_lock() only. They also use fsverity_info::inode to do the key comparison. Fix this by RCU-delaying the freeing of 'struct fsverity_info' after it's been removed from the rhashtable.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Linux Kernel
CVE-2026-97352

News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-87835

Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms, allowing unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the Front End Users WordPress plugin through 3.2.35's content restrictions and its registration gating.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114705

WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability

Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Feed Gallery: from n/a through 5.0.13.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-114704

WordPress Relevanssi plugin <= 4.28.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—