Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 8,882

CVE-2026-39743

WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wclovers Wordpress-extensions
Products
Wcfm Membership Wcfm Membership
CVE-2026-114183

WordPress AnyWhere Elementor plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpvibes
Products
Anywhere Elementor Anywhere Elementor
CVE-2026-120843

WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Barn2 Plugins Wordpress-extensions
Products
Posts Table With Search & Sort Posts Table With Search & Sort
CVE-2026-119487

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress-extensions
Products
Dokan Dokan
CVE-2026-39777

WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wclovers Wordpress-extensions
Products
Wcfm Membership Wcfm Membership
CVE-2026-119485

WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wedevs Wordpress-extensions
Products
Dokan Dokan
CVE-2026-114185

WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpvibes
Products
Anywhere Elementor Anywhere Elementor
CVE-2026-103077

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mycred Wordpress-extensions
Products
Mycred Mycred
CVE-2026-105619

PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views

PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-105620

PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query

PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-110181

PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data

PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-110182

PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data

PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-110183

PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking

PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dalibo
Products
Postgresql Anonymizer
CVE-2026-17132

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17131

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-17129

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-127207

Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions

Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-17128

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-124417

WordPress WP Job Portal plugin <= 2.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ahmad Wordpress-extensions
Products
Wp Job Portal Wp Job Portal
CVE-2026-124411

WordPress SureCart plugin <= 4.12.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Surecart Surecart