Search vulnerabilities

Expected end of text, found ':' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,857

CVE-2026-119175

Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A first-time commenter's submission requires a single administrator approval under the default comment_previously_approved setting; however, once approved, all subsequent comments from the same name and email pair bypass moderation, and the injected script executes for every visitor — including administrators viewing the post from the front end.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Gijo Wordpress-extensions
Products
Flying Images: Optimize And Lazy Load Images For Faster Page Speed Flying Images
CVE-2026-121516

QODE Wishlist for WooCommerce <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via 'table_title' Shared Wishlist Field via Guest Cookie

The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qode_wishlist_for_woocommerce_guests_items' parameter in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by guests because the required wp_rest nonce is publicly emitted to unauthenticated visitors on the /wishlist/ page, and the attacker controls the transient key, meaning the payload is stored site-wide and only requires a victim to open a crafted share URL and click the injected title link. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Qodeinteractive Wordpress-extensions
Products
Qode Wishlist For Woocommerce Qode Wishlist For Woocommerce
CVE-2026-124495

Apache Storm: Logviewer follows worker symlinks across topology ACLs

When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Storm
CVE-2026-124496

Apache Storm: DRPC HTTP doAsUser bypasses the impersonation authorizer

The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Apache
Products
Storm
CVE-2026-124690

Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Kendo Ui For Jquery
CVE-2026-124815

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions, and uses a user-supplied table name in a SQL query without validating or escaping it, allowing unauthenticated users to perform SQL injection attacks, deleting data from any database table and extracting sensitive information such as password hashes.

CVSS 3.1 · 10.0 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Clockinator Lite
CVE-2026-17112

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information belonging to other tenants due to broken object-level authorization.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-64463

usb: typec: tcpci_rt1711h: unregister TCPCI port with devres

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpci_rt1711h: unregister TCPCI port with devres rt1711h_probe() registers the TCPCI port before requesting the interrupt and enabling alert interrupts. If either of those later steps fails, the probe function returns without unregistering the TCPCI port. The explicit unregister currently only happens from the remove callback. Register a devres action immediately after tcpci_register_port() succeeds, so tcpci_unregister_port() runs on later probe failures and on driver detach. Drop the remove callback to avoid unregistering the same port twice. This issue was identified during our ongoing static-analysis research while reviewing kernel code.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-123836

Workspace Collaborators Retrieve Owner's SSH Private Key via Git Backup in JetBrains Datalore

In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore
CVE-2026-119907

Windows Function Discovery Resource Publication Elevation of Privilege Vulnerability

Untrusted pointer dereference in Windows Function Discovery Resource Publication allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-119921

Windows Microsoft Account Sign-in Assistant Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Microsoft Account Sign-in Assistant allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 20 more
CVE-2026-124701

Deserialization of Untrusted Data in Progress Telerik UI for WinForms

In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Progress
Products
Telerik Ui For Winforms
CVE-2026-123835

Code Execution Through Init Script Upload Race in JetBrains Datalore

In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jetbrains
Products
Datalore