Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2026-77183

FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

The FooSales – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.43.0. This is due to the plugin not properly validating a user's identity prior to updating their details like email. This makes it possible for authenticated attackers, with FooSales Cashier-level access and above, to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-5727

Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site

The Hello Plus plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish their own Hello+ header/footer templates and draft currently active templates owned by higher-privileged users.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-3717

CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload

The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.3.1. This makes it possible for unauthenticated attackers to upload arbitrary content to the WordPress uploads directory as png files.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-39453

Red Lion Controls N-Tron 700 Series Reachable Assertion

Navigating to a certain URL on the switch’s web server causes the switch to reboot. This can be automated using a tool like curl to create DoS conditions where the switch constantly reboots.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-33367

Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function

SNMP can be used to perform administrative actions such as retrieving configuration files, modifying user accounts or device settings, and initiating firmware or bootloader upgrades or downgrades—all without any authentication.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-33272

Red Lion Controls N-Tron 700 Series Authentication Bypass Using an Alternate Path or Channel

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-29797

Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check

No authentication is required when updating firmware or bootloader, making it easy for malicious files to be pushed to the device. Additionally, anyone with the same software can scan a network for N-Tron devices and push/pull firmware without authenticating by using SNMP/TFTP.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-28745

Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format

Usernames and passwords, including the default credentials, are stored in the configuration file using weak encryption. If the default credentials are known by a malicious user, they could obtain other credentials on the system.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Red Lion Controls
Products
700 Series
CVE-2026-15340

Savannah lwIP SMTP client Classic Buffer Overflow

lwIP SMTP client does not check the size of inputs, potentially allowing a buffer overflow.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Savannah
Products
Lwip Smtp Client
CVE-2026-15178

Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification

The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with Custom-level access and above, to read private form submissions, change submission statuses, permanently delete submissions, and modify global plugin settings.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-108506

Unauthorized access vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Z80 Ultra
CVE-2026-108505

Information disclosure vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra has a local information disclosure vulnerability. Third-party applications can capture data returned by system interfaces to obtain device-related information.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Z80 Ultra
CVE-2026-108504

Unauthorized information retrieval vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Z80 Ultra
CVE-2026-108503

Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra has an interface permission validation vulnerability. The callable functions provided by the system lack sufficient access control. An attacker can leverage these functions to read relevant information.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Z80 Ultra
CVE-2026-108502

Information disclosure vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra contains an information disclosure vulnerability, through which third-party applications can read relevant information by hooking system APIs.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Z80 Ultra
CVE-2026-108501

Unauthorized access vulnerability in ZTE Z80 Ultra product

ZTE Z80 Ultra has a system interface permission verification defect. The interface lacks necessary access control, and relevant information can be read by reflectively invoking the interface.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Zte
Products
Zte Z80 Ultra
CVE-2026-107712

WP Booking System <= 2.1.0.1 - Authenticated (Subscriber+) SQL Injection via 'current_month' Parameter

The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_month' parameter in all versions up to, and including, 2.1.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a regression vulnerability — a capability check introduced in versions 2.0.19.11–2.0.19.14 to address CVE-2024-50425 was removed in version 2.1, meaning any authenticated subscriber-level account can reach the vulnerable handler with no nonce validation required.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-107645

Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

The Blocksy Companion plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.1.58 This is due to the implement_user_registration() AJAX handler explicitly disabling Dokan's vendor-registration nonce check (via add_filter('dokan_register_nonce_check', '__return_false')) and then trusting an attacker-supplied $_POST['role'] value when invoking wc_create_new_customer() and wc_set_customer_auth_cookie(). This makes it possible for unauthenticated attackers to elevate their privileges to a Dokan 'seller' (vendor) account — including sites where the Dokan vendor signup is explicitly turned off — and to be auto-authenticated into that account, which grants publishing capabilities beyond those of a normal customer.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-106208

chromium-browser: Missing authorization in API

Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-105281

Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Grid Protection Alliance
Products
Openhistorian Openpdc