Search vulnerabilities

Expected end of text, found '/' (at char 13), (line:1, col:14)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,601

CVE-2026-124739

Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf

A flaw was found in BusyBox. When the httpd web server processes subdirectory configuration files, an overly long index page name can trigger a stack-based buffer overflow. An attacker with permissions to write to a subdirectory configuration file could exploit this vulnerability to execute arbitrary code with elevated privileges or cause a denial of service (DoS) by crashing the server process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Hummingbird Rhel Els
CVE-2026-115338

Insecure XFT Transport in Progress WS_FTP Server

Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Progress Progress Software
Products
Ws Ftp Server Ws Ftp Server
CVE-2026-106025

Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-105002

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code, which is only possible where the related feature is enabled and not properly restricted.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Api Connect
CVE-2026-78287

WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-121374

Arbitrary file write and code execution via excluded node roles in Kubernetes special agent

Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with permission to edit rules in at least one folder to write files to arbitrary locations writable by the site user via crafted node roles in the "Exclude nodes based on their role" rule option, leading to code execution as the site user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-118965

Path traversal in host label synchronization allows code execution on the central site from a remote site

Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an attacker in control of a remote site in a distributed monitoring setup to write arbitrary files on the central site and thereby execute code as the central site user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-120495

Arbitrary file write and code execution via crafted Synthetic Monitoring agent data

Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Checkmk
Products
Checkmk
CVE-2026-13604

Pixelavo < 1.5.4 - Unauthenticated Facebook CAPI Event Injection via pixelavo_event AJAX

The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pixelavo
CVE-2026-13729

Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF

The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Podlove Podcast Publisher
CVE-2026-14214

Amelia < 2.4.4 - Amelia Manager+ Arbitrary User-Field Modification via Mass Assignment

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Amelia
CVE-2026-14315

Pixel Tag Manager for WooCommerce < 2.2.1 - Unauthenticated Forged Conversion Event Submission

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.1 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to submit forged e-commerce conversion events to the site's configured server-side advertising conversion APIs using the site's stored credentials.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Pixel Tag Manager For Woocommerce
CVE-2026-14561

Authora - Easy Login with Mobile Number < 1.7.7 - Unauthenticated Account Takeover via OTP Disclosure

The Authora : Easy login with mobile number WordPress plugin before 1.7.7 does not keep its one-time login code confidential, returning the code and a valid verification token in the response of an unauthenticated action, allowing unauthenticated attackers to log in as any user whose registered mobile number they know (including administrators) or to create arbitrary accounts.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Authora
CVE-2026-14839

Mapster WP Maps < 1.24.0 - Unauthenticated Private and Draft Post Content Disclosure

The Mapster WP Maps WordPress plugin before 1.24.0 does not perform any authorization or post-status check on a public REST endpoint, allowing unauthenticated users to retrieve the title and full content of any post regardless of its status, including unpublished (draft, pending, private, and trashed) posts.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Mapster Wp Maps
CVE-2026-14841

King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a crafted page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
King Addons For Elementor
CVE-2026-14864

JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as administrators.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Jetengine
CVE-2026-14938

FluentBoards < 1.95.3 - Subscriber+ Cross-Board Task Disclosure via IDOR

The FluentBoards WordPress plugin before 1.95.3 does not verify that the items selected for a board import operation belong to a board the requesting user is authorized to access, allowing any authenticated user with member access to a single board to copy and read the stages and tasks (including titles, descriptions and file attachments) of any other board on the site.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Fluentboards
CVE-2026-15151

Five Star Restaurant Reservations < 2.7.23 - Booking Manager+ Missing Authorization via rtb_reset_notifications

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Five Star Restaurant Reservations
CVE-2026-15241

ChatBot for eCommerce – WoowBot < 4.8.4 - Unauthenticated Gemini API Key Abuse via qcld_gemini_response

The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional feature is enabled, to retrieve indexed knowledge-base content.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Chatbot For Ecommerce
CVE-2026-15385

RT Mega Menu < 1.5.2 - Subscriber+ Stored XSS via Menu Item CSS

The RT Mega Menu WordPress plugin before 1.5.2 does not perform a capability check on the AJAX action that saves mega-menu configuration and per-menu-item settings; its only gate is a nonce that any logged-in user can read from a standard admin page. A subscriber-level user can therefore enable the mega menu on a site menu and store a menu-item style value that is rendered, without output escaping, into a style attribute on the public navigation. By breaking out of that attribute the user persists a JavaScript event handler that executes for every visitor who hovers the navigation, including administrators, leading to session/site takeover.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Rt Mega Menu