Search vulnerabilities

Expected end of text, found ':' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,865

CVE-2026-14836

Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Login/signup Popup
CVE-2026-15244

HUSKY - Products Filter Professional for WooCommerce < 1.4.1 - Shop Manager+ Local File Inclusion via meta_filter search_view

The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors.

CVSS 3.1 · 7.2 High EPSS 1.1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Husky
CVE-2026-15368

Profile Builder < 3.16.4 - Unauthenticated Account Takeover via Auto-Login After Registration

The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Profile Builder
CVE-2026-15262

Admin Columns for ACF Fields <= 0.3.2 - Contributor+ Stored XSS via ACF Field Value Column

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of higher-privileged users who view the affected post-list screen.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Admin Columns For Acf Fields
CVE-2026-15234

Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of any higher-privileged user (such as an administrator) who views the content.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Codeless Page Builder
CVE-2026-13158

Everest Toolkit <= 1.2.3 - Admin+ Arbitrary File Upload

The Everest Toolkit WordPress plugin through 1.2.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Everest Toolkit
CVE-2026-13157

Theme Demo Import <= 1.1.3 - Admin+ Arbitrary File Upload

The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Theme Demo Import
CVE-2026-10827

Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Spectra
CVE-2026-11882

Builderall for WordPress < 3.0.2 - Unauthenticated OAuth Access Token Poisoning via Public REST Routes

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token. A durable overwrite requires the site to already be connected to a paid account.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Builderall For Wordpress
CVE-2026-12696

wpForo Forum < 3.1.2 - Subscriber+ Stored XSS via Profile Location Field

The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the public participant profile page, allowing users with a subscriber-level account to inject JavaScript that executes in the browser of any visitor who views the profile, including a logged-in administrator.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wpforo Forum
CVE-2026-13329

WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wc Buckaroo Bpe Gateway
CVE-2026-13596

Participants Database < 2.7.8.4 - Unauthenticated SQL Injection via List Search

The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Participants Database
CVE-2025-0604

Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD restrictions. The issue enables authentication bypass and could allow unauthorized access under certain conditions.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Red Hat Single Sign On
CVE-2026-92091

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Ansible Automation Platform Enterprise Linux Openshift Ai and 2 more
CVE-2026-80179

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Red Hat Openshift Ai (rhoai) Ansible Automation Platform Enterprise Linux and 3 more
CVE-2026-79655

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Red Hat Redhat
Products
Enterprise Linux Enterprise Linux Rhel Els
CVE-2026-18769

Insufficient IOCTL access control allows local relocation of arbitrary physical memory

A local low privileged attacker can move arbitrary physical memory content via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Tcrouter.sys Twincat.xar.base.km
CVE-2026-18768

Insufficient IOCTL access control allows local access to arbitrary physical memory

A local low privileged attacker can access arbitrary physical memory or define its mapping via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Tcrouter.sys Twincat.xar.base.km
CVE-2026-18767

Insufficient IOCTL access control allows local access to I/O ports

A local low privileged attacker or process can access I/O ports via TcRouter.sys because of exposed IOCTL function calls resulting in a full compromise of the affected devices.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Beckhoff
Products
Tcrouter.sys Twincat.xar.base.km