Search vulnerabilities

Expected end of text, found '‑' (at char 7), (line:1, col:8)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,471

CVE-2026-5096

Everest Forms <= 3.4.4 - Unauthenticated Server-Side Request Forgery via Upload Field 'Previous Value'

The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpeverest
Products
Wordpress Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder
CVE-2026-81849

Path traversal in the aws:downloadContent plugin in amazon-ssm-agent

Improper limitation of a pathname to a restricted directory in the aws:downloadContent plugin in amazon-ssm-agent before 3.3.4515.0 might allow an authenticated remote user whose ssm:SendCommand permission is restricted to the AWS-DownloadContent document, to write arbitrary files outside the intended download directory with root privileges, via crafted object keys in the S3 source the document is directed to retrieve. This issue may lead to arbitrary code execution as root if specific sensitive files are overwritten. To remediate this issue, customers should upgrade amazon-ssm-agent to version 3.3.4515.0 or later.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Amazon
Products
Amazon-ssm-agent Amazon Ssm Agent
CVE-2026-55485

Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session tables, while piccolo_api/session_auth/tables.py exposes SessionsBase.token because the token column is not secret. In deployments that add the Sessions and User tables to create_admin, a non-superuser administrator can call GET /api/tables/sessions/, obtain another user's live session token, replay it as the Cookie id value to impersonate a superuser, and permanently set superuser to true on the attacker's own row. This issue is fixed in version 1.14.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Piccolo-orm
Products
Piccolo
CVE-2026-18233

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-18234

MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet

The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mstore Wordpress
Products
Mstore Api Wordpress
CVE-2026-77007

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated BigBlueButton API Secret Disclosure

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Higheredlab Wordpress
Products
Hel Online Classroom: Ai-powered Online Classrooms Wordpress
CVE-2026-77008

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Plugin Settings Update

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Higheredlab Wordpress
Products
Hel Online Classroom: Ai-powered Online Classrooms Wordpress
CVE-2026-77010

HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Moderator Join URL Disclosure and Class Access Code Bypass

The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Higheredlab Wordpress
Products
Hel Online Classroom: Ai-powered Online Classrooms Wordpress
CVE-2026-77704

Amelia 1.2.32 - 2.4.8 - Amelia Customer+ Appointment Status Update and Self-Approval

The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Ameliabooking Wordpress
Products
Booking For Appointments And Events Calendar Wordpress
CVE-2026-81026

MasterStudy LMS < 3.7.40 - Unauthenticated Payment Bypass via PayPal IPN

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Masterstudy Lms Wordpress Plugin Wordpress
CVE-2026-81200

MasterStudy LMS < 3.7.42 - Instructor+ Cross-Tenant Order Billing PII Disclosure via IDOR

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Masterstudy Lms Wordpress Plugin Wordpress
CVE-2026-81342

MasterStudy LMS < 3.7.43 - Unauthenticated Open Redirect

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Stylemix Wordpress
Products
Masterstudy Lms Wordpress Plugin Wordpress
CVE-2026-78364

MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Mw Wp Form Project Wordpress
Products
Mw Wp Form Wordpress
CVE-2026-19873

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements

HTML::FormFu versions through 2.08 for Perl allow resource exhaustion via an unbounded repeat count from the query string in Repeatable elements. When a Repeatable element has counter_name set, its process method reads the repeat count from the named query string parameter, checks only that it is a positive integer, and passes it to repeat, which deep-clones the element's child subtree once per iteration. Nothing caps the value, and no attribute lets an application impose a limit. The count is read on every request, before the form decides whether it was submitted, so a plain GET reaches the clone loop with no credentials, no session and no request body. Nesting multiplies: a Repeatable inside a Repeatable takes a counter at each level, so an outer and an inner value of 100 build 10,000 clones. Once the form is submitted, each cloned field's constraints scan the whole element tree in _find_field_value, so cost grows faster than linearly with the count. A single request exhausts memory and CPU. The latest release on CPAN is 2.07, from 2018. Version 2.08 exists only in the git repository.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Formfu
Products
Html-formfu
CVE-2026-37004

Server‑Side Template Injection in BerriAI litellm Enables Remote Code Execution

BerriAI litellm <=1.82.4 is vulnerable to Server-Side Template Injection (SSTI), which allows unauthenticated remote attackers to execute arbitrary OS commands via a crafted dotprompt_content parameter in the /prompts/test endpoint due to use of an unsandboxed jinja2.Environment.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Berriai
Products
Litellm
CVE-2026-82475

iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitions.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Iflytek
Products
Astron-agent
CVE-2026-82469

Rodauth before 2.47.0 Authentication Bypass via jwt_refresh

Rodauth before 2.47.0 contains an authentication bypass vulnerability in the jwt_refresh route that issues new JWT access tokens without requiring a refresh token. Attackers can present an access token to the refresh route via non-POST methods to obtain a new valid access token, enabling indefinite account access with temporary token possession.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Jeremyevans
Products
Rodauth