Search vulnerabilities

Expected end of text, found '\' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2026-67359

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any order_id as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
J2commerce.com
Products
J2store Extension For Joomla
CVE-2026-67358

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Download quota manipulation in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user with a valid order token could increment the download limit counter on a download record belonging to a different order. The endpoint also lacked a CSRF token.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
J2commerce.com
Products
J2store Extension For Joomla
CVE-2026-27875

Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Johnson Controls Johnsoncontrols
Products
Simplex Incident Manager Autocall Fire Administrator Simplex Incident Manager / Autocall Fire Administrator
CVE-2026-15679

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face PyTorch Image Models checkpoint Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face PyTorch Image Models. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of checkpoints. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-27987.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Hugging Face
Products
Pytorch Image Models
CVE-2026-27365

WordPress PublishPress Series plugin <= 2.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Publishpress Wordpress
Products
Publishpress Series Wordpress
CVE-2026-74804

Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-75114

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64

Joomla Extension - yootheme.com - Open redirect in CommentController::twitterAuthenticate() in Zoo < 4.1.64 - The referer request parameter is passed straight to setRedirect() with no validation.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-74803

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64

Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-71960

Cudy WR3000 2.0 Hard-coded JWT Secret Authentication Bypass via MQTT

Cudy WR3000 2.0 running firmware before 2.5.24 contains a hard-coded JWT HMAC signing secret vulnerability in the Mosquitto MQTT broker's authentication plugin that allows unauthenticated attackers to forge valid JWT tokens by extracting the secret from the firmware image. Attackers can use the extracted secret to craft arbitrary JWT tokens and authenticate to the MQTT broker without legitimate credentials, gaining unauthorized access to the device's mesh networking interface.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Shenzhen Cudy Technology
Products
Wr3000 2.0
CVE-2026-71961

Cudy WR3000 2.0 OS Command Injection via Mesh MQTT Command Handler

Cudy WR3000 2.0 running firmware before 2.5.24 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary OS commands with root privileges by sending unsanitized input through the mesh MQTT command interface. The sync_command binary forwards unsanitized input directly to a shell execution sink in command.lua, enabling attackers with access to the MQTT broker to exploit the default-enabled command execution path to achieve full root-level system compromise.

CVSS 4.0 · 8.7 High EPSS 2.7% KEV · Not listed
Vendors
Shenzhen Cudy Technology
Products
Wr3000 2.0
CVE-2026-76610

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65

Joomla Extension - yootheme.com - Unauthenticated tag modifications in Zoo < 4.1.65 - The comment controller endpoint lacked ACL checks, allowing unauthorized tag modifications by unauthenticated users.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-77029

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

Joomla Extension - yootheme.com - Missing CSRF tokens on front-end state changes in Zoo < 4.1.66

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-77028

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-75115

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40

Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Yootheme Pro Extension For Joomla
CVE-2026-76611

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-76612

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Yootheme.com
Products
Zoo Extension For Joomla
CVE-2026-75928

Brushfire unauthenticated information disclosure

The Brushfire platform's video content streaming application (https://online.brushfire.com) exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Brushfire
Products
Online Experience
CVE-2026-75932

Jet Admin tenant isolation failure

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth Client ID and Client Secret if the victim is using an OAuth provider.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Jet Admin
Products
Jet Admin
CVE-2026-75933

Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Jet Admin
Products
Jet Admin