Search vulnerabilities

Expected end of text, found '\' (at char 29), (line:1, col:30)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,120

CVE-2026-18391

WooCommerce Subscriptions < 9.1.0 - Unauthenticated RCE via PHP Object Injection

The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Woocommerce Wordpress
Products
Subscriptions Wordpress
CVE-2026-18474

WP Directory Kit < 1.5.6 - Unauthenticated SQL Injection via search_location and search_category

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpdirectorykit
Products
Wordpress Wp Directory Kit
CVE-2026-4901

Insertion of Sesitive Information into Log File in AlanWeb SCADA

AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Control System Hydrosystem Hydrosystem.poznan
Products
Alanweb Scada Control System Control System
CVE-2026-34185

SQL Injection in AlanWeb SCADA

AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Control System Hydrosystem Hydrosystem.poznan
Products
Alanweb Scada Control System Control System
CVE-2026-34184

Missing Authorization inAlanWeb SCADA

AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Control System Hydrosystem Hydrosystem.poznan
Products
Alanweb Scada Control System Control System
CVE-2026-66151

Out-of-Bounds Read in SonicWall Global VPN Client SWIPsec.sys Leads to System Crash

SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Sonicwall
Products
Global Vpn Client
CVE-2026-16574

Dokan < 5.0.11 - Vendor+ Cross-Vendor Downloadable Product Access Grant via Order Downloads REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Dokan Wordpress
Products
Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution Wordpress
CVE-2026-16608

Download Monitor < 5.2.6 - Unauthenticated Download Log Injection

The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Download Monitor Wordpress
Products
Download Monitor Wordpress
CVE-2026-16948

Solace Extra < 1.6.1 - Subscriber+ Multiple Missing Authorization via Site-Wide Nonce Exposure

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Solacewp Wordpress
Products
Solace Extra Wordpress
CVE-2026-67285

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-67286

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0

Joomla Extension - joomshaper.com - Unauthenticated arbitrary directory creation and file write in SP Page Builder < 6.8.0 - An unauthenticated attacker can create arbitrary directories and files with a predefined name.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomshaper.net
Products
Sp Page Builder Extension For Joomla
CVE-2026-73415

jupyterlab: Image viewer in JupyterLab allows XSS when opening malicious image in new browser tab

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.10 and 4.6.2, in packages/imageviewer/src/widget.ts, JupyterLab's ImageViewer uses URL.createObjectURL for a specially crafted SVG image and revokes the blob URL too early, allowing the image to retain an executable same-origin context when it is opened through the image viewer and then opened in a new browser tab. The resulting cross-site scripting can be used to execute arbitrary code on the JupyterLab server. This issue is fixed in versions 4.5.10 and 4.6.2.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jupyter
Products
Jupyterlab
CVE-2026-17540

Bit File Manager < 6.9.1 - Subscriber+ Arbitrary File Read and Deletion via Connector Command Request-Source Mismatch

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's configuration secrets and to denial of service.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed
Vendors
Filemanagerpro Wordpress
Products
File Manager Wordpress
CVE-2026-18468

Login & Register Forms < 4.0.2 - Unauthenticated Account Takeover via Password Reset Verification State Keyed on a Client-Supplied Address Header

The Login & Register Forms WordPress plugin before 4.0.2 does not bind the password reset verification state to the account being reset or to the party that completed the verification, keying it instead on a value the client controls, allowing unauthenticated attackers to take over the account of any user who recently completed a reset verification, including an administrator.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-19049

ProSolution WP Client < 2.0.9 - Unauthenticated SQLi and Plugin Data Deletion via 'removesite' Cookie

The ProSolution WP Client WordPress plugin before 2.0.9 does not sanitise a cookie value before using it in SQL queries, and processes that cookie on every request without any authentication or capability check, allowing unauthenticated users to read arbitrary data from the database and to delete the records the ProSolution WP Client WordPress plugin before 2.0.9 stores.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Prosolution Wordpress
Products
Prosolution Wp Client Wordpress
CVE-2026-15229

Pinpoint Booking System <= 2.9.9.7.1 - Unauthenticated Arbitrary Booking Price Manipulation

The Pinpoint Booking System WordPress plugin through 2.9.9.7.1 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pinpoint Wordpress
Products
Pinpoint Booking System Wordpress
CVE-2026-17023

Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Google Calendar connection tokens with attacker-controlled ones and hijack the integration. Exploitation requires the site to have configured its own Google OAuth client for the calendar feature.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Salonbookingsystem Wordpress
Products
Salon Booking System Wordpress
CVE-2026-19077

Copy & Delete Posts < 1.5.5 - Authenticated Arbitrary Post Deletion via Missing Object-Level Authorization

The Duplicate Post WordPress plugin before 1.5.5 does not perform per-object authorisation checks in its bulk copy and delete operations, allowing any user whose role an administrator has granted Duplicate Post WordPress plugin before 1.5.5 access to permanently delete arbitrary posts on the site, including those belonging to other users.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Duplicate Post Project Wordpress
Products
Duplicate Post Wordpress
CVE-2026-68088

usb: gadget: function: rndis: add length check to response query

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: function: rndis: add length check to response query Add variable representations for BufLength and BufOffset in rndis_query_response(), and perform a length check on them. This is identical to how rndis_set_response() handles these parameters.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel
CVE-2026-68114

drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON()

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12.1: replace BUG_ON() with WARN_ON() There's no need to crash the kernel for these cases. (cherry picked from commit e4d99e04b2e9b13b97d3b17804c735f62689db23)

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Linux
Products
Linux Kernel