Search vulnerabilities

Expected end of text, found '\u200b' (at char 19), (line:1, col:20)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,910

CVE-2026-57494

AgenticMail: Cross-agent task authorization bypass in AgenticMail API

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Agenticmail
Products
Api
CVE-2026-57495

AgenticMail: Unauthenticated inbound mail triggers bypassPermissions resume of the operator's Claude Code session (bridge-wake)

AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher to resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding the attacker-controlled `from`/`subject`/`preview` verbatim into the prompt the resumed agent reads — an indirect prompt injection into a fully-privileged agent (Bash/Write/Edit/WebFetch + the agenticmail MCP toolbelt) running as the operator's OAuth identity. The sibling operator-query email-reply hook gates the same untrusted-From provenance with `isOperatorReplySender(replyFrom, config.operatorEmail)` (fail-closed); the bridge-wake path — a strictly higher-privilege effect — has no equivalent. @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71 contain a fix.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Agenticmail
Products
Agenticmail Claudecode Codex and 1 more
CVE-2026-16287

Root Command Injection via Offline Update in TÜBİTAK BİLGEM's pardus-update

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Tubitak Bilgem Software Technologies Research Institute
Products
Pardus Update
CVE-2026-11804

Program Module Vulnerability

Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Tridium
Products
Niagara Enterprise Security Niagara Framework
CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Joomshaper.com
Products
Easy Store Extension For Joomla
CVE-2026-65761

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions.

CVSS 4.0 · 9.3 Critical EPSS 1.0% KEV · Not listed
Vendors
Joomshaper.com
Products
Easy Store Extension For Joomla
CVE-2026-65759

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Joomshaper.com
Products
Easy Store Extension For Joomla
CVE-2026-65763

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Maps Extension For Joomla
CVE-2026-65762

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Phoca
Products
Phoca Guestbook Extension For Joomla
CVE-2026-12982

Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Dan Rossiter Wordpress
Products
Document Gallery Wordpress
CVE-2026-13400

Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Nsquared Wordpress
Products
Simply Schedule Appointments Wordpress
CVE-2026-13597

QRcode Login for WeChat <= 1.3 - Unauthenticated Account Takeover

The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Markchenlife Wordpress
Products
Qrcode-login-for-weixin Wordpress
CVE-2026-13714

Realtyna Organic IDX plugin + WPL Real Estate < 5.3.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution

The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Realtyna Wordpress
Products
Realtyna Organic Idx Plugin + Wpl Real Estate Wordpress
CVE-2026-13726

Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Mpg Wordpress
CVE-2026-14203

Smart Manager < 8.92.0 - Contributor+ Stored XSS via Post Title

The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Smart Manager Wordpress
Products
Smart Manager Wordpress
CVE-2026-14236

Contact Form 7 – PayPal & Stripe Add-on < 2.5 - Open Redirect

The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Scottpaterson Wordpress
Products
Contact Form 7 – Paypal & Stripe Add-on Wordpress
CVE-2026-14289

WP FacturaONE < 5.37 - Unauthenticated Remote Code Execution

The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Facturaone Para Woocommerce Con Verifactu Wordpress
Products
Facturaone Para Woocommerce Con Verifactu Wordpress
CVE-2026-48030

Pheditor: OS Command Injection in terminal handler via unsanitized 'dir' parameter (CWE-78)

Pheditor is a single-file editor and file manager written in PHP. From version 2.0.1 to before version 2.0.4, an OS Command Injection vulnerability in the terminal action handler allows any authenticated user to execute arbitrary OS commands by injecting shell metacharacters into the 'dir' POST parameter, completely bypassing the TERMINAL_COMMANDS whitelist and achieving full Remote Code Execution with web server privileges. This issue has been patched in version 2.0.4.

CVSS 3.1 · 9.9 Critical EPSS 7.5% KEV · Not listed
Vendors
Pheditor
Products
Pheditor