Search vulnerabilities

Expected end of text, found '/' (at char 41), (line:1, col:42)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,892

CVE-2026-65536

WordPress افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) plugin <= 4.4.5 - Cross Site Request Forgery (CSRF) vulnerability

Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Mahdi Yousefi Wordpress
Products
افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) Wordpress
CVE-2026-65550

WordPress Tabs plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability

Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpshopmart
Products
Wordpress Tabs
CVE-2026-61945

WordPress WooCommerce Product Stock Alert plugin <= 3.0.6 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Multivendorx Wordpress
Products
Woocommerce Product Stock Alert Wordpress
CVE-2026-16733

bahmutov find-cypress-specs Branch index.js shell.exec os command injection

A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the component Branch Handler. This manipulation of the argument --branch causes os command injection. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS 1.1% KEV · Not listed
Vendors
Bahmutov
Products
Find-cypress-specs
CVE-2026-8287

Unrestricted File Upload in BizimHesap Information Systems' Online Pre-Accounting Software

Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software allows Excessive Allocation. This issue affects Online Pre-Accounting Software: through 17072026.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Bizimhesap Information Systems Industry And Trade
Products
Online Pre-accounting Software
CVE-2026-27403

WordPress Hubbub Lite plugin <= 1.36.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Nerdpress Wordpress
Products
Hubbub Lites Wordpress
CVE-2026-62210

OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce availability.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-62234

Grav < 2.0.4 SSRF via Unrestricted cURL Protocols

Grav before 2.0.4 fails to restrict cURL protocols in webhook dispatch, allowing authenticated users with api.webhooks.write permission to create webhooks with file://, dict://, or gopher:// URLs. Attackers can trigger webhook events to read local files, access process information, or pivot to internal services via unrestricted protocol handlers.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav
CVE-2026-62216

OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload

OpenClaw 2026.4.20 before 2026.5.28 contain a policy bypass in the QQBot media upload feature. A lower-trust caller or configured input path could cause the media upload to reach network destinations that should have been blocked by OpenClaw policy (server-side request forgery). The practical impact depends on the operator's configuration and whether lower-trust input can reach that path.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-62386

Grav < 1.0.0-rc.16 Authentication Bypass via token URL Parameter

The Grav API plugin (getgrav/grav-plugin-api) before 1.0.0-rc.16 accepts JWT access tokens through the ?token= URL query parameter on every API route (JwtAuthenticator::extractBearerToken fallback). Because tokens are embedded in URLs, they are logged verbatim in web server access logs, leaked via the Referer header, stored in browser history, and captured by upstream proxy and CDN logs, exposing valid admin access tokens. A leaked token grants unauthorized API access, including reading configuration and user data, creating admin accounts, modifying system settings, and deleting pages.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Getgrav
Products
Grav