Search vulnerabilities

Expected end of text, found '/' (at char 32), (line:1, col:33)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,979

CVE-2026-57800

WordPress Overworld theme <= 1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Overworld overworld allows PHP Local File Inclusion.This issue affects Overworld: from n/a through <= 1.5.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-61955

WordPress گرویتی فرم فارسی plugin <= 3.0.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Hannan Wordpress
Products
گرویتی فرم فارسی Wordpress
CVE-2026-61956

WordPress ووسلام – همگام سازی ووکامرس و باسلام plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام &#8211; همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام &#8211; همگام سازی ووکامرس و باسلام: from n/a through <= 1.9.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Hamsalam Wordpress
Products
ووسلام &#8211; همگام سازی ووکامرس و باسلام Wordpress
CVE-2026-61970

WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 5.0.4 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Themeisle Wordpress
Products
Auto Featured Image (auto Post Thumbnail) Wordpress
CVE-2026-57810

WordPress APIExperts Square for WooCommerce plugin <= 4.7.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal APIExperts Square for WooCommerce woosquare allows Blind SQL Injection.This issue affects APIExperts Square for WooCommerce: from n/a through <= 4.7.4.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Saad Iqbal Wordpress
Products
Apiexperts Square For Woocommerce Wordpress
CVE-2026-61977

WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Crocoblock Wordpress
Products
Jetsearch Wordpress
CVE-2026-61985

WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Magepeopleteam Wordpress
Products
Car Rental Manager Wordpress
CVE-2026-22093

Adversary-in-the-Middle (AitM) attack vulnerability in EVbee Service app

The EVbee Service Android app uses TLS encrypted communication (HTTPS), but does not validate the certificate provided by the server. This allows an attacker on the network path between the app and EVbee server to intercept and manipulate the communication between the app and server. The traffic is weakly encrypted using RC4 with a hardcoded key, which allows an attacker to gain access to the communication. Part of this communication involves access codes to charging stations. This issue affects EVbee Service: v1.4.101.00.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Evbee Service
CVE-2026-57816

WordPress Funnel Builder by FunnelKit plugin <= 3.15.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelKit Funnel Builder by FunnelKit funnel-builder allows Reflected XSS.This issue affects Funnel Builder by FunnelKit: from n/a through <= 3.15.0.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Funnelkit Wordpress
Products
Funnel Builder By Funnelkit Wordpress
CVE-2026-22095

Command injection in diagnosis web endpoint

The network diagnosis endpoint on the web server at port 8090 is vulnerable to command injection.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22100

Comnand injection in OCPP ReserveLogin message

The OCPP DataTransfer message `ReserveLogin` is vulnerable to command injection. By manipulating the data value, arbitrary OS commands can be executed as root.

CVSS 4.0 · 8.6 High EPSS 1.1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22096

Missing authentication for webserver endpoints

The webserver running on port 8090 does not require authentication. This allows for sensitive information leakage such as configured passwords, or uploading files through different endpoints.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22102

Arbitrary file overwrite through certificate update functionality

A POST request sent to a specific webserver endpoint can be used to write to arbitrary file locations. The endpoint accepts the filename parameter in the Content-Disposition header without verification. This can be used to cause a denial of service by overwriting system files, or remote-code-execution by overwriting shell-scripts which execution can be triggered through other means.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-61971

WordPress User Profile Picture plugin <= 2.6.3 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6.3.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Cozmoslabs Wordpress
Products
User Profile Picture Wordpress
CVE-2026-22099

Missing authentication for Bluetooth communication

The charging station does not require authentication for Bluetooth commands to perform actions. The functionality exposed includes sensitive information leakage, triggering reboots, or pushing a firmware update URL.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22097

Missing firmware validation allows remote code execution

The firmware update mechanism does not include cryptographic signature validation. This allows anyone with access to the firmware update capability to upload arbitrary files which can then lead to arbitrary code execution.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22098

Sensitive information is written to logs

Various sensitive information such as passwords and charging card UIDs are written to log files.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-22103

Command injection in NPC start web endpoint

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection.

CVSS 4.0 · 9.3 Critical EPSS 1.4% KEV · Not listed
Vendors
Evbee
Products
Dc-80
CVE-2026-14846

Incorrect neutralisation in the PrestaShop firmware

In version 8.2.1 of PrestaShop, there is a vulnerability relating to the incorrect sanitisation of elements, caused by inadequate validation of the ‘Alias’ parameter in the ‘Update your address’ function. This flaw allows an attacker to inject malicious expressions that are executed when the information is exported using the ‘Get my data in CSV’ tool. Successful exploitation of this vulnerability could facilitate unauthorised access to the victim’s personal data.

CVSS 4.0 · 4.5 Medium EPSS < 1% KEV · Not listed
Vendors
Prestashop
Products
The Firmware
CVE-2026-13014

Remote Code Execution vulnerability in "Suspicious" application

A vulnerability in Thales CERT "Suspicious" application =< 1.3.4 allows a remote and unauthenticated attacker to execute arbitrary code and arbitrarily overwrite writable application files—including Python modules, configuration files, cron inputs, and runtime artifacts—leading to a persistent denial of service, the potential compromise of application secrets or integrations, and root-level execution inside the Django application container. This vulnerability has been names "Matryoshka Mail". Thales PSIRT acknowledges and thanks Lucien Doustaly (aka wlayzz) for discovering and reporting this issue.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Thalesgroup
Products
Cert Suspicious