Search
43,411 CVEs
CVEs (43,411, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 476–500 of 43,411 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-15012 | MEDIUM | 5.3 | 2026-07-28 | The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via … | |
| CVE-2026-15136 | MEDIUM | 4.3 | 2026-07-28 | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.3.7. This i… | |
| CVE-2026-16585 | HIGH | 7.2 | 2026-07-28 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path va… | |
| CVE-2026-16587 | MEDIUM | 4.3 | 2026-07-28 | The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is d… | |
| CVE-2026-16797 | MEDIUM | 4.3 | 2026-07-28 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and … | |
| CVE-2026-16811 | MEDIUM | 4.9 | 2026-07-28 | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' parameter in all … | |
| CVE-2026-6251 | MEDIUM | 6.5 | 2026-07-28 | The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due to the fetch_custom_fiel… | |
| CVE-2024-14041 | HIGH | Patched | 5.9 | 2026-07-28 | In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, whic… |
| CVE-2026-11756 | CRITICAL | 10.0 | 2026-07-28 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R202… | |
| CVE-2026-12741 | HIGH | 7.5 | 2026-07-28 | The WP Fast Total Search – The Power of Indexed Search plugin for WordPress is vulnerable to generic SQL Injection via the 'form_data[s]' parameter in all versions up to, a… | |
| CVE-2026-15014 | CRITICAL | 9.8 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to Authentication Bypass leading to Account Take… | |
| CVE-2026-15670 | MEDIUM | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to time-based SQL Injection via the 'orderby' pa… | |
| CVE-2026-15671 | MEDIUM | 4.9 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via the 'id' parameter … | |
| CVE-2026-15673 | MEDIUM | 4.4 | 2026-07-28 | The SMS Alert – SMS & OTP for WooCommerce, Order Notifications & Abandoned Cart Recovery plugin for WordPress is vulnerable to generic SQL Injection via 'checkout_payment_p… | |
| CVE-2026-15730 | MEDIUM | 6.4 | 2026-07-28 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headi… | |
| CVE-2026-55977 | LOW | 3.3 | 2026-07-28 | Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing … | |
| CVE-2026-12800 | HIGH | 7.5 | 2026-07-28 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to SQL Injection via the 'code' parameter of the POST /wp-json/wpdmpp/v1/cart/coupo… | |
| CVE-2026-13161 | HIGH | 7.5 | 2026-07-28 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to generic SQL Injection via the 'alldata[truebooker_user]' parameter in all ve… | |
| CVE-2026-14167 | HIGH | 8.8 | 2026-07-28 | A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization. | |
| CVE-2026-14168 | HIGH | 8.8 | 2026-07-28 | A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full syst… | |
| CVE-2026-14169 | HIGH | 8.1 | 2026-07-28 | Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which cou… | |
| CVE-2026-14170 | NONE | — | 2026-07-28 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | |
| CVE-2026-14171 | MEDIUM | 6.1 | 2026-07-28 | An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a l… | |
| CVE-2026-14516 | HIGH | 7.5 | 2026-07-28 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to time-based SQL Injection via the 'staff_ids' parameter in all versions u… | |
| CVE-2026-15267 | MEDIUM | 6.5 | 2026-07-28 | The Taskbuilder – Project Management & Task Management Tool With Kanban Board plugin for WordPress is vulnerable to SQL Injection via the 'wppm_proj_filter' parameter in ve… |