Browse CVEs

CRITICAL 10.0 CVE-2026-11976 The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) … No fix yet Fix from $2,3002026-08-06 HIGH 7.8 CVE-2026-11803 A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage thi… No fix yet Fix from $1,9502026-08-06 MEDIUM 5.9 CVE-2026-11361 The Formidable Forms WordPress plugin before 6.32.1 does not properly validate the status of a PayPal subscription payment before marking it complete… No fix yet Fix from $1,6002026-08-06 HIGH 7.5 CVE-2026-10599 The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the order bein… No fix yet Fix from $1,9502026-08-06 HIGH 7.5 CVE-2026-10524 The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the c… No fix yet Fix from $1,9502026-08-06 CRITICAL 9.0 CVE-2025-14561 In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing suffici… No fix yet Fix from $2,3002026-08-06 MEDIUM 5.0 CVE-2025-12317 When internal roles are removed from a user within the WSO2 product, the system fails to invalidate any previously issued authentication tokens assoc… No fix yet Fix from $1,6002026-08-06 HIGH 8.8 CVE-2024-39024 In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution. No fix yet Fix from $1,9502026-08-06 MEDIUM 6.8 CVE-2024-6541 The Class Mediator fails to correctly validate or sanitize `messageContext` properties when they are used to populate dynamic values. This allows aut… No fix yet Fix from $1,6002026-08-06 HIGH 8.2 CVE-2026-5423 @neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL su… No fix yet Fix from $1,9502026-08-06 HIGH 8.6 CVE-2026-3430 The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unaut… No fix yet Fix from $1,9502026-08-06 MEDIUM 5.3 CVE-2026-19047 A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src… No fix yet Fix from $1,6002026-08-06 HIGH 7.5 CVE-2026-18427 @fastify/static before version 10.1.3 contains an incomplete fix for a previous route guard bypass. The static file handler rejected only parent dire… No fix yet Fix from $1,9502026-08-06 MEDIUM 5.9 CVE-2026-70637 LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing L… No fix yet Fix from $1,6002026-08-06 HIGH 7.5 CVE-2026-66712 Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. No fix yet Fix from $1,9502026-08-06 HIGH 7.1 CVE-2026-66711 Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. No fix yet Fix from $1,9502026-08-06 HIGH 8.1 CVE-2026-66710 Unauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions. No fix yet Fix from $1,9502026-08-06 CRITICAL 9.1 CVE-2026-66709 Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. No fix yet Fix from $2,3002026-08-06 HIGH 8.2 CVE-2026-66708 Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. No fix yet Fix from $1,9502026-08-06 HIGH 7.1 CVE-2026-66707 Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. No fix yet Fix from $1,9502026-08-06 MEDIUM 5.9 CVE-2026-66706 Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. No fix yet Fix from $1,6002026-08-06 HIGH 7.1 CVE-2026-66705 Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. No fix yet Fix from $1,9502026-08-06 MEDIUM 6.5 CVE-2026-66703 Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. No fix yet Fix from $1,6002026-08-06 HIGH 7.1 CVE-2026-66702 Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions. No fix yet Fix from $1,9502026-08-06 MEDIUM 5.3 CVE-2026-66701 Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions. No fix yet Fix from $1,6002026-08-06 MEDIUM 5.3 CVE-2026-66699 Custom role Broken Access Control in Dokan <= 5.0.10 versions. No fix yet Fix from $1,6002026-08-06 MEDIUM 6.5 CVE-2026-66695 Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions. No fix yet Fix from $1,6002026-08-06 HIGH 7.1 CVE-2026-66694 Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. No fix yet Fix from $1,9502026-08-06 HIGH 7.1 CVE-2026-66690 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. No fix yet Fix from $1,9502026-08-06 MEDIUM 6.5 CVE-2026-66688 Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions. No fix yet Fix from $1,6002026-08-06