Browse CVEs

CRITICAL 9.1 CVE-2026-44091 An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system conf… Mitigation only Fix from $2,3002026-07-30 CRITICAL 9.8 CVE-2026-44090 Due to missing authentication, an unauthenticated remote attacker may access the MQTT broker, which is only protected from external access by a firew… No fix yet Fix from $2,3002026-07-30 HIGH 7.1 CVE-2026-13584 Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in Mitsubishi Electric MELSEC MX Controller MX… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.3 CVE-2026-64635 Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to … No fix yet Fix from $1,6002026-07-30 CRITICAL 9.9 CVE-2026-58046 Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data f… No fix yet Fix from $2,3002026-07-30 HIGH 7.5 CVE-2026-58043 A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an atta… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.3 CVE-2026-58040 An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix … No fix yet Fix from $1,6002026-07-30 HIGH 8.3 CVE-2026-47882 When enabling Spring Boot DevTools support for a remote application target (for example a Docker container or Cloud Foundry app) from the Spring Tool… No fix yet Fix from $1,9502026-07-30 HIGH 8.0 CVE-2026-47873 The Boot Dashboard Docker integration in Spring Tools publishes container control ports on all of the host's network interfaces (0.0.0.0) rather than… No fix yet Fix from $1,9502026-07-30 HIGH 8.0 CVE-2026-47858 Starting Spring Boot applications in the Spring Tools with the live information mode enabled makes the running application vulnerable against JMX-bas… No fix yet Fix from $1,9502026-07-30 MEDIUM 5.3 CVE-2026-16531 An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.5 CVE-2026-16530 A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` functio… No fix yet Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-16529 A signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. Th… No fix yet Fix from $1,9502026-07-30 HIGH 7.3 CVE-2026-16527 An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacke… No fix yet Fix from $1,9502026-07-30 HIGH 8.8 CVE-2026-16526 A flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate… No fix yet Fix from $1,9502026-07-30 HIGH 7.8 CVE-2026-16524 A command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed valid… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.5 CVE-2026-15382 The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's cu… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-15257 The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing ac… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-15255 The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the ident… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2026-15252 The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authentic… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-15250 The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its p… No fix yet Fix from $1,6002026-07-30 HIGH 7.5 CVE-2026-15240 The Customer Switching WordPress plugin before 2.1.3 does not securely bind an active user-switching session to the operator who initiated it, allowi… No fix yet Fix from $1,9502026-07-30 MEDIUM 6.8 CVE-2026-15153 The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a … No fix yet Fix from $1,6002026-07-30 MEDIUM 6.5 CVE-2026-14923 The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and u… No fix yet Fix from $1,6002026-07-30 HIGH 7.1 CVE-2026-14239 The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and do… No fix yet Fix from $1,9502026-07-30 CRITICAL 9.0 CVE-2026-14602 The Remote API WordPress plugin through 0.2 does not authenticate a request before deserializing user-supplied input, allowing unauthenticated attack… No fix yet Fix from $2,3002026-07-30 MEDIUM 6.1 CVE-2026-14592 The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option v… No fix yet Fix from $1,6002026-07-30 MEDIUM 6.8 CVE-2026-14318 The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.4 CVE-2026-14310 The Tutor LMS WordPress plugin before 4.0.0 does not properly verify that a user has access to the course a Q&A thread belongs to before returning o… No fix yet Fix from $1,6002026-07-30 MEDIUM 5.3 CVE-2026-14305 The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users t… No fix yet Fix from $1,6002026-07-30