Browse CVEs

CRITICAL 9.1 CVE-2026-14488 The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission exten… No fix yet Fix from $2,3002026-07-29 HIGH 7.1 CVE-2026-12895 SQL injection in Frappe's ERPNext, versions ERPNext 15.107.0 and Frappe 15.107.2. The application constructs SQL queries through direct string interp… No fix yet Fix from $1,9502026-07-29 MEDIUM 6.5 CVE-2026-18207 A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of … Build Of Keycloak No fix yet Fix from $1,6002026-07-29 MEDIUM 5.5 CVE-2026-18201 Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator w… Build Of Keycloak No fix yet Fix from $1,6002026-07-29 CRITICAL 9.8 CVE-2025-10656 The Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin for WordPress is vulnerable to Missing Authorization in all versions u… No fix yet Fix from $2,3002026-07-29 HIGH 8.8 CVE-2026-64557 In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() l2cap_so… Mitigation only Fix from $1,9502026-07-29 HIGH 7.8 CVE-2026-64556 In the Linux kernel, the following vulnerability has been resolved: perf/core: Detach event groups during remove_on_exec perf_event_remove_on_exec(… No fix yet Fix from $1,9502026-07-29 HIGH 7.2 CVE-2026-13425 The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and includi… No fix yet Fix from $1,9502026-07-29 MEDIUM 6.5 CVE-2026-35226 An out‑of‑bounds write vulnerability in the CODESYS PROFINET Controller allows an unauthenticated attacker on the same network segment to send malfor… No fix yet Fix from $1,6002026-07-29 MEDIUM 6.5 CVE-2026-18192 VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversa… No fix yet Fix from $1,6002026-07-29 CRITICAL 9.8 CVE-2026-18191 VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden fu… Mitigation only Fix from $2,3002026-07-29 MEDIUM 5.4 CVE-2026-63239 A hard-coded AWS IAM credentials vulnerability in Koollab LMS allowed an attacker to access shared multi-tenant S3 buckets and SQS queues, exposing s… No fix yet Fix from $1,6002026-07-29 MEDIUM 6.5 CVE-2026-63238 An authentication bypass vulnerability in Koollab LMS allowed an unauthenticated attacker to take over any account, including administrator accounts,… No fix yet Fix from $1,6002026-07-29 CRITICAL 9.9 CVE-2026-63234 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the manual mark assessmen… No fix yet Fix from $2,3002026-07-29 CRITICAL 9.9 CVE-2026-63233 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment overall an… Mitigation only Fix from $2,3002026-07-29 CRITICAL 9.9 CVE-2026-63232 A SQL injection and unsafe deserialisation vulnerability in Koollab LMS allowed an authenticated attacker to inject through the assessment reinforcem… No fix yet Fix from $2,3002026-07-29 HIGH 8.1 CVE-2026-63231 A post-authentication SQL injection vulnerability in Koollab LMS allowed an authenticated attacker to use an error-based SQL oracle via the face-to-f… No fix yet Fix from $1,9502026-07-29 CRITICAL 9.1 CVE-2026-63230 A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, … No fix yet Fix from $2,3002026-07-29 CRITICAL 9.1 CVE-2026-63229 A pre-authentication blind SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to use a time-based SQL oracle via the SSO … Mitigation only Fix from $2,3002026-07-29 HIGH 8.1 CVE-2026-14300 The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by i… No fix yet Fix from $1,9502026-07-29 HIGH 7.1 CVE-2026-14234 The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker… No fix yet Fix from $1,9502026-07-29 CRITICAL 9.9 CVE-2026-63227 An unrestricted SCORM file upload vulnerability in Koollab LMS allowed an authenticated module designer to upload a SCORM package containing a PHP we… No fix yet Fix from $2,3002026-07-29 MEDIUM 5.4 CVE-2026-14224 The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the… No fix yet Fix from $1,6002026-07-29 MEDIUM 5.3 CVE-2026-13692 The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing… No fix yet Fix from $1,6002026-07-29 HIGH 7.4 CVE-2026-13690 The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attac… No fix yet Fix from $1,9502026-07-29 MEDIUM 6.8 CVE-2026-13605 The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into th… No fix yet Fix from $1,6002026-07-29 CRITICAL 9.8 CVE-2026-13423 The Streamit WordPress theme through 4.5.0 does not perform any authorization or nonce verification on one of its unauthenticated AJAX routes, which … No fix yet Fix from $2,3002026-07-29 HIGH 8.6 CVE-2026-11974 The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two A… No fix yet Fix from $1,9502026-07-29 MEDIUM 5.3 CVE-2026-11351 The ShinyStat Analytics WordPress plugin before 1.0.17 does not perform any authorization check on one of its REST API endpoints, allowing unauthenti… No fix yet Fix from $1,6002026-07-29 CRITICAL 9.8 CVE-2026-18072 The Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … plugin for WordPress is vulnerable to Authentication Bypass via a H… No fix yet Fix from $2,3002026-07-29