Browse CVEs

MEDIUM 5.3 CVE-2026-12495 Denial-of-service (DoS) vulnerability due to a stack buffer overflow in the http_gdpr_decrypt function of the Mercusys MB115-4G device's web interfac… No fix yet Fix from $1,6002026-07-27 HIGH 7.7 CVE-2026-17527 In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, include… No fix yet Fix from $1,9502026-07-27 MEDIUM 6.9 CVE-2026-65765 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download action… No fix yet Fix from $1,6002026-07-27 MEDIUM 5.1 CVE-2026-65764 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XS… No fix yet Fix from $1,6002026-07-27 MEDIUM 5.1 CVE-2026-16554 cJSON library is vulnerable to an integer overflow in the print_string_ptr() function in cJSON.c on 32-bit platforms. The escape_characters counter, … No fix yet Fix from $1,6002026-07-27 HIGH 8.7 CVE-2026-65894 This vulnerability exists in CP PLUS EZ-P21 IP Camera due to improper authentication of HTTP endpoints. A remote attacker could exploit this vulnerab… No fix yet Fix from $1,9502026-07-27 HIGH 7.0 CVE-2026-65893 This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access cou… No fix yet Fix from $1,9502026-07-27 HIGH 8.1 CVE-2026-64536 In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_… No fix yet Fix from $1,9502026-07-27 CRITICAL 9.8 CVE-2026-64535 In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnera… No fix yet Fix from $2,3002026-07-27 CRITICAL 9.8 CVE-2026-64534 In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nv… No fix yet Fix from $2,3002026-07-27 HIGH 7.8 CVE-2026-64533 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts D… No fix yet Fix from $1,9502026-07-27 HIGH 7.8 CVE-2026-64532 In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In d… No fix yet Fix from $1,9502026-07-27 HIGH 7.8 CVE-2026-64531 In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores gene… No fix yet Fix from $1,9502026-07-27 HIGH 7.8 CVE-2026-14837 Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local atta… No fix yet Fix from $1,9502026-07-27 HIGH 8.2 CVE-2026-9830 The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in… Mitigation only Fix from $1,9502026-07-27 MEDIUM 6.8 CVE-2026-14827 The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a p… No fix yet Fix from $1,6002026-07-27 MEDIUM 5.3 CVE-2026-14820 The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end … No fix yet Fix from $1,6002026-07-27 MEDIUM 6.5 CVE-2026-14568 The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 do… No fix yet Fix from $1,6002026-07-27 CRITICAL 9.0 CVE-2026-14289 The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection i… No fix yet Fix from $2,3002026-07-27 HIGH 7.5 CVE-2026-14235 The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, maki… No fix yet Fix from $1,9502026-07-27 MEDIUM 6.1 CVE-2026-14190 The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticate… No fix yet Fix from $1,6002026-07-27 HIGH 7.1 CVE-2026-13726 The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated a… No fix yet Fix from $1,9502026-07-27 CRITICAL 9.8 CVE-2026-13714 The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload fun… No fix yet Fix from $2,3002026-07-27 CRITICAL 9.1 CVE-2026-13597 The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it disc… No fix yet Fix from $2,3002026-07-27 MEDIUM 6.1 CVE-2026-13400 Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root caus… No fix yet Fix from $1,6002026-07-27 MEDIUM 5.3 CVE-2026-13390 The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes an… No fix yet Fix from $1,6002026-07-27 CRITICAL 9.1 CVE-2026-13332 The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user session… No fix yet Fix from $2,3002026-07-27 HIGH 8.1 CVE-2026-13152 The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to th… No fix yet Fix from $1,9502026-07-27 MEDIUM 6.1 CVE-2026-12982 The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an u… No fix yet Fix from $1,6002026-07-27 HIGH 7.5 CVE-2026-12493 The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually… No fix yet Fix from $1,9502026-07-27