Browse CVEs

HIGH 8.8 CVE-2026-15212 The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_S… No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-12353 An unauthenticated attacker could trigger an Out of Memory condition to crash the Java process for RHCS by repeatedly sending HTTP requests to the TL… No fix yet Fix from $1,6002026-07-23 HIGH 7.5 CVE-2026-16756 Missing connection and header-read timeouts and the absence of a concurrent-connection cap in the default serve() path of Amazon aws-smithy-http-serv… No fix yet Fix from $1,9502026-07-23 CRITICAL 10.0 CVE-2026-6516 Zohocorp ManageEngine ADAudit Plus versions before 8606 are affected by Unauthenticated Remote code execution due to the vulnerable agent API. No fix yet Fix from $2,3002026-07-23 MEDIUM 5.1 CVE-2026-65763 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vul… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.1 CVE-2026-65762 Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XS… No fix yet Fix from $1,6002026-07-23 HIGH 8.6 CVE-2026-65702 Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persistence integration that allows unauthenticated re… No fix yet Fix from $1,9502026-07-23 CRITICAL 9.1 CVE-2026-65701 SoftVC VITS Singing Voice Conversion through commit 730930d contains a path traversal vulnerability in the full-song inference server that allows una… No fix yet Fix from $2,3002026-07-23 CRITICAL 9.8 CVE-2026-65700 h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read,… No fix yet Fix from $2,3002026-07-23 MEDIUM 6.5 CVE-2026-47755 ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged auth… No fix yet Fix from $1,6002026-07-23 CRITICAL 9.9 CVE-2026-47752 Tugtainer is a self-hosted app for automating updates of Docker containers. Versions prior to 1.30.2 are vulnerable to Server-Side Template Injection… No fix yet Fix from $2,3002026-07-23 CRITICAL 10.0 CVE-2026-47668 DbGate is cross-platform database manager. In versions 7.1.8 and prior, DbGate's JSON script runner (`POST /runners/start`) allows remote code execut… No fix yet Fix from $2,3002026-07-23 CRITICAL 9.3 CVE-2026-65761 Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead … No fix yet Fix from $2,3002026-07-23 CRITICAL 9.2 CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access ch… No fix yet Fix from $2,3002026-07-23 HIGH 8.7 CVE-2026-65759 Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment informatio… No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-65698 Void through 1.3.4 contains a path traversal vulnerability in the AI agent file-reading tools that allows network-adjacent attackers to read arbitrar… No fix yet Fix from $1,6002026-07-23 MEDIUM 6.1 CVE-2026-65697 Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attac… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-65696 Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenti… No fix yet Fix from $1,6002026-07-23 MEDIUM 6.8 CVE-2026-65695 Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filen… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.3 CVE-2026-16768 A flaw was found in gdk-pixbuf. When parsing a specially crafted ICO file with pixel values that exceed the defined palette range, an out-of-bounds r… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48539 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authent… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48538 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48537 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated … No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48536 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated a… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48535 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated … No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48534 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers t… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48532 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authent… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48531 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attack… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.4 CVE-2026-48530 GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated at… No fix yet Fix from $1,6002026-07-23 HIGH 7.0 CVE-2026-16584 Improper handling of an initialization failure in AWS API MCP Server from 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured se… No fix yet Fix from $1,9502026-07-23