Browse CVEs

CRITICAL 9.1 CVE-2026-15617 Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via ca… No fix yet Fix from $2,3002026-07-23 CRITICAL 9.1 CVE-2026-15616 Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized … No fix yet Fix from $2,3002026-07-23 HIGH 7.5 CVE-2026-15615 Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitel… No fix yet Fix from $1,9502026-07-23 HIGH 7.5 CVE-2026-15614 Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window. No fix yet Fix from $1,9502026-07-23 CRITICAL 9.1 CVE-2026-15612 Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session… No fix yet Fix from $2,3002026-07-23 CRITICAL 9.1 CVE-2026-15611 Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and … No fix yet Fix from $2,3002026-07-23 MEDIUM 5.2 CVE-2026-11804 Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterp… No fix yet Fix from $1,6002026-07-23 HIGH 7.7 CVE-2026-43820 NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backe… No fix yet Fix from $1,9502026-07-23 HIGH 7.5 CVE-2026-43823 When initializing an RSA public key from DER or PEM bytes throws an error, the EVP_PKEY* is double-freed: first in the catch block, then in the deini… No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-16735 A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file in… No fix yet Fix from $1,6002026-07-23 MEDIUM 5.3 CVE-2026-16733 A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js… No fix yet Fix from $1,6002026-07-23 CRITICAL 9.1 CVE-2026-65907 In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible No fix yet Fix from $2,3002026-07-23 MEDIUM 5.9 CVE-2026-65550 Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. No fix yet Fix from $1,6002026-07-23 HIGH 7.1 CVE-2026-65540 Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. No fix yet Fix from $1,9502026-07-23 HIGH 7.1 CVE-2026-65539 Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. No fix yet Fix from $1,9502026-07-23 MEDIUM 5.9 CVE-2026-65538 Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65536 Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 5.9 CVE-2026-65534 Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65533 Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. No fix yet Fix from $1,6002026-07-23 HIGH 7.6 CVE-2026-65532 Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-65529 Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65528 Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65527 Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. No fix yet Fix from $1,6002026-07-23 HIGH 8.5 CVE-2026-65526 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection… No fix yet Fix from $1,9502026-07-23 MEDIUM 5.3 CVE-2026-65525 Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65522 Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 5.3 CVE-2026-65521 Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65519 Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. No fix yet Fix from $1,6002026-07-23 MEDIUM 6.5 CVE-2026-65518 Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions. No fix yet Fix from $1,6002026-07-23 HIGH 7.2 CVE-2026-65516 Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. No fix yet Fix from $1,9502026-07-23