Browse CVEs

MEDIUM 5.3 CVE-2026-54199 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to HTTP header injection through the request body in the application's link storing function… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.3 CVE-2026-12071 The Webbox of TeamDavid by Tobit Laboratories AG constructs redirect URLs using user-supplied input, which is appended to the redirect target in a 3… No fix yet Fix from $1,6002026-08-07 HIGH 8.4 CVE-2026-12070 Tobit Laboratories AG TeamDavid's Webbox is vulnerable to an arbitrary file deletion vulnerability in the send email, fax, SMS, etc. functionality.… No fix yet Fix from $1,9502026-08-07 HIGH 8.8 CVE-2026-9169 DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges … No fix yet Fix from $1,9502026-08-07 MEDIUM 6.4 CVE-2026-66493 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move ac… No fix yet Fix from $1,6002026-08-07 MEDIUM 6.1 CVE-2026-66492 Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action le… No fix yet Fix from $1,6002026-08-07 HIGH 8.2 CVE-2026-66491 Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an … No fix yet Fix from $1,9502026-08-07 MEDIUM 6.5 CVE-2026-49008 By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific a… No fix yet Fix from $1,6002026-08-07 MEDIUM 6.2 CVE-2026-18938 A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerabil… No fix yet Fix from $1,6002026-08-07 HIGH 7.5 CVE-2026-49007 By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface. No fix yet Fix from $1,9502026-08-07 MEDIUM 5.3 CVE-2026-49006 By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission. No fix yet Fix from $1,6002026-08-07 MEDIUM 5.4 CVE-2026-16027 Server-Side request forgery (SSRF) vulnerability in Revenue Administration Türkiye's E-Signature allows Server Side Request Forgery. This issue affe… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.3 CVE-2026-15239 The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin before 1.42.0 does not bind its Turnstile validation cache to the single-use challenge … No fix yet Fix from $1,6002026-08-07 MEDIUM 5.9 CVE-2026-15211 The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not validate the payment amount or bind the PayPal order token to the order bein… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.3 CVE-2026-15148 The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merch… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.3 CVE-2026-12261 A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts pa… No fix yet Fix from $1,6002026-08-07 HIGH 7.3 CVE-2026-19196 A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.5 CVE-2026-16265 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not restrict the operation it disp… No fix yet Fix from $1,6002026-08-07 HIGH 8.8 CVE-2026-16263 The WP Maps WordPress plugin before 4.9.7 does not perform a capability check in one of its AJAX actions and does not properly validate a user-contr… No fix yet Fix from $1,9502026-08-07 HIGH 7.5 CVE-2026-16262 The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an un… No fix yet Fix from $1,9502026-08-07 CRITICAL 9.8 CVE-2026-16258 The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to p… No fix yet Fix from $2,3002026-08-07 HIGH 7.5 CVE-2026-16041 The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route,… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.5 CVE-2026-16039 The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated us… No fix yet Fix from $1,6002026-08-07 CRITICAL 9.1 CVE-2026-16038 The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its… No fix yet Fix from $2,3002026-08-07 HIGH 8.1 CVE-2026-16030 The MStore API WordPress plugin before 4.21.0 does not correctly verify the cryptographic signature of the token used to authenticate its phone-base… No fix yet Fix from $1,9502026-08-07 MEDIUM 5.4 CVE-2026-15386 The Meow Gallery WordPress plugin before 5.5.2 does not escape an attachment's alt text before outputting it into an attribute of the link it builds … No fix yet Fix from $1,6002026-08-07 HIGH 8.1 CVE-2026-15361 The Content Views WordPress plugin before 4.5 does not perform a capability check on one of its AJAX actions and does not properly sanitise attacker… No fix yet Fix from $1,9502026-08-07 MEDIUM 6.5 CVE-2026-15359 The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers… No fix yet Fix from $1,6002026-08-07 MEDIUM 5.4 CVE-2026-15245 The BNE Testimonials WordPress plugin before 2.0.8.2 does not properly escape a shortcode attribute for a JavaScript context before echoing it into a… No fix yet Fix from $1,6002026-08-07 HIGH 8.8 CVE-2026-15215 The Subscriptions for WooCommerce WordPress plugin before 2.0.1 does not verify the user's capability before installing and activating a Subscription… No fix yet Fix from $1,9502026-08-07