Browse CVEs

CRITICAL 10.0 CVE-2026-11756 A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Re… No fix yet Fix from $2,3002026-07-28 HIGH 8.2 CVE-2024-14041 In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modu… Patch available Fix from $1,9502026-07-28 MEDIUM 6.5 CVE-2026-6251 The Chaty Pro plugin for WordPress is vulnerable to Authenticated Time-Based Blind SQL Injection in versions up to and including 3.5.5. This is due t… No fix yet Fix from $1,6002026-07-28 HIGH 7.2 CVE-2026-16585 The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to arbitrary file deletion due to in… No fix yet Fix from $1,9502026-07-28 MEDIUM 5.3 CVE-2026-15012 The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, an… No fix yet Fix from $1,6002026-07-28 HIGH 7.5 CVE-2026-14924 The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allo… No fix yet Fix from $1,9502026-07-28 HIGH 7.1 CVE-2026-14870 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before refl… No fix yet Fix from $1,9502026-07-28 CRITICAL 9.8 CVE-2026-14545 The TrueBooker WordPress plugin before 1.2.4 does not validate account ownership when resetting a user's password through one of its front-end accou… No fix yet Fix from $2,3002026-07-28 HIGH 7.5 CVE-2026-14490 The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to… No fix yet Fix from $1,9502026-07-28 MEDIUM 5.3 CVE-2026-12124 The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauth… No fix yet Fix from $1,6002026-07-28 MEDIUM 6.1 CVE-2026-17528 Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a mal… Patch available Fix from $1,6002026-07-28 HIGH 7.5 CVE-2026-17524 Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extractio… Patch available Fix from $1,9502026-07-28 HIGH 7.5 CVE-2026-66473 Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. No fix yet Fix from $1,9502026-07-27 MEDIUM 6.5 CVE-2026-65448 Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1 versions. No fix yet Fix from $1,6002026-07-27 HIGH 7.1 CVE-2026-65447 Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65446 Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. No fix yet Fix from $1,9502026-07-27 MEDIUM 6.5 CVE-2026-65445 Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. No fix yet Fix from $1,6002026-07-27 HIGH 7.1 CVE-2026-65443 Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.2 CVE-2026-65442 Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65441 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. No fix yet Fix from $1,9502026-07-27 MEDIUM 6.1 CVE-2026-51565 Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web scr… No fix yet Fix from $1,6002026-07-27 HIGH 7.1 CVE-2026-65440 Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65439 Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65438 Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65437 Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-61957 Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.2 CVE-2026-61953 Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.5 CVE-2025-63913 An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and co… No fix yet Fix from $1,9502026-07-27 MEDIUM 6.9 CVE-2026-59240 The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notifi… Patch available Fix from $1,6002026-07-27 HIGH 7.5 CVE-2026-55685 React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests t… React Router 7.18.0+ Fix from $1,9502026-07-27