Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| nocodb | CVE-2026-126270 NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and… |
6,9 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| nocodb | CVE-2026-126271 NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key,… |
8,3 | 0,23 % | Brak wpisu w KEV nie wyklucza ataków | |
| Chatterbug Forms – Fast, Flexible WordPress Form Builder | CVE-2026-125055 The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.0.2 via the cbforms_check_form_submissions function. This is due to missing server-side file extension validation in… |
9,8 | 1,03 % | Brak wpisu w KEV nie wyklucza ataków | |
| Passster – Password Protect Pages and Content | CVE-2026-125409 The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping.… |
6,4 | 0,29 % | Brak wpisu w KEV nie wyklucza ataków | |
| Recipe Card Blocks Lite | CVE-2026-125948 The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
6,4 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| WPZOOM Addons for Elementor – Starter Templates & Widgets | CVE-2026-126029 The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versions up to, and including, 1.4.20 due to… |
6,4 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| siyuan | CVE-2026-126264 SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced… |
7,7 | 0,35 % | Brak wpisu w KEV nie wyklucza ataków | |
| EZ SQL Reports Shortcode Widget and DB Backup | CVE-2026-120688 The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to… |
7,2 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| Customer Reviews for WooCommerce | CVE-2026-121518 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on… |
5,3 | 0,54 % | Brak wpisu w KEV nie wyklucza ataków | |
| Newsletters | CVE-2026-122063 The Newsletters plugin for WordPress is vulnerable to blind SQL Injection via the 'user_email' parameter in all versions up to, and including, 4.18.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for… |
6,5 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| Easy Property Listings | CVE-2026-122227 The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in all versions up to, and including, 3.5.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it… |
6,5 | 0,45 % | Brak wpisu w KEV nie wyklucza ataków | |
| SureDash – Community, Courses & Member Dashboard | CVE-2026-123769 The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.13.0 This is due to the `save_settings()` REST handler at `/suredash/v1/save-settings` being gated only by `admin_permission_callback()`, which… |
8,8 | 0,43 % | Brak wpisu w KEV nie wyklucza ataków | |
| Drag and Drop File Upload for Elementor Forms | CVE-2026-124218 The Drag and Drop File Upload for Elementor Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the remove_files function in all versions up to, and including, 1.6.2 This makes it possible for unauthenticated attackers to delete arbitrary… |
8,2 | 0,99 % | Brak wpisu w KEV nie wyklucza ataków | |
| Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery | CVE-2026-118191 The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_job function in all versions up to, and including, 4.5.5 This makes it possible for authenticated attackers, with… |
8,1 | 0,99 % | Brak wpisu w KEV nie wyklucza ataków | |
| PowerPress Podcasting plugin by Blubrry | CVE-2026-118587 The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
5,4 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| ELEX WordPress HelpDesk & Customer Ticketing System | CVE-2026-119077 The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is… |
9,8 | 1,34 % | Brak wpisu w KEV nie wyklucza ataków | |
| CF7 Apps – Addons for Contact Form 7 (Honeypot, Database, Redirection, Webhook, etc.) | CVE-2026-120547 The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient… |
4,4 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| WPeMatico RSS Feed Fetcher | CVE-2026-120573 The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
6,4 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| Download Manager | CVE-2026-120658 The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_previews][]' parameter in all versions up to, and including, 7.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with… |
6,4 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups | CVE-2026-115871 The WP STAGING – Backups & Restore, Migration & Clone Plugin – Cloud Backups, Scheduled Backups plugin for WordPress is vulnerable to Arbitrary Directory Deletion in all versions up to, and including, 4.19.0. This is due to insufficient path validation in the `cleanStagingDirectory` function,… |
2,7 | 0,4 % | Brak wpisu w KEV nie wyklucza ataków | |
| PowerScale InsightIQ | CVE-2026-116418 Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. |
7,5 | 0,3 % | Brak wpisu w KEV nie wyklucza ataków | |
| PowerScale InsightIQ | CVE-2026-116433 Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains a Missing Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. |
4,3 | 0,24 % | Brak wpisu w KEV nie wyklucza ataków | |
| Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker | CVE-2026-116509 The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via the 'qpages' parameter in all versions up to, and including, 11.2.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the… |
6,5 | 0,44 % | Brak wpisu w KEV nie wyklucza ataków | |
| WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping | CVE-2026-116614 The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to generic SQL Injection via the 'sourceId' parameter in all versions up to, and including, 2.24.1 due to insufficient escaping on the user supplied parameter and lack of… |
4,9 | 0,38 % | Brak wpisu w KEV nie wyklucza ataków | |
| Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets | CVE-2026-116615 The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter… |
8,8 | 0,88 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 03:02 UTC – 15.11.2026, 08:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.