KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for…
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping.…
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping.…
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping.…
The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the…
The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it…
The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping.…
The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized to perform an…
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host'…
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read.
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output…
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type…
In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header. Because the application incorrectly trusts this header, an attacker…
Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of parameterized queries allows an attacker to inject arbitrary SQL commands,…
A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations
In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol address length (ar_pln) fields of incoming ARP packets. in_arpreply()…
Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property, value) and where(property, operator, value), string/UUID-key lookup…
A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS.
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by…
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that…
Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through…
A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-78087 The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input… |
Pozostałe |
CVSS 6,4EPSS 0,19 % | ||
| CVE-2026-18548 The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including,… |
Monitoruj |
CVSS 7,2EPSS 0,29 % | ||
| CVE-2026-18557 The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and… |
Pozostałe |
CVSS 6,1EPSS 0,21 % | ||
| CVE-2026-18586 The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and… |
Monitoruj |
CVSS 7,2EPSS 0,23 % | ||
| CVE-2026-15090 The Link Library plugin for WordPress is vulnerable to time-based SQL Injection via the 'link_url' parameter in all versions up to, and including, 7.9.2 due to insufficient escaping on the… |
Monitoruj |
CVSS 7,5EPSS 0,36 % | ||
| CVE-2026-15180 The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to… |
Pozostałe |
CVSS 6,1EPSS 0,21 % | ||
| CVE-2026-17001 The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including,… |
Pozostałe |
CVSS 6,4EPSS 0,19 % | ||
| CVE-2026-17031 The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the… |
Monitoruj |
CVSS 8,1EPSS 0,3 % | ||
| CVE-2026-3712 The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL… |
Monitoruj |
CVSS 7,3EPSS 0,24 % | ||
| CVE-2026-76665 A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow. |
Monitoruj |
CVSS 7,1EPSS 0,16 % | ||
| CVE-2026-76666 A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read. |
Pozostałe |
CVSS 4,7EPSS 0,1 % | ||
| CVE-2026-76667 A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read. |
Pozostałe |
CVSS 5,7EPSS 0,09 % | ||
| CVE-2026-14572 The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and… |
Pozostałe |
CVSS 6,4EPSS 0,19 % | ||
| CVE-2026-108587 The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via… |
Wysoki priorytet |
CVSS 9,8EPSS 0,92 % | ||
| CVE-2026-93483 In Znuny through 7.3.6, an attacker can bypass specific standard login procedures and gain unauthorized access to sensitive system functions by manipulating a specific HTTP request header.… |
Wysoki priorytet |
CVSS 9,5EPSS 0,23 % | ||
| CVE-2026-93484 Znuny through 7.3.6 constructs a ticket-search database query by directly concatenating user-supplied input into the SQL statement. This lack of proper sanitization or the use of… |
Monitoruj |
CVSS 8,6EPSS 0,3 % | ||
| CVE-2026-76664 A security vulnerability in HPE NonStop EXPAND may result in out-of-bounds memory read/write operations |
Pozostałe |
CVSS 6,4EPSS 0,15 % | ||
| CVE-2026-110912 In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate the hardware address length (ar_hln) and protocol… |
Monitoruj |
CVSS 7,1EPSS 0,17 % | ||
| CVE-2026-110911 Wheels 1.1.8 through 4.1.1 allows SQL injection when caller-supplied quoted values are parsed again as SQL by dynamic finders (such as findOneByEmail), the query builder's where(property,… |
Wysoki priorytet |
CVSS 9,8EPSS 0,3 % | ||
| CVE-2026-76662 A buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption and DoS. |
Pozostałe |
CVSS 5,9EPSS 0,23 % | ||
| CVE-2026-76663 A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS. |
Monitoruj |
CVSS 7,5EPSS 0,27 % | ||
| CVE-2026-110907 Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert… |
Monitoruj |
CVSS 7,5EPSS 0,25 % | ||
| CVE-2026-110908 Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with… |
Monitoruj |
CVSS 8,8EPSS 6,08 % | ||
| CVE-2026-110909 Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can… |
Pozostałe |
CVSS 5,0EPSS 0,1 % | ||
| CVE-2026-76660 A vulnerability in HPE NonStop CIPSAM allows an out-of-bounds write that can corrupt buffer data. |
Monitoruj |
CVSS 8,7EPSS 0,11 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 6.11.2026, 07:02 UTC – 6.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.