KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for…
Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.
Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite:…
Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.
A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed…
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to…
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST…
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the…
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of…
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an…
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the…
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0.
Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions.
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-52710 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows… |
Pozostałe |
CVSS 5,3EPSS 0,3 % | ||
| CVE-2026-54850 Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. |
Pozostałe |
CVSS 6,5EPSS 0,36 % | ||
| CVE-2026-39732 Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. |
Wysoki priorytet |
CVSS 9,3EPSS 0,32 % | ||
| CVE-2026-39734 Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. |
Monitoruj |
CVSS 7,5EPSS 0,46 % | ||
| CVE-2026-39738 Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through… |
Wysoki priorytet |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2026-39739 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows… |
Pozostałe |
CVSS 6,5EPSS 0,2 % | ||
| CVE-2026-39786 Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. |
Monitoruj |
CVSS 7,1EPSS 0,23 % | ||
| CVE-2026-27061 Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. |
Pozostałe |
CVSS 6,5EPSS 0,24 % | ||
| CVE-2026-28160 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from… |
Monitoruj |
CVSS 7,1EPSS 0,23 % | ||
| CVE-2026-119842 A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the… |
Pozostałe |
CVSS 6,5EPSS 0,33 % | ||
| CVE-2026-120007 NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register.… |
Pozostałe |
CVSS 6,9EPSS 0,34 % | ||
| CVE-2026-120046 Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service.… |
Pozostałe |
CVSS 6,0EPSS 0,3 % | ||
| CVE-2026-119727 A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette… |
Pozostałe |
CVSS 6,5EPSS 0,25 % | ||
| CVE-2026-119728 A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set… |
Pozostałe |
CVSS 6,5EPSS 0,33 % | ||
| CVE-2026-119729 A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1… |
Pozostałe |
CVSS 6,5EPSS 0,4 % | ||
| CVE-2026-119117 Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local… |
Monitoruj |
CVSS 8,2EPSS 0,15 % | ||
| CVE-2026-119526 Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0. |
Wysoki priorytet |
CVSS 9,8EPSS 0,41 % | ||
| CVE-2026-118086 Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. |
Monitoruj |
CVSS 8,8EPSS 0,36 % | ||
| CVE-2026-118089 Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. |
Monitoruj |
CVSS 7,2EPSS 0,39 % | ||
| CVE-2026-118090 Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. |
Monitoruj |
CVSS 8,8EPSS 0,45 % | ||
| CVE-2026-116852 Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. |
Wysoki priorytet |
CVSS 9,1EPSS 0,6 % | ||
| CVE-2026-116853 Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. |
Pozostałe |
CVSS 6,5EPSS 0,21 % | ||
| CVE-2026-116854 Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. |
Pozostałe |
CVSS 6,5EPSS 0,2 % | ||
| CVE-2026-116861 Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. |
Monitoruj |
CVSS 7,5EPSS 0,34 % | ||
| CVE-2026-116862 Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. |
Monitoruj |
CVSS 7,5EPSS 0,32 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 07:02 UTC – 12.11.2026, 12:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.