New CVEs this week, the last 7 days, newest first, page 88
Filter
The new CVEs published in the last 7 days, newest first, with CVSS, EPSS, CISA KEV and public exploits for each. Refreshed every few minutes. Narrow it: in CISA KEV · critical. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, Patch Tuesday
- 5.3CVE-2026-123129EPSS 0.2%
The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the subm…
- 3.7CVE-2026-123128EPSS 0.1%
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items …
- 7.5CVE-2026-123091EPSS 0.2%
The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that …
- 5.3CVE-2026-123088EPSS 0.2%
The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redire…
- 8.8CVE-2026-123064EPSS 0.2%
The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a n…
- 7.2CVE-2026-121875EPSS 0.3%
The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbit…
- 7.2CVE-2026-121874EPSS 0.3%
The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including t…
- 4.9CVE-2026-121759EPSS 0.2%
The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the trash, which could allow users with a role as low as Contributor to trash arbitrary posts and pages, or delete them permane…
- 5.3CVE-2026-120409EPSS 0.2%
The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the me…
- 7.5CVE-2026-118202EPSS 0.2%
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not confirm that its two-factor authentication step succeeded before completing a login and treats a failure to build that step as success, so an attacker who holds a pr…
- 7.5CVE-2026-118201EPSS 0.2%
The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through a…
- 7.5CVE-2026-115256EPSS 0.3%
The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own d…
- 9.8CVE-2026-115237EPSS 0.3%
The Grand Job WordPress plugin through 1.2.1 does not correctly verify the password reset code before updating a user's password, allowing unauthenticated attackers to set the password of arbitrary accounts, including administrators, and f…
- 9.8CVE-2026-115213EPSS 0.3%
The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, al…
- 8.8CVE-2026-115212EPSS 0.4%
The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authentic…
- 8.8CVE-2026-115204EPSS 0.4%
The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to …
- 2.1CVE-2026-124571EPSS 0.2%
A flaw has been found in SourceCodester Simple CRUD using PHP and FPDF 1.0. Affected by this vulnerability is an unknown functionality of the file app/register.php. Executing a manipulation of the argument firstname can lead to sql injecti…
- 1.9CVE-2026-124570EPSS 0.2%
A vulnerability was detected in SourceCodester Online Leave Management System 1.0. Affected is an unknown function of the file app/classes/Master.php of the component Employee Avatar Upload Extension. Performing a manipulation of the argum…
- 5.3CVE-2026-124569EPSS 0.2%
A vulnerability was found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. The affected element is the function updateCommissionCash of the file CommissionCashServiceImpl.java. The manipulation of the argument S…
- 5.3CVE-2026-124568EPSS 0.2%
A vulnerability has been found in fushengqian fuintCatering up to 6d054f5788ac8645eb491f79242bb8a625efc133. Impacted is the function RefundServiceImpl.agreeRefund of the component Refund Agreement. The manipulation leads to improper access…
- 5.3CVE-2026-124567EPSS 0.2%
A flaw has been found in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This issue affects the function receipt of the file ClientOrderController.java. Executing a manipulation can lead to state issue. The attack may be …
- 5.3CVE-2026-124566EPSS 0.2%
A vulnerability was detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This vulnerability affects the function aliPayCallback of the file ClientPayController.java of the component Alipay Callback Handler. Perform…
- 5.3CVE-2026-124565EPSS 0.2%
A security vulnerability has been detected in fushengqian fuint up to 36cc31b08d77facc94e8959afa02224891b4fe5f. This affects the function confirm of the file MerchantOrderController.java of the component Order Verification. Such manipulati…
- 9.3CVE-2026-113364EPSS 0.8%
Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary code with SYSTEM privile…
- 9.3CVE-2026-113363EPSS 1.1%
Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and Ver 7.7.0 through 7.7.2 on Windows allows a remote unauthenticated attacker to execute arbitrary co…
- 5.5CVE-2026-124564EPSS 0.6%
A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path trave…
- 7.7CVE-2026-124563EPSS 0.5%
A security flaw has been discovered in D-Link DIR-878 1.20B05. Affected by this vulnerability is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument Primary/Secondary results in buffer overflow. The …
- 7.7CVE-2026-124562EPSS 0.5%
A vulnerability was identified in D-Link DIR-878 1.20B05. Affected is the function SetWanSettings of the component HNAP Handler. The manipulation of the argument ConfigDNS/Primary/ConfigDNS/Secondary leads to buffer overflow. The attack ma…
- 7.7CVE-2026-124561EPSS 0.5%
A vulnerability was determined in D-Link DIR-878 1.20B05. This impacts the function SetVLANSettings of the file prog.cgi of the component HNAP Handler. Executing a manipulation of the argument VID can lead to stack-based buffer overflow. T…
- 8.5CVE-2026-113362EPSS 0.2%
Improper Access Control in the program installation folder in NEC Corporation WebSAM Winshare Ver 7.5.0 and earlier (excluding Ver 7.3.3), Ver 7.6.0 and Ver 7.7.0 through 7.7.1 on Windows allows a locally authenticated low-privileged attac…
- 8.9CVE-2026-124560EPSS 0.7%
A vulnerability was found in D-Link DIR-878 1.20B05. This affects the function GetCAPTCHAsetting of the file bin/prog.cgi of the component HNAP Handler. Performing a manipulation of the argument uid results in heap-based buffer overflow. T…
- 5.5CVE-2026-124558EPSS 0.3%
A vulnerability has been found in DataLinkDC Dinky up to 1.2.5. The impacted element is the function SqlGateway.onOpen of the file SqlGateway.java of the component sql-gateway Endpoint. Such manipulation of the argument connectAddress lead…
- 5.5CVE-2026-124557EPSS 0.5%
A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argu…
- 2.1CVE-2026-124556EPSS 0.3%
A security vulnerability has been detected in kekingcn kkFileView up to 5.0.3. This issue affects the function BaseUrlFilter.getBaseUrl of the file server/src/main/java/cn/keking/web/filter/BaseUrlFilter.java. The manipulation of the argum…
- 5.1CVE-2026-121825EPSS 0.2%
OpenAM (OpenAM Consortium Edition) 14.0.5 and earlier contains an open redirect vulnerability (CWE-601) in the Liberty ID-FF service provider single sign-on flow. The goto parameter of the /preLogin endpoint is stored as the RelayState of …
- 2.1CVE-2026-124555EPSS 0.2%
A weakness has been identified in JeecgBoot 3.9.5. This vulnerability affects the function JimuFormApiService.getTableDictList of the file /jeecg-boot/jmreport/form/getTableDictList of the component Table Dictionary API. Executing a manipu…
- 5.5CVE-2026-124554EPSS 0.3%
A security flaw has been discovered in JeecgBoot 3.9.5. This affects an unknown part of the file /jeecg-boot/drag/onlDragDatasetHead/getAllChartData of the component JimuBI. Performing a manipulation of the argument params results in sql i…
- 5.5CVE-2026-124509EPSS 0.5%
A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Ha…
- 5.5CVE-2026-124508EPSS 0.8%
A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifa…
- 5.5CVE-2026-124507EPSS 0.3%
A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Tas…
- 2.1CVE-2026-124506EPSS 0.3%
A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This vulnerability affects the function Model.getDomain of the file WEB-INF/tags/hourlyReport.tag of the component Report Handler. The manipulation of the argument domain …
- 2.1CVE-2026-124505EPSS 0.2%
A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. This affects the function Handler.redirect of the file Handler.java of the component Login/Logout. Executing a manipulation of the argument rtnUrl can lead to open redirect. The at…
- 2.1CVE-2026-124504EPSS 0.2%
A vulnerability was detected in erupts erupt up to 2.3.0. Affected by this issue is the function ReportService.queryBiData of the file ReportService.java. Performing a manipulation of the argument sort results in sql injection. The attack …
- 9.1CVE-2026-119506EPSS 0.3%
Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1.
- 2.1CVE-2026-124502EPSS 0.2%
A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.p…
- 5.5CVE-2026-124501EPSS 0.3%
A weakness has been identified in Tidelift moto up to 5.2.4. Affected is an unknown function of the file moto/batch/models.py of the component AWS Batch Emulation. This manipulation of the argument privileged/volumes causes improper privil…
- 2.1CVE-2026-124500EPSS 0.2%
A security flaw has been discovered in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This impacts the function upload_document_image of the file application/controllers/FilesController.class.php of the component File Handler. The manipu…
- 2.0CVE-2026-124499EPSS 0.2%
A vulnerability was identified in Fengoffice Feng Office up to 3.11.13.11/4.2.1.2. This affects the function write_translations of the file application/controllers/ToolController.class.php of the component Translation Tool. The manipulatio…
- 2.0CVE-2026-124498EPSS 0.2%
A vulnerability was determined in Convene Azeus Convene Board Management Portal 7.0.2.7_3 p72. The impacted element is an unknown function of the file /jsp/ge/dummy_launcher.jsp. Executing a manipulation of the argument REDIRECT_URL can le…
- 7.5CVE-2026-96146EPSS 0.3%
IBM SevOne Network Performance Management 7.0.0 through 8.2.2 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption.