cve.bz

Matching records, newest first, page 152

Filter
  1. 9.9CVE-2026-49774EPSS 0.3%

    Improper Control of Generation of Code ('Code Injection') vulnerability in Filipe Nasc RD Station allows Remote Code Inclusion. This issue affects RD Station: from n/a through 5.6.0.

  2. 9.3CVE-2026-49772ExploitEPSS 1.9%

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP The Events Calendar allows Blind SQL Injection. This issue affects The Events Calendar: from 6.15.12 through 6.16…

  3. 9.3CVE-2026-39574EPSS 0.2%

    Unauthenticated SQL Injection in InPost Gallery <= 2.1.4.6 versions.

  4. 9.2CVE-2026-48853EPSS 0.8%

    Deserialization of Untrusted Data and Allocation of Resources Without Limits or Throttling vulnerabilities in elixir-grpc grpc allow unauthenticated attackers to crash the BEAM node via atom table exhaustion and, when a decoded term flows …

  5. 9.1CVE-2026-12205EPSS 0.3%

    Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. Crypt::DSA::sign caches the per-signature nonce material in the Key object without ever clearing it. The first sign() on a Key …

  6. 9.1CVE-2026-48714EPSS 0.5%

    i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and p…

  7. 9.1CVE-2026-48713EPSS 0.5%

    Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFil…

  8. 9.1CVE-2026-12087EPSS 0.6%

    Socket versions before 2.041 for Perl have an out-of-bounds heap read. In Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the prec…

  9. 9.1CVE-2026-11832EPSS 0.3%

    Dancer2::Plugin::Auth::OAuth versions before 0.22 for Perl default to a predictable nonce. The default nonce was generated using an MD5 hash of the epoch time, which is predictable.

  10. 9.8CVE-2026-9691EPSS 0.5%

    Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions.

  11. 9.6CVE-2026-52703EPSS 0.4%

    Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

  12. 9.3CVE-2026-52693EPSS 0.3%

    Unauthenticated SQL Injection in eCommerce Product Catalog <= 3.5.5 versions.

  13. 9.8CVE-2026-49781EPSS 0.5%

    Unauthenticated PHP Object Injection in OttoKit <= 1.1.27 versions.

  14. 9.3CVE-2026-49776EPSS 0.3%

    Unauthenticated SQL Injection in GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites <= 2.32.6 versions.

  15. 9.8CVE-2026-49770EPSS 0.4%

    Unauthenticated PHP Object Injection in WP Travel Engine <= 6.7.12 versions.

  16. 9.8CVE-2026-49769EPSS 0.3%

    Unauthenticated PHP Object Injection in wpForo Forum <= 3.1.0 versions.

  17. 9.8CVE-2026-49768EPSS 0.4%

    Unauthenticated PHP Object Injection in Happyforms <= 1.26.13 versions.

  18. 9.9CVE-2026-49766EPSS 0.5%

    Subscriber Arbitrary File Deletion in WP User Manager <= 2.9.16 versions.

  19. 9.8CVE-2026-49765EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.8 versions.

  20. 9.8CVE-2026-49764EPSS 0.4%

    Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.8.6 versions.

  21. 9.8CVE-2026-49763EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 HubSpot <= 1.3.7 versions.

  22. 9.8CVE-2026-49109EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.3 versions.

  23. 9.8CVE-2026-49106EPSS 0.4%

    Unauthenticated PHP Object Injection in Integration for Contact Form 7 and Constant Contact <= 1.1.6 versions.

  24. 9.8CVE-2026-49105EPSS 0.5%

    Unauthenticated PHP Object Injection in WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  25. 9.8CVE-2026-49104EPSS 0.5%

    Unauthenticated PHP Object Injection in Integration for Keap/infusionsoft and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.2.1 versions.

  26. 9.8CVE-2026-49085EPSS 0.5%

    Unauthenticated PHP Object Injection in WP Insightly for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms <= 1.1.4 versions.

  27. 9.3CVE-2026-49067EPSS 0.3%

    Unauthenticated SQL Injection in Advanced 301 and 302 Redirect <= 1.6.9 versions.

  28. 9.3CVE-2026-48886EPSS 0.3%

    Unauthenticated SQL Injection in JS Help Desk <= 3.0.9 versions.

  29. 9.1CVE-2026-48881EPSS 0.3%

    Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.

  30. 10.0CVE-2026-48836EPSS 0.6%

    Unauthenticated Remote Code Execution (RCE) in Easy Invoice <= 2.1.19 versions.

  31. 9.3CVE-2026-45439EPSS 0.3%

    Unauthenticated SQL Injection in Realtyna Organic IDX plugin <= 5.1.0 versions.

  32. 9.3CVE-2026-42665EPSS 0.3%

    Unauthenticated SQL Injection in WP Data Access <= 5.5.70 versions.

  33. 9.3CVE-2026-42639EPSS 0.3%

    Unauthenticated SQL Injection in GD Rating System <= 3.6.2 versions.

  34. 9.3CVE-2026-42386EPSS 0.3%

    Unauthenticated SQL Injection in Order Delivery Date for WooCommerce <= 4.5.1 versions.

  35. 9.3CVE-2026-42381EPSS 0.3%

    Unauthenticated SQL Injection in Funnel Builder by FunnelKit <= 3.15.0.1 versions.

  36. 9.3CVE-2026-40798EPSS 0.3%

    Unauthenticated SQL Injection in wpForo Forum <= 3.0.4 versions.

  37. 10.0CVE-2026-40772EPSS 0.4%

    Unauthenticated Arbitrary File Upload in GeekyBot <= 1.2.2 versions.

  38. 9.3CVE-2026-40771EPSS 0.3%

    Unauthenticated SQL Injection in Contest Gallery <= 28.1.6 versions.

  39. 9.9CVE-2026-39591EPSS 0.5%

    Subscriber Arbitrary File Upload in WP-BusinessDirectory <= 4.0.0 versions.

  40. 9.8CVE-2026-39583EPSS 0.4%

    Unauthenticated Privilege Escalation in Datalogics Ecommerce Delivery <= 2.6.62 versions.

  41. 9.3CVE-2026-39530EPSS 0.3%

    Unauthenticated SQL Injection in SpeakOut! Email Petitions <= 4.6.5 versions.

  42. 9.3CVE-2026-39519EPSS 0.3%

    Unauthenticated SQL Injection in GeekyBot <= 1.2.0 versions.

  43. 9.3CVE-2026-39512EPSS 0.3%

    Unauthenticated SQL Injection in GeoDirectory <= 2.8.152 versions.

  44. 9.3CVE-2026-39511EPSS 0.3%

    Unauthenticated SQL Injection in WP Photo Album Plus <= 9.1.08.001 versions.

  45. 9.3CVE-2026-39502EPSS 0.3%

    Unauthenticated SQL Injection in Form Maker by 10Web <= 1.15.38 versions.

  46. 9.3CVE-2026-39493EPSS 0.4%

    Unauthenticated SQL Injection in Simply Schedule Appointments <= 1.6.9.27 versions.

  47. 9.3CVE-2026-39492EPSS 0.4%

    Unauthenticated SQL Injection in WP Maps <= 4.9.1 versions.

  48. 9.1CVE-2026-39465EPSS 0.7%

    Editor Remote Code Execution (RCE) in Responsive Slider by MetaSlider <= 3.106.0 versions.

  49. 9.3CVE-2026-39441EPSS 0.3%

    Unauthenticated SQL Injection in Feed KuantoKusta for WooCommerce – Free <= 5.3 versions.

  50. 9.8CVE-2026-34901EPSS 0.3%

    Unauthenticated Privilege Escalation in iControlWP <= 5.5.3 versions.