cve.bz

Newest records, page 31

Filter
  1. 5.4CVE-2026-88090EPSS 0.3%

    Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

  2. 4.3CVE-2026-88078EPSS 0.3%

    Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

  3. 8.8CVE-2026-88077EPSS 0.6%

    Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.

  4. 8.1CVE-2026-85899EPSS 0.6%

    Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges over a network.

  5. 8.8CVE-2026-85897EPSS 0.6%

    Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  6. 8.8CVE-2026-85890EPSS 0.6%

    Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

  7. 4.3CVE-2026-85330EPSS 0.4%

    Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

  8. 6.8CVE-2026-84296EPSS 0.3%

    Multi-Factor Authentication Bypass vulnerability in SSH component in Progress Software WS_FTP Server versions prior to 2024.0.6, and 2025.0.3 on Windows allows authenticated users to bypass MFA requirements through improper association of …

  9. 10.0CVE-2026-84295EPSS 0.6%

    Improper authentication in Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an unauthenticated remote attacker to access sensitive information, including administrative credentials.

  10. 7.7CVE-2026-84294EPSS 0.4%

    Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories.

  11. 6.5CVE-2026-77819EPSS 0.4%

    IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.

  12. 6.5CVE-2026-77817EPSS 0.3%

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper sanitization of secrets during flow and project exports.

  13. 5.3CVE-2026-66912EPSS 0.5%

    Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containi…

  14. 5.3CVE-2026-66911EPSS 0.5%

    Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticate…

  15. 9.8CVE-2026-62131EPSS 0.3%

    Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

  16. 9.8CVE-2026-62018EPSS 0.4%

    Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

  17. 9.8CVE-2026-62017EPSS 0.4%

    Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

  18. 9.8CVE-2026-62016EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

  19. 9.8CVE-2026-62015EPSS 0.4%

    Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

  20. 9.8CVE-2026-62014EPSS 0.4%

    Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

  21. 9.8CVE-2026-62013EPSS 0.4%

    Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

  22. 9.8CVE-2026-62012EPSS 0.4%

    Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

  23. 9.8CVE-2026-62011EPSS 0.4%

    Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

  24. 9.8CVE-2026-62010EPSS 0.4%

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

  25. 9.8CVE-2026-62009EPSS 0.4%

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

  26. 9.8CVE-2026-62008EPSS 0.4%

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

  27. 9.8CVE-2026-62006EPSS 0.4%

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

  28. 9.8CVE-2026-62005EPSS 0.4%

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

  29. 9.8CVE-2026-62004EPSS 0.4%

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

  30. 9.8CVE-2026-62003EPSS 0.4%

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

  31. 9.8CVE-2026-62002EPSS 0.5%

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

  32. 9.8CVE-2026-62001EPSS 0.5%

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

  33. 9.8CVE-2026-61998EPSS 0.5%

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

  34. 9.8CVE-2026-61997EPSS 0.5%

    Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.

  35. 8.5CVE-2026-61996EPSS 0.4%

    Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.

  36. 7.1CVE-2026-61995EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.

  37. 7.1CVE-2026-61993EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.

  38. 9.8CVE-2026-61992EPSS 0.4%

    Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.

  39. 10.0CVE-2026-61991EPSS 0.7%

    Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.

  40. 7.1CVE-2026-61989EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.

  41. 7.1CVE-2026-61988EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.

  42. 7.1CVE-2026-54866EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions.

  43. 6.5CVE-2026-54865EPSS 0.2%

    Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions.

  44. 7.1CVE-2026-54864EPSS 0.2%

    Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions.

  45. 9.8CVE-2026-54860EPSS 0.5%

    Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions.

  46. 9.8CVE-2026-54859EPSS 0.5%

    Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.

  47. 9.8CVE-2026-54858EPSS 0.5%

    Unauthenticated PHP Object Injection in Printy <= 1.13.0 versions.

  48. 9.8CVE-2026-54857EPSS 0.5%

    Unauthenticated PHP Object Injection in Quirky <= 1.23 versions.

  49. 9.8CVE-2026-54856EPSS 0.5%

    Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions.

  50. 5.3CVE-2026-48200EPSS 0.3%

    Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.