Veille CVE

Semaine du 7 septembre au 13 septembre 2026

3 722 CVE

Critique 473 Élevée 1493 Moyenne 1601 Faible 134 Non évaluée 21 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-84869 9.9 Critique Exploitée

    ConnectWise ScreenConnect

    A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

  2. CVE-2026-83987 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  3. CVE-2026-83985 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  4. CVE-2026-83983 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  5. CVE-2026-83982 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  6. CVE-2026-83981 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  7. CVE-2026-83980 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  8. CVE-2026-83977 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  9. CVE-2026-83973 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  10. CVE-2026-83972 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  11. CVE-2026-83971 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  12. CVE-2026-83970 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  13. CVE-2026-83967 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  14. CVE-2026-83954 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  15. CVE-2026-78448 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  16. CVE-2026-73007 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  17. CVE-2026-73002 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  18. CVE-2026-72996 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally.

  19. CVE-2026-82001 5.5 Moyenne

    Adobe Acrobat · Adobe Acrobat Reader · Adobe Acrobat 2024 · Adobe acrobat dc

    Acrobat Reader is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

  20. CVE-2026-81982 5.5 Moyenne

    Adobe Acrobat · Adobe Acrobat Reader · Adobe Acrobat 2024 · Adobe acrobat dc

    Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

  21. CVE-2026-81977 5.5 Moyenne

    Adobe Acrobat · Adobe Acrobat Reader · Adobe Acrobat 2024 · Adobe acrobat dc

    Acrobat Reader is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

  22. CVE-2026-75740 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

  23. CVE-2026-75735 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

  24. CVE-2026-75729 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

  25. CVE-2026-75722 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  26. CVE-2026-75716 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  27. CVE-2026-75706 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  28. CVE-2026-75683 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  29. CVE-2026-75677 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  30. CVE-2026-75661 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  31. CVE-2026-75642 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

  32. CVE-2026-75635 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  33. CVE-2026-19713 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  34. CVE-2026-61410 9.4 Critique

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution. This vulnerability is considered critical because it allows an attacker to execute commands remotely on a target system by sending a specially crafted request to the application, bypassing intended restrictions on code execution.Dell recommends customers to upgrade at the earliest opportunity.

  35. CVE-2026-80132 8.1 Élevée

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    ell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

  36. CVE-2026-80133 8.1 Élevée

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to remote execution.

  37. CVE-2026-80134 7.7 Élevée

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

  38. CVE-2026-80135 5.3 Moyenne

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check or Handling of Exceptional Conditions vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

  39. CVE-2026-80178 7.8 Élevée

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

  40. CVE-2026-80238 9.3 Critique

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Unnecessary Privileges vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass. This vulnerability is considered critical because a low-privileged operator with SSH access to the SCG host can gain root-level access to the host without requiring a password by leveraging the exposed Docker socket. Additionally, an attacker who compromises a service running within the orchestrator container can access the same socket and escape the container boundary to obtain host-level control. Dell recommends that customers upgrade at the earliest opportunity.

  41. CVE-2026-80170 6.5 Moyenne

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to protection mechanism bypass.

  42. CVE-2026-78480 7.5 Élevée

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

  43. CVE-2026-78488 6.5 Moyenne

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to command execution.

  44. CVE-2026-79644 7.4 Élevée

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

  45. CVE-2026-79645 8.2 Élevée

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

  46. CVE-2026-80056 5.5 Moyenne

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.

  47. CVE-2026-80057 5.5 Moyenne

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded Cryptographic Key vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information disclosure.

  48. CVE-2026-89265 4.3 Moyenne

    moxi624 MoguBlog

    MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify annotation required to enforce role-based permissions. Authenticated back-office users without image-category permissions can supply a category uid to retrieve restricted image-category records including metadata such as name, cover file uid, sort order and timestamps.

  49. CVE-2026-89260 7.5 Élevée

    moxi624 MoguBlog

    MoguBlog through 6.2 contains an XML external entity injection vulnerability in the WeChat callback handler at POST /wechat/wechatCheck. The WechatRestApi.index() method passes the raw request body to SignUtil.xmlToMap(), which uses an unhardened dom4j SAXReader without DTD or external-entity restrictions. Unauthenticated remote attackers can submit DOCTYPE declarations with external parameter entities to read arbitrary local files or trigger outbound HTTP requests, with resolved entities reflected in error responses.

  50. CVE-2026-8778 9.8 Critique

    mulika MIPL Grouped Checkout Fields for WooCommerce. Customize & Organize Checkout Fields.

    The MIPL Grouped Checkout Fields for WooCommerce – Customize & Organize Checkout Fields. plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the `mipl_wc_upload_file` function in all versions up to, and including, 1.2.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

  51. CVE-2026-8615 4.3 Moyenne

    ghera74 ilGhera Reviso Exporter for WooCommerce

    The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service.

  52. CVE-2026-89254 8.7 Élevée

    WWBN AVideo

    AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the field_name parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute when viewing extra info pages or profile forms that render the typeToHTML function.

  53. CVE-2026-89249 8.7 Élevée

    WWBN AVideo

    AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the YPTWallet plugin where user-supplied CryptoWallet values are base64-encoded but not HTML-escaped before storage in wallet_log.information. Administrators viewing pending withdrawal requests in pendingRequests.php execute the stored markup in their session, allowing attackers to perform administrative actions via same-origin fetch requests.

  54. CVE-2026-89244 6.1 Moyenne

    WWBN AVideo

    WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Gallery/view/Category.php when SubCategorys is enabled. The getBackURL parameter is echoed into an href attribute without HTML encoding, allowing attackers to inject malicious scripts that execute in visitors' browsers when they interact with the Back control.

  55. CVE-2026-89239 6.1 Moyenne

    WWBN AVideo

    WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in the showAlertMessage() function that inserts the raw Referer header into a JavaScript comment without encoding. Attackers can craft a Referer header containing */ to close the comment and inject arbitrary JavaScript that executes in the site origin for visitors arriving from the attacker-controlled page.

  56. CVE-2026-89042 9.1 Critique

    krakenjs passport-saml-encrypted

    passport-saml-encrypted through 0.1.13 makes SAML signature verification conditional on an optional cert option, allowing attackers to bypass authentication by submitting unsigned SAML responses. Attackers can post forged SAML responses with arbitrary NameID and attributes to the assertion consumer service endpoint to receive authenticated profiles without valid signatures.

  57. CVE-2026-88959 8.8 Élevée

    anchorcms Anchor CMS

    Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to create administrator accounts or modify existing ones. Attackers with editor or user roles can POST directly to admin/users/add or admin/users/edit endpoints to create new administrator accounts or change the existing administrator's password, gaining full administrative access.

  58. CVE-2026-88899 9.8 Critique

    knowns-dev knowns

    knowns versions before 0.31.0 fail to properly validate the x-opencode-directory request header in the /api/opencode proxy endpoint. Remote attackers can supply arbitrary directory paths to execute file operations outside the project root on the host system.

  59. CVE-2026-87923 4.3 Moyenne

    Rizwan17 inventory-management-system

    A weakness has been identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this issue is some unknown functionality of the file includes/DBOperation.php of the component List Handler. This manipulation of the argument category_name/brand_name/product_name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

  60. CVE-2026-87870 6.4 Moyenne

    Saturday Drive Ninja Forms - Scheduled Exports

    The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters (interval, format, emailTo) in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level privileges and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The REST endpoint is registered without a permission_callback and only validates a nonce without checking user capabilities.

  61. CVE-2026-86808 7.3 Élevée

    moltis-org moltis

    A security vulnerability has been detected in moltis-org moltis up to 20260818.10. The affected element is the function vault_unlock_handler/vault_recovery_handler of the file vault.rs. Such manipulation leads to missing authentication. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 20260819.01 is sufficient to fix this issue. The name of the patch is 3b92dd64d5648f829968cf48bf67dc3113852fef. Upgrading the affected component is advised.

  62. CVE-2026-86804 5.3 Moyenne

    seakee CPA-Manager-Plus

    A vulnerability was identified in seakee CPA-Manager-Plus up to 1.11.10. This vulnerability affects the function CPAResource of the file apps/manager-server/internal/http/controller/proxy/handler.go of the component HTTP Handler. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. Upgrading to version 1.11.11 is able to resolve this issue. The identifier of the patch is 842eec791377ddcbea5cd639bc065eaa4801d656. It is suggested to upgrade the affected component.

  63. CVE-2026-86674 6.3 Moyenne

    ningzichun Student Management System

    A vulnerability was found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is the function session_start of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been made public and could be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The project was informed of the problem early through an issue report but has not responded yet.

  64. CVE-2026-86672 5.3 Moyenne

    ningzichun Student Management System

    A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

  65. CVE-2026-86668 4.3 Moyenne

    aircheng-org iWebShop-5

    A security vulnerability has been detected in aircheng-org iWebShop-5 up to 5.15. The impacted element is the function uploadFile of the file controllers/pic.php. Such manipulation of the argument outerSrc/selectPhoto leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

  66. CVE-2026-86519 5.3 Moyenne

    code-projects Student Crud Operation

    A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /card_activation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used.

  67. CVE-2026-86509 9.6 Critique

    D-Link DIR-895L

    A flaw has been found in D-Link DIR-895L A1_102b07. This impacts the function sendOffer/sendACK of the file udhcpcd/serverpacket.c of the component udhcpcd. This manipulation causes stack-based buffer overflow. The attack can only be done within the local network. The exploit has been published and may be used.

  68. CVE-2026-86310 6.3 Moyenne

    itsourcecode Sales and Inventory System

    A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/cust_edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

  69. CVE-2026-86305 7.3 Élevée

    light0011 cms

    A security flaw has been discovered in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function Upload::upload of the file ThinkPHP/Library/Think/Upload.class.php. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

  70. CVE-2026-86299 9.9 Critique

    Linksys RE7000

    A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

  71. CVE-2026-86294 4.3 Moyenne

    SourceCodester Simple Traffic Offense System

    A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site_name/site_desc leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

  72. CVE-2026-86289 4.3 Moyenne

    Ollama

    A vulnerability was found in Ollama up to 0.31.1. This issue affects the function readGGUFV1String of the file fs/ggml/gguf.go of the component GGUF Decoder. Performing a manipulation results in integer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 0.31.2-rc1 is capable of addressing this issue. The patch is named 67b6a1c2d45321e0cb3c04a18073f9818de7724b. It is recommended to upgrade the affected component.

  73. CVE-2026-86281 4.3 Moyenne

    SourceCodester Syllabus-Aligned Learning Management & Examination System

    A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.

  74. CVE-2026-86273 7.3 Élevée

    projeto-siga siga

    A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

  75. CVE-2026-86236 6.3 Moyenne

    itsourcecode Sales and Inventory System

    A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/pro_transac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

  76. CVE-2026-86231 3.7 Faible

    mwiede jsch

    A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate revocation. The attack is possible to be carried out remotely. The attack is considered to have high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.28.6 is able to address this issue. The patch is named 194a2f76a5c0f1c3f778565be3fd66bcafc42d23. You should upgrade the affected component.

  77. CVE-2026-86224 7.3 Élevée

    SourceCodester Class and Exam Timetabling System

    A vulnerability was determined in SourceCodester Class and Exam Timetabling System 1.0. Affected is the function mysqli_query of the file /admin/modal_add_product.php. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

  78. CVE-2026-86217 5.3 Moyenne

    code-projects Hotel and Tourism Reservation in PHP

    A vulnerability was detected in code-projects Hotel and Tourism Reservation in PHP 1.0. Affected is an unknown function of the file /ht/hotel_db%20(1).sql of the component Database Backup Handler. The manipulation results in information disclosure. The attack may be launched remotely. The exploit is now public and may be used.

  79. CVE-2026-86212 4.3 Moyenne

    Open5GS

    A vulnerability has been found in Open5GS 2.7.7/2.8.0. This vulnerability affects unknown code of the component AMF/MME. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 9468de94caed2fc940f4a23cbf734651896d0fde. To fix this issue, it is recommended to deploy a patch.

  80. CVE-2026-86183 5.3 Moyenne

    diem-project diem

    A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget_id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet.

  81. CVE-2026-86172 6.3 Moyenne

    DefaultFuction CRM

    A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

  82. CVE-2026-86166 8.8 Élevée

    Tenda HG10

    A vulnerability was determined in Tenda HG10 300001138. This issue affects the function formWanRedirect of the file /boaform/formWanRedirect of the component Boa Web Server. Executing a manipulation of the argument if can lead to buffer overflow. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

  83. CVE-2026-86161 7.3 Élevée

    SourceCodester Online Voting System

    A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete_category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

  84. CVE-2026-86151 9.1 Critique

    Tenda CP3

    A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely.

  85. CVE-2026-85645 6.1 Moyenne

    10web Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder

    The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  86. CVE-2026-85703 6.5 Moyenne

    ramon-victor freegpt-webui

    A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This vulnerability only affects products that are no longer supported by the maintainer.

  87. CVE-2026-85638 7.3 Élevée

    jofpin trape

    A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

  88. CVE-2026-85516 7.3 Élevée

    code-projects Vehicle Management System

    A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

  89. CVE-2026-85402 7.3 Élevée

    code-projects Doctor Appointment System

    A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.

  90. CVE-2026-85383 6.3 Moyenne

    itsourcecode Sales and Inventory System

    A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

  91. CVE-2026-84816 7.1 Élevée

    RealMag777 WPCS

    Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions.

  92. CVE-2026-85378 7.3 Élevée

    light0011 cms

    A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

  93. CVE-2026-83997 8.1 Élevée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2

    Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.

  94. CVE-2026-83990 7.8 Élevée

    Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

    Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  95. CVE-2026-82537 8.8 Élevée

    RooCodeInc Roo-Code

    Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent's auto-execute privileges on the developer's machine.

  96. CVE-2026-82004 10.0 Critique

    Adobe Campaign Classic · Adobe campaign

    Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

  97. CVE-2026-81825 7.2 Élevée

    specialk Simple Ajax Chat – Add a Fast, Secure Chat Box

    The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load.

  98. CVE-2026-81800 9.3 Critique

    Par avisverifies Verified Reviews (Avis Vérifiés)

    Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions.

  99. CVE-2026-81786 7.5 Élevée

    VillaTheme Thank You Page Customizer for WooCommerce

    Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions.

  100. CVE-2026-81275 6.5 Moyenne

    Youzify

    Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions.

  101. CVE-2026-79698 9.9 Critique

    Advantech WISE-6610-NB · Advantech WISE-6610-EB · Advantech WISE-6610-TB · Advantech WISE-6610-JB

    A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_20251110. This vulnerability affects the function nodered_lib_apply of the component Node-RED Library. Such manipulation of the argument act leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 1.2.4_20260821 is able to resolve this issue. It is advisable to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

  102. CVE-2026-75803 9.1 Critique

    OpenSSL · Openssl openssl

    Issue summary: ChaCha20-Poly1305 and AES-OCB decryption with an empty ciphertext can report success without verifying the supplied authentication tag when the operation is finalized by calling the EVP_Cipher() function. Impact summary: Applications calling EVP_Cipher() on an empty ciphertext and expecting the call to check the AEAD tag may accept forged messages. CWE: CWE-354 (Improper Validation of Integrity Check Value) Description: The EVP_Cipher() API call for AEAD ciphers behaves like a one shot encryption and decryption call. It also verifies the AEAD tag after the decryption operation. However for AES-OCB and ChaCha20-Poly1305 ciphers it skipped the AEAD tag verification when an empty ciphertext was passed to the function. The callers of this function might believe that a successful return indicates a valid AEAD tag for these ciphers, even when that has not truly been validated in this case. FIPS impact: no The FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this CVE as the affected algorithms are not FIPS approved and thus not implemented in the FIPS module.

  103. CVE-2026-78172 6.1 Moyenne

    themifyme Themify – WooCommerce Product Filter

    The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  104. CVE-2026-77807 7.5 Élevée

    acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

    The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled.

  105. CVE-2026-79693 3.4 Faible

    Dell Secure Connect Gateway 5.0 - Application · Dell Secure Connect Gateway 5.0 - Appliance · Dell secure connect gateway

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Violation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

  106. CVE-2026-78444 8.1 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2019 · Microsoft Windows Server 2019 (Server Core installation) · Microsoft Windows Server 2022

    Untrusted pointer dereference in Windows Failover Cluster allows an unauthorized attacker to execute code over a network.

  107. CVE-2026-75927 7.2 Élevée

    publishpress User Role Editor – PublishPress Capabilities: Access Control and User Roles

    The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible.

  108. CVE-2026-77187 6.4 Moyenne

    joedolson My Calendar – Accessible Event Manager

    The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  109. CVE-2026-75711 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  110. CVE-2026-75700 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  111. CVE-2026-75692 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  112. CVE-2026-75670 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  113. CVE-2026-75651 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.

  114. CVE-2026-77108 7.5 Élevée

    Adobe Commerce · Adobe Commerce B2B · Adobe Magento Open Source · Adobe magento

    Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive information. Exploitation of this issue does not require user interaction.

  115. CVE-2026-73017 7.5 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally.

  116. CVE-2026-62140 5.3 Moyenne

    ExpressTech Systems Quiz And Survey Master

    Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions.

  117. CVE-2026-6642 6.4 Moyenne

    dglingren Media Library Assistant

    The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechanism in versions up to and including 3.35. This is due to insufficient output escaping on preset field values when they are rendered in HTML attribute contexts in the mla_generate_bulk_edit_form_fieldsets() function and mla-bulk-edit-fieldsets.tpl template. While wp_kses() filtering is applied during preset export for users without unfiltered_html capability, this does not prevent attribute injection attacks since the malicious payload consists of quotes and HTML attributes rather than HTML tags. When preset values are retrieved and rendered, they are directly assigned to template variables without esc_attr() escaping and then inserted into input element value attributes via simple string replacement. This makes it possible for authenticated attackers, with Author-level access and above (upload_files capability), to inject arbitrary web scripts that execute when an administrator imports the poisoned preset and the targeted input field receives focus.

  118. CVE-2026-71440 5.4 Moyenne

    Adobe Experience Manager as a Cloud Service · Adobe Experience Manager 6.5 LTS · Adobe Experience Manager 6.5 · Adobe experience manager

    Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

  119. CVE-2026-62137 5.3 Moyenne

    John James Jacoby bbPress

    Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions.

  120. CVE-2026-62136 5.3 Moyenne

    wpdesk Flexible Quantity – Measurement Price Calculator for WooCommerce

    Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions.

  121. CVE-2026-62135 5.3 Moyenne

    Arraytics Booktics

    Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.

  122. CVE-2026-62132 5.3 Moyenne

    Masteriyo - LMS

    Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions.

  123. CVE-2026-62114 5.3 Moyenne

    WP Chill Passster

    Unauthenticated Broken Access Control in Passster <= 4.3.13 versions.

  124. CVE-2026-62113 4.3 Moyenne

    Anh Tran Slim SEO

    Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions.

  125. CVE-2026-62110 6.5 Moyenne

    boldthemes Bold Page Builder

    Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions.

  126. CVE-2026-62109 7.6 Élevée

    wowDevs Sky Addons for Elementor

    Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions.

  127. CVE-2026-62107 8.8 Élevée

    Masteriyo - LMS

    Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions.

  128. CVE-2026-63076 7.5 Élevée

    OpenSSL · Openssl openssl

    Issue summary: OpenSSL CMP password based protection verification only checks whether the protectionAlg parameter was not NULL and not its ASN.1 type, before treating it as a PBMParameter. A crafted message can contain a parameter of a different type, which is then dereferenced as an invalid pointer. Impact summary: A remote, unauthenticated attacker can crash an application acting as a CMP server that accepts PBM-protected messages, or a CMP client talking to a malicious or intercepted CMP server, resulting in a Denial of Service. CWE: CWE-476: NULL Pointer Dereference Description: When verifying the password-based MAC protection of a CMP message, OpenSSL library reads the protectionAlg algorithm parameter with X509_ALGOR_get0(), which returns both the parameter type and its value pointer. The value is then cast to an ASN1_STRING and treated as the expected PBMParameter after only checking that pointer is not NULL. The parameter type returned by X509_ALGOR_get0() was never consulted. This happens during protection verification, before any MAC is computed, so no knowledge of the PBM shared secret is required; the only precondition is that PBM verification is reachable. On the server side this is reached from OSSL_CMP_SRV_process_request() for any application that stands up a CMP server accepting PBM-protected messages, and on the client side from CMP response validation against a malicious or on-path (MITM) server. The reliable consequence is a denial of service; there is no memory disclosure, no controlled memory write, and no path to code execution. CMP is a specialized feature that an application must explicitly enable. FIPS impact: no As the CMP code lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.

  129. CVE-2026-62103 9.8 Critique

    wpeverest Everest Forms

    Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions.

  130. CVE-2026-62102 8.8 Élevée

    Gato GraphQL

    Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions.

  131. CVE-2026-62089 7.1 Élevée

    Pixar Labs Master Addons for Elementor

    Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a through 3.2.2.

  132. CVE-2026-62088 5.3 Moyenne

    10up ElasticPress

    Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4.

  133. CVE-2026-48707 3.1 Faible

    instantsoft icms2

    InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Server-Side Request Forgery (SSRF) vulnerability in the file upload functionality (`system/core/uploader.php` at lines 509-532). When the "upload from URL" feature follows an HTTP redirect, the redirected target URL bypasses the private IP address blacklist check. This allows authenticated users to scan and access internal network services. Version 2.18.2 contains a fix.

  134. CVE-2026-19991 8.1 Élevée

    stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP

    The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload_file_remove() AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $_POST when no real $_FILES upload is provided (process_account() calls uwp_validate_fields() and array_merges the result with the empty output of UsersWP_Files::validate_uploads()). At storage time the value is only checked with validate_file(), which passes any string that does not contain a literal '../'. When the value is later processed by upload_file_remove(), it is again gated with validate_file() and then normalized through uwp_get_file_relative_url(); that helper performs a global str_replace() of the uploads base URL against the stored URL, allowing a crafted URL containing embedded '..<uploads-baseurl>' tokens to collapse into '../../' traversal sequences after the last validation. The transformed value is then appended to the uploads base directory and passed to wp_delete_file() without any canonical containment check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the affected site's server (including wp-config.

  135. CVE-2026-2310 7.8 Élevée

    IBM webMethods Integration Server

    IBM webMethods Integration Server 11.1 IBM webMethods Integration is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

  136. CVE-2026-19946 4.3 Moyenne

    awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin

    The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim.

  137. CVE-2026-18579 7.2 Élevée

    opajaap WP Photo Album Plus

    The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all versions up to, and including, 9.2.08.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce failure path for the getshortcodedrenderedfenodelay action serves as the log-write trigger rather than an access barrier — a deliberately failed nonce check causes wppa_log() to record the attacker-supplied X-Forwarded-For value to disk, making the exploit fully reachable by unauthenticated callers via the wp_ajax_nopriv_wppa endpoint.

  138. CVE-2026-18561 7.5 Élevée

    unitecms Unlimited Elements For Elementor

    The Unlimited Elements For Elementor plugin for WordPress is vulnerable to SQL Injection via the 'addontype' parameter in versions up to, and including, 2.0.16. This is due to insufficient escaping on the user-supplied parameter and the lack of sufficient preparation on the existing SQL query in the getWhereString() function; when the parameter is supplied as an array, element zero is used verbatim as the SQL comparison operator and concatenated into the WHERE clause without sanitization, while normalizeAjaxInputData() strips WordPress's magic_quotes protection from the value. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  139. CVE-2026-11496 6.5 Moyenne

    edgarrojas PDF Builder for WooCommerce. Create invoices,packing slips and more

    The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.0.8. This is due to the InspectOrder() AJAX handler (woocommerce-pdf-invoice-ajax.php:513), registered on wp_ajax_rednao_wcpdfinv_inspect_order, performing no capability check and no nonce verification before loading an arbitrary order by the attacker-supplied 'OrderNumber' POST field and serializing its full WC_Order::get_data() and meta to the response. This makes it possible for authenticated attackers with Subscriber-level access and above to read every WooCommerce order on the site — including billing/shipping address, email, phone number, payment method, gateway transaction ID, and order totals — by iterating order IDs.

  140. CVE-2026-15823 4.3 Moyenne

    Builderall for WordPress

    The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() function in versions up to, and including, 3.0.2. The wp_ajax_ba_cheetah_disable AJAX handler is registered without any capability or nonce verification, and the target post_id is sourced directly from user-controlled $_POST['ba_cheetah_data']['post_id']. This makes it possible for authenticated attackers, with Subscriber-level access and above, to disable the page builder layout on arbitrary posts by setting the _ba_cheetah_enabled post meta to false, including on posts owned by other users.

  141. CVE-2026-19797 6.1 Moyenne

    gm_alex User Access Manager

    The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and including, 2.3.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

  142. CVE-2026-15406 7.5 Élevée

    arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce

    The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

  143. CVE-2024-12145 4.3 Moyenne

    BuddyPress

    The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_action_bulk_manage due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete/mark as read/mark as unread notifications of other users.

  144. CVE-2026-63075 7.5 Élevée

    OpenSSL · Openssl openssl

    Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service. The fix is to ensure that we account for the transmission of the ACK-only packet in the packet histories high and low watermark without actually storing the ACK-only packet metadata itself. FIPS impact: no The OpenSSL FIPS module is not affected as the QUIC code is outside the FIPS module boundary.

  145. CVE-2026-62139 4.3 Moyenne

    Google Site Kit by Google

    Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions.

  146. CVE-2026-62138 6.5 Moyenne

    Visual Composer Website Builder

    Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions.

  147. CVE-2026-62134 4.3 Moyenne

    Brainstorm Force Starter Templates

    Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions.

  148. CVE-2026-62133 5.4 Moyenne

    rometheme RTMKit

    Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions.

  149. CVE-2026-62112 7.6 Élevée

    Melograno Venture Studio Amelia

    Editor SQL Injection in Amelia <= 2.4.9 versions.

  150. CVE-2026-62111 6.5 Moyenne

    Ido Kobelkowsky Simple Payment

    Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions.