Veille CVE

Semaine du 5 octobre au 11 octobre 2026

1 368 CVE

Critique 183 Élevée 483 Moyenne 621 Faible 44 Non évaluée 37 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-108606 5.4 Moyenne

    JeecgBoot

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GET /airag/ocr/list endpoint and repeatedly delete every shared OCR prompt record stored in Redis.

  2. CVE-2026-108605 4.3 Moyenne

    JeecgBoot

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/ocr/edit to overwrite LLM prompts in the shared airag:ocr Redis key, corrupting OCR results for all users.

  3. CVE-2026-97853 6.9 Moyenne

    ericmj decimal

    Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places. Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument. This issue affects decimal: from 0.1.0 before 3.1.2.

  4. CVE-2026-81797 9.8 Critique

    ThemeRex Buzz Stone | Magazine & Viral Blog WordPress Theme

    Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

  5. CVE-2026-78535 9.8 Critique

    ThemeRex Photolia

    Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

  6. CVE-2026-78534 7.1 Élevée

    Keen IT Solutions Educavo

    Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

  7. CVE-2026-78533 9.8 Critique

    AncoraThemes Qwery

    Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

  8. CVE-2026-78532 7.1 Élevée

    designthemes LMS

    Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

  9. CVE-2026-78531 9.8 Critique

    ThemeREX Jacqueline

    Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

  10. CVE-2026-78530 7.7 Élevée

    Chimpstudio FoodBakery

    Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

  11. CVE-2026-78529 9.8 Critique

    ThemeREX Alliance

    Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

  12. CVE-2026-66569 9.8 Critique

    axiomthemes Kicker

    Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

  13. CVE-2026-66568 9.8 Critique

    axiomthemes Original

    Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

  14. CVE-2026-66567 9.8 Critique

    AncoraThemes Anesta

    Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

  15. CVE-2026-66566 8.1 Élevée

    Elated-Themes Ambient

    Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

  16. CVE-2026-66565 9.8 Critique

    axiomthemes FC United

    Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

  17. CVE-2026-66564 9.8 Critique

    ThemeREX ShiftCV

    Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

  18. CVE-2026-66563 9.8 Critique

    ThemeREX Windsor

    Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

  19. CVE-2026-66483 9.8 Critique

    ThemeREX Education Center

    Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

  20. CVE-2026-66482 9.8 Critique

    AncoraThemes Drone Media

    Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

  21. CVE-2026-66481 6.8 Moyenne

    Presto Player Pro

    Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.

  22. CVE-2026-66480 5.3 Moyenne

    YITH WooCommerce Product Add-Ons

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

  23. CVE-2026-65459 7.5 Élevée

    WPMU DEV Forminator

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

  24. CVE-2026-62130 7.2 Élevée

    Amir Helzer WooCommerce Multilingual & Multicurrency

    Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

  25. CVE-2026-62129 9.9 Critique

    WPFunnels Creator LMS

    Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

  26. CVE-2026-62125 9.8 Critique

    ThemeREX Asia Garden

    Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

  27. CVE-2026-62124 9.8 Critique

    ThemeREX N7 | Golf Club Sports & Events

    Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

  28. CVE-2026-62123 9.8 Critique

    ThemeREX Invetex

    Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

  29. CVE-2026-62120 9.8 Critique

    ThemeREX Law Office

    Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

  30. CVE-2026-62118 7.3 Élevée

    Dmitry V. Barcode Scanner with Inventory & Order Manager

    Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  31. CVE-2026-62117 8.5 Élevée

    Dmitry V. Barcode Scanner with Inventory & Order Manager

    Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  32. CVE-2026-62116 7.1 Élevée

    Dmitry V. Barcode Scanner with Inventory & Order Manager

    Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  33. CVE-2026-62115 8.1 Élevée

    kutethemes KuteShop

    Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

  34. CVE-2026-62100 7.1 Élevée

    kutethemes KuteShop

    Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

  35. CVE-2026-62099 8.1 Élevée

    kutethemes Boutique

    Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

  36. CVE-2026-62098 6.5 Moyenne

    kutethemes Boutique

    Unauthenticated Content Injection in Boutique <= 2.3.3 versions.

  37. CVE-2026-62096 8.1 Élevée

    kutethemes Biolife

    Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

  38. CVE-2026-62095 7.1 Élevée

    kutethemes Biolife

    Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

  39. CVE-2026-62094 8.1 Élevée

    kutethemes TechOne

    Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

  40. CVE-2026-62093 7.1 Élevée

    kutethemes TechOne

    Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

  41. CVE-2026-62092 8.1 Élevée

    kutethemes Armania

    Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

  42. CVE-2026-62091 7.1 Élevée

    kutethemes Armania

    Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

  43. CVE-2026-62090 9.8 Critique

    ThemeREX WineShop

    Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.

  44. CVE-2026-62087 9.8 Critique

    ThemeREX Equadio

    Unauthenticated PHP Object Injection in Equadio <= 1.1.4 versions.

  45. CVE-2026-62086 9.8 Critique

    ThemeREX Juno

    Unauthenticated PHP Object Injection in Juno <= 2.25 versions.

  46. CVE-2026-62082 7.1 Élevée

    An-Themes Pin WP

    Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

  47. CVE-2026-62077 9.8 Critique

    BoldThemes Avala

    Unauthenticated PHP Object Injection in Avala <= 1.1.4 versions.

  48. CVE-2026-62076 9.8 Critique

    The4 Kalles

    Unauthenticated PHP Object Injection in Kalles <= 1.1.7.1 versions.

  49. CVE-2026-62075 8.1 Élevée

    Mymoun Backhoe

    Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

  50. CVE-2026-62074 8.1 Élevée

    ThemeREX Ozeum

    Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

  51. CVE-2026-62070 8.1 Élevée

    CKThemes Flipmart

    Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

  52. CVE-2026-62069 8.1 Élevée

    CocoBasic Fabius

    Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

  53. CVE-2026-62068 8.1 Élevée

    CocoBasic Teoro

    Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

  54. CVE-2026-62067 8.1 Élevée

    CocoBasic Kaven

    Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

  55. CVE-2026-62066 8.1 Élevée

    CocoBasic Volos

    Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

  56. CVE-2026-62065 8.1 Élevée

    CocoBasic Cardea

    Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

  57. CVE-2026-62064 7.1 Élevée

    Bracketweb Ambed

    Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

  58. CVE-2026-62054 9.8 Critique

    ThemeREX Yacht Rental

    Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions.

  59. CVE-2026-62053 9.8 Critique

    ThemeREX Wine House

    Unauthenticated PHP Object Injection in Wine House <= 3.20 versions.

  60. CVE-2026-62052 9.8 Critique

    ThemeREX Tipsy

    Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions.

  61. CVE-2026-62051 9.8 Critique

    ThemeREX Stargaze

    Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions.

  62. CVE-2026-62050 9.8 Critique

    ThemeREX Splendour

    Unauthenticated PHP Object Injection in Splendour <= 1.23 versions.

  63. CVE-2026-62043 7.5 Élevée

    sevenspark Contact Form 7 – Dynamic Text Extension

    Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

  64. CVE-2026-62038 7.3 Élevée

    DigitalME eRoom

    Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

  65. CVE-2026-62037 7.1 Élevée

    bPlugins Document Embedder

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

  66. CVE-2026-62035 6.3 Moyenne

    upcasted AWS S3 for WordPress Plugin – Upcasted

    Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

  67. CVE-2026-62034 7.1 Élevée

    bPlugins Before After Image Comparison – Image comparison for WP

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

  68. CVE-2026-62033 7.6 Élevée

    Stylemix uListing

    Subscriber Settings Change in uListing <= 2.2.0 versions.

  69. CVE-2026-62032 9.8 Critique

    Designinvento DirectoryPress

    Unauthenticated Local File Inclusion in DirectoryPress <= 3.6.27 versions.

  70. CVE-2026-62031 9.3 Critique

    Stylemix uListing

    Unauthenticated SQL Injection in uListing <= 2.2.0 versions.

  71. CVE-2026-62030 7.2 Élevée

    bPlugins StreamCast

    Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

  72. CVE-2026-62027 7.1 Élevée

    bPlugins Team Section Block

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

  73. CVE-2026-62025 9.0 Critique

    Tailored Media Tailored Tools

    Unauthenticated Arbitrary File Upload in Tailored Tools <= 3.0.3 versions.

  74. CVE-2026-62024 9.9 Critique

    CodeBard Help Desk

    Subscriber Arbitrary File Upload in CodeBard Help Desk <= 1.1.2 versions.

  75. CVE-2026-62022 9.8 Critique

    Select-Themes Tonda Membership

    Unauthenticated Privilege Escalation in Tonda Membership <= 1.0.1 versions.

  76. CVE-2026-62021 8.8 Élevée

    rascals Angio

    Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

  77. CVE-2026-62020 8.1 Élevée

    Mikado-Themes TouchUp

    Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

  78. CVE-2026-57742 7.1 Élevée

    ThemeREX Group Kids Planet

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

  79. CVE-2026-48194 8.1 Élevée

    kutethemes DukaMarket

    Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

  80. CVE-2026-48193 8.1 Élevée

    kutethemes Uminex

    Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

  81. CVE-2026-45440 7.6 Élevée

    Smackcoders Inc. WP Ultimate CSV Importer

    Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

  82. CVE-2026-42777 8.1 Élevée

    Edge-Themes Aalto

    Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

  83. CVE-2026-42724 8.1 Élevée

    AncoraThemes CleanSkin

    Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

  84. CVE-2026-42723 9.8 Critique

    AncoraThemes CleanSkin

    Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.

  85. CVE-2026-42722 7.6 Élevée

    Shabti Kaplan Frontend Admin by DynamiApps

    Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

  86. CVE-2026-42719 9.8 Critique

    Sarah Giles Dynamic User Directory

    Subscriber PHP Object Injection in Dynamic User Directory <= 2.4 versions.

  87. CVE-2026-42718 9.8 Critique

    Pluggabl Booster for WooCommerce

    Unauthenticated PHP Object Injection in Booster for WooCommerce <= 8.4.0 versions.

  88. CVE-2026-42717 7.6 Élevée

    VaultDweller Leyka

    Administrator SQL Injection in Leyka <= 3.32.3 versions.

  89. CVE-2026-42716 9.8 Critique

    Payever - WooCommerce Gateway

    Unauthenticated PHP Object Injection in Payever - WooCommerce Gateway <= 4.8.2 versions.

  90. CVE-2026-42715 7.1 Élevée

    10Web Photo Gallery by 10Web

    Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

  91. CVE-2026-42712 8.5 Élevée

    Qode Tours

    Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

  92. CVE-2026-42711 7.1 Élevée

    10Web Slider by 10Web

    Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

  93. CVE-2026-42709 7.1 Élevée

    RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce

    Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

  94. CVE-2026-42706 7.5 Élevée

    ThemeGoods DK

    Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

  95. CVE-2026-42705 7.5 Élevée

    ThemeGoods Grand News

    Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

  96. CVE-2026-42704 8.1 Élevée

    axiomthemes Kids Care

    Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

  97. CVE-2026-42702 7.1 Élevée

    Themeum Tutor LMS

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

  98. CVE-2026-42699 7.1 Élevée

    FolioVision FV Player 8

    Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

  99. CVE-2026-42697 7.1 Élevée

    Inisev Social Share Icons & Social Share Buttons

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

  100. CVE-2026-42696 10.0 Critique

    Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning

    Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration &amp; Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration &amp; Cloning: from n/a through 1.5.19.

  101. CVE-2026-42693 7.1 Élevée

    TieLabs Jannah

    Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.

  102. CVE-2026-42633 8.5 Élevée

    Marcus Events Manager

    Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

  103. CVE-2026-42632 7.1 Élevée

    Qode Real Estate

    Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

  104. CVE-2026-42631 7.1 Élevée

    Qode Music

    Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

  105. CVE-2026-42630 7.5 Élevée

    Web Plura Backup &amp; Restore Manager

    Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

  106. CVE-2026-42419 5.9 Moyenne

    SwishFolio Swish Migrate and Backup

    Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

  107. CVE-2026-40808 6.5 Moyenne

    Automattic Jetpack VideoPress

    Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

  108. CVE-2026-40805 7.7 Élevée

    PeepSo

    Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

  109. CVE-2026-40803 7.1 Élevée

    Jotform &#8211; AI Chatbot

    Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

  110. CVE-2026-40802 7.6 Élevée

    Pubjet | پاب‌جت

    Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

  111. CVE-2026-40801 8.1 Élevée

    Wordable

    Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

  112. CVE-2026-40800 9.3 Critique

    ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes

    Subscriber SQL Injection in ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.5.3 versions.

  113. CVE-2026-40777 8.1 Élevée

    Rashid WPSection

    Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

  114. CVE-2026-39802 8.1 Élevée

    everestthemes Everest Backup

    Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

  115. CVE-2026-39801 9.8 Critique

    Sergey AIWU

    Subscriber Privilege Escalation in AIWU <= 1.5.9 versions.

  116. CVE-2026-39800 7.1 Élevée

    Anton Bond Additional Order Filters for WooCommerce

    Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

  117. CVE-2026-39799 7.1 Élevée

    Joomunited WP File Download

    Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

  118. CVE-2026-27350 7.2 Élevée

    Builderius.io Builderius

    Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

  119. CVE-2026-108604 6.3 Moyenne

    TabularisDB tabularis

    Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.

  120. CVE-2026-108603 3.3 Faible

    addsumtech slide-maker

    slide-maker through 5.8.0 contains a path traversal vulnerability in generate_images_openai.py that allows attackers to write image files outside the output directory via manifest-supplied filenames. Attackers can influence deck source material so the image prompt manifest contains ../ or symlinked filenames, creating directories and overwriting existing files at arbitrary paths.

  121. CVE-2026-108602 4.3 Moyenne

    helicone

    Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.

  122. CVE-2026-107434 5.4 Moyenne

    videowhisper MicroPayments

    Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.

  123. CVE-2026-107420 5.3 Moyenne

    Narinder Singh Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway

    Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.

  124. CVE-2026-103685 4.3 Moyenne

    VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce

    Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.

  125. CVE-2026-96341 8.2 Élevée

    WPMU DEV Forminator

    Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

  126. CVE-2026-94590 6.5 Moyenne

    CodePeople2 Sell Downloads

    Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.

  127. CVE-2026-57806 7.1 Élevée

    drfuri Martfury - WooCommerce Marketplace WordPress Theme

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.

  128. CVE-2026-108600 4.7 Moyenne

    open-multi-agent

    open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.

  129. CVE-2026-108599 4.7 Moyenne

    pulseaiclub phi

    phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.

  130. CVE-2026-108598 9.8 Critique

    floci-io floci

    Floci 1.1.0 before 2.2.0 contains a code injection vulnerability in VtlTemplateEngine that allows unauthenticated attackers to execute commands via unrestricted Velocity mapping templates. Attackers can create a REST API with a MOCK integration whose template uses $util reflection to reach Runtime or ProcessBuilder, executing OS commands in the Floci JVM.

  131. CVE-2026-108597 4.8 Moyenne

    cohere-ai cohere-python

    Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.

  132. CVE-2026-108596 5.3 Moyenne

    openlit

    OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.

  133. CVE-2026-108595 5.3 Moyenne

    pulseaiclub phi

    Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.

  134. CVE-2026-108594 3.5 Faible

    mealie-recipes mealie

    Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when allowlisting the identity provider hostname. Authenticated OIDC users who control their picture URL can make the server send GET requests to arbitrary ports on the provider's internal address on each login.

  135. CVE-2026-108593 6.4 Moyenne

    decolua 9router

    9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.

  136. CVE-2026-108592 5.3 Moyenne

    SWE-agent mini-swe-agent

    mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.

  137. CVE-2026-108591 4.4 Moyenne

    innocommerce InnoShop

    InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.

  138. CVE-2026-106610 9.8 Critique

    miniorange otp verification

    Incorrect Privilege Assignment vulnerability in miniOrange miniorange otp verification miniorange-otp-verification allows Privilege Escalation.This issue affects miniorange otp verification: from n/a through 5.5.7.

  139. CVE-2026-105892 9.8 Critique

    rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Path Traversal.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.13.

  140. CVE-2026-94160 7.1 Élevée

    ThemeStek Extras for LabtechCO Theme

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.

  141. CVE-2026-62044 7.2 Élevée

    bPlugins Super Video Player

    Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

  142. CVE-2026-108586 5.4 Moyenne

    1mcp-app @1mcp/agent

    1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to list and invoke tools on backend MCP servers outside their granted scopes.

  143. CVE-2026-108585 5.4 Moyenne

    argoproj-labs argocd-mcp

    argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.

  144. CVE-2026-106609 7.5 Élevée

    Web Impian Bayarcash WooCommerce

    Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

  145. CVE-2026-106608 7.2 Élevée

    Automattic WooCommerce

    Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

  146. CVE-2026-105889 9.3 Critique

    Tickera

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tickera Tickera tickera-event-ticketing-system allows Blind SQL Injection.This issue affects Tickera: from n/a through 3.6.0.6.

  147. CVE-2026-104398 9.8 Critique

    VillaTheme AFFI – Affiliate Marketing for WooCommerce

    Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.10.

  148. CVE-2026-103357 6.9 Moyenne

    VillaTheme GIFT4U

    Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3.

  149. CVE-2026-103071 7.5 Élevée

    VillaTheme Thank You Page Customizer for WooCommerce

    Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

  150. CVE-2026-108583 4.2 Moyenne

    54yyyu zotero-mcp

    zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.