Veille CVE

Samedi 10 octobre 2026

250 CVE sur 343

Critique 80 Élevée 134 Moyenne 116 Faible 10 Non évaluée 3 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-97853 6.9 Moyenne

    ericmj decimal

    Memory Allocation with Excessive Size Value vulnerability in ericmj decimal allows Denial of Service. Decimal.round/3 builds the full result for the requested number of decimal places before the context precision (34 digits by default) is applied, so its cost grows with the places argument instead of with the size of the result. For positive places it appends places zero digits to the coefficient as a charlist before converting it to an integer, and for negative places it builds a charlist of -places zero digits. A single call such as Decimal.round(Decimal.new("1.5"), -50_000_000) allocates about 5.5 GB of memory, which can exhaust available memory and get the BEAM VM killed. The oldest releases instead loop once per decimal place, consuming CPU in proportion to places. Any application that passes a user-supplied number of decimal places or scale to Decimal.round/2 or Decimal.round/3 without bounding it is exposed. The input limits added for CVE-2026-32686 do not cover the places argument. This issue affects decimal: from 0.1.0 before 3.1.2.

  2. CVE-2026-78534 7.1 Élevée

    Keen IT Solutions Educavo

    Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.

  3. CVE-2026-78532 7.1 Élevée

    designthemes LMS

    Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.

  4. CVE-2026-78530 7.7 Élevée

    Chimpstudio FoodBakery

    Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.

  5. CVE-2026-66566 8.1 Élevée

    Elated-Themes Ambient

    Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.

  6. CVE-2026-66481 6.8 Moyenne

    Presto Player Pro

    Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions.

  7. CVE-2026-66480 5.3 Moyenne

    YITH WooCommerce Product Add-Ons

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Retrieve Embedded Sensitive Data. This issue affects YITH WooCommerce Product Add-Ons: from n/a through 4.34.0.

  8. CVE-2026-65459 7.5 Élevée

    WPMU DEV Forminator

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

  9. CVE-2026-62130 7.2 Élevée

    Amir Helzer WooCommerce Multilingual & Multicurrency

    Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.

  10. CVE-2026-62118 7.3 Élevée

    Dmitry V. Barcode Scanner with Inventory & Order Manager

    Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  11. CVE-2026-62117 8.5 Élevée

    Dmitry V. Barcode Scanner with Inventory & Order Manager

    Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  12. CVE-2026-62116 7.1 Élevée

    Dmitry V. Barcode Scanner with Inventory & Order Manager

    Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  13. CVE-2026-62115 8.1 Élevée

    kutethemes KuteShop

    Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.

  14. CVE-2026-62100 7.1 Élevée

    kutethemes KuteShop

    Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.

  15. CVE-2026-62099 8.1 Élevée

    kutethemes Boutique

    Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.

  16. CVE-2026-62098 6.5 Moyenne

    kutethemes Boutique

    Unauthenticated Content Injection in Boutique <= 2.3.3 versions.

  17. CVE-2026-62096 8.1 Élevée

    kutethemes Biolife

    Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.

  18. CVE-2026-62095 7.1 Élevée

    kutethemes Biolife

    Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.

  19. CVE-2026-62094 8.1 Élevée

    kutethemes TechOne

    Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.

  20. CVE-2026-62093 7.1 Élevée

    kutethemes TechOne

    Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.

  21. CVE-2026-62092 8.1 Élevée

    kutethemes Armania

    Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.

  22. CVE-2026-62091 7.1 Élevée

    kutethemes Armania

    Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.

  23. CVE-2026-62082 7.1 Élevée

    An-Themes Pin WP

    Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.

  24. CVE-2026-62075 8.1 Élevée

    Mymoun Backhoe

    Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.

  25. CVE-2026-62074 8.1 Élevée

    ThemeREX Ozeum

    Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.

  26. CVE-2026-62070 8.1 Élevée

    CKThemes Flipmart

    Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.

  27. CVE-2026-62069 8.1 Élevée

    CocoBasic Fabius

    Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.

  28. CVE-2026-62068 8.1 Élevée

    CocoBasic Teoro

    Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.

  29. CVE-2026-62067 8.1 Élevée

    CocoBasic Kaven

    Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.

  30. CVE-2026-62066 8.1 Élevée

    CocoBasic Volos

    Unauthenticated Local File Inclusion in Volos <= 1.2 versions.

  31. CVE-2026-62065 8.1 Élevée

    CocoBasic Cardea

    Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.

  32. CVE-2026-62064 7.1 Élevée

    Bracketweb Ambed

    Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.

  33. CVE-2026-62043 7.5 Élevée

    sevenspark Contact Form 7 – Dynamic Text Extension

    Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.

  34. CVE-2026-62038 7.3 Élevée

    DigitalME eRoom

    Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

  35. CVE-2026-62037 7.1 Élevée

    bPlugins Document Embedder

    Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.

  36. CVE-2026-62035 6.3 Moyenne

    upcasted AWS S3 for WordPress Plugin – Upcasted

    Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

  37. CVE-2026-62034 7.1 Élevée

    bPlugins Before After Image Comparison – Image comparison for WP

    Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.

  38. CVE-2026-62033 7.6 Élevée

    Stylemix uListing

    Subscriber Settings Change in uListing <= 2.2.0 versions.

  39. CVE-2026-62030 7.2 Élevée

    bPlugins StreamCast

    Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.

  40. CVE-2026-62027 7.1 Élevée

    bPlugins Team Section Block

    Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.

  41. CVE-2026-62021 8.8 Élevée

    rascals Angio

    Subscriber PHP Object Injection in Angio <= 1.1.1 versions.

  42. CVE-2026-62020 8.1 Élevée

    Mikado-Themes TouchUp

    Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.

  43. CVE-2026-57742 7.1 Élevée

    ThemeREX Group Kids Planet

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2.

  44. CVE-2026-48194 8.1 Élevée

    kutethemes DukaMarket

    Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.

  45. CVE-2026-48193 8.1 Élevée

    kutethemes Uminex

    Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.

  46. CVE-2026-45440 7.6 Élevée

    Smackcoders Inc. WP Ultimate CSV Importer

    Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.

  47. CVE-2026-42777 8.1 Élevée

    Edge-Themes Aalto

    Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.

  48. CVE-2026-42724 8.1 Élevée

    AncoraThemes CleanSkin

    Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.

  49. CVE-2026-42722 7.6 Élevée

    Shabti Kaplan Frontend Admin by DynamiApps

    Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.

  50. CVE-2026-42717 7.6 Élevée

    VaultDweller Leyka

    Administrator SQL Injection in Leyka <= 3.32.3 versions.

  51. CVE-2026-42715 7.1 Élevée

    10Web Photo Gallery by 10Web

    Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

  52. CVE-2026-42712 8.5 Élevée

    Qode Tours

    Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.

  53. CVE-2026-42711 7.1 Élevée

    10Web Slider by 10Web

    Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

  54. CVE-2026-42709 7.1 Élevée

    RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce

    Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

  55. CVE-2026-42706 7.5 Élevée

    ThemeGoods DK

    Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

  56. CVE-2026-42705 7.5 Élevée

    ThemeGoods Grand News

    Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

  57. CVE-2026-42704 8.1 Élevée

    axiomthemes Kids Care

    Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.

  58. CVE-2026-42702 7.1 Élevée

    Themeum Tutor LMS

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

  59. CVE-2026-42699 7.1 Élevée

    FolioVision FV Player 8

    Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

  60. CVE-2026-42697 7.1 Élevée

    Inisev Social Share Icons & Social Share Buttons

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5.

  61. CVE-2026-42693 7.1 Élevée

    TieLabs Jannah

    Unauthenticated Cross Site Scripting (XSS) in Jannah <= 7.6.5 versions.

  62. CVE-2026-42633 8.5 Élevée

    Marcus Events Manager

    Subscriber SQL Injection in Events Manager <= 7.4.6 versions.

  63. CVE-2026-42632 7.1 Élevée

    Qode Real Estate

    Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

  64. CVE-2026-42631 7.1 Élevée

    Qode Music

    Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

  65. CVE-2026-42630 7.5 Élevée

    Web Plura Backup &amp; Restore Manager

    Unauthenticated Sensitive Data Exposure in Web Plura Backup &amp; Restore Manager <= 0.2.25 versions.

  66. CVE-2026-42419 5.9 Moyenne

    SwishFolio Swish Migrate and Backup

    Unauthenticated Sensitive Data Exposure in Swish Migrate and Backup <= 1.4.0 versions.

  67. CVE-2026-40808 6.5 Moyenne

    Automattic Jetpack VideoPress

    Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

  68. CVE-2026-40805 7.7 Élevée

    PeepSo

    Subscriber Arbitrary File Deletion in PeepSo <= 9.0.5.4 versions.

  69. CVE-2026-40803 7.1 Élevée

    Jotform &#8211; AI Chatbot

    Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

  70. CVE-2026-40802 7.6 Élevée

    Pubjet | پاب‌جت

    Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

  71. CVE-2026-40801 8.1 Élevée

    Wordable

    Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

  72. CVE-2026-40777 8.1 Élevée

    Rashid WPSection

    Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

  73. CVE-2026-39802 8.1 Élevée

    everestthemes Everest Backup

    Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions.

  74. CVE-2026-39800 7.1 Élevée

    Anton Bond Additional Order Filters for WooCommerce

    Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

  75. CVE-2026-39799 7.1 Élevée

    Joomunited WP File Download

    Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

  76. CVE-2026-27350 7.2 Élevée

    Builderius.io Builderius

    Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

  77. CVE-2026-108604 6.3 Moyenne

    TabularisDB tabularis

    Tabularis through 0.27.0 contains an incorrect authorization vulnerability in the MCP run_query safety gate that allows prompt-injected agents or untrusted MCP clients to bypass read-only mode by submitting side-effecting SELECT statements. Attackers can run statements like SELECT setval, nextval, or PostgreSQL query_to_xml with embedded DELETE to modify data without approval prompts.

  78. CVE-2026-108602 4.3 Moyenne

    helicone

    Helicone through v2025.08.21-1 contains a server-side request forgery vulnerability in the Jawn webhook sender that allows authenticated organization users to reach internal services by using hostnames resolving to private addresses. Attackers can create webhooks with public hostnames that resolve or DNS-rebind to loopback or internal addresses, causing blind POST requests to internal HTTPS services.

  79. CVE-2026-107434 5.4 Moyenne

    videowhisper MicroPayments

    Subscriber Bypass Vulnerability in MicroPayments <= 3.2.9 versions.

  80. CVE-2026-107420 5.3 Moyenne

    Narinder Singh Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway

    Unauthenticated Bypass Vulnerability in Pay With MetaMask For WooCommerce – Cryptocurrency Payment Gateway <= 1.7.2 versions.

  81. CVE-2026-103685 4.3 Moyenne

    VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce

    Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce: from n/a through 2.2.4.

  82. CVE-2026-96341 8.2 Élevée

    WPMU DEV Forminator

    Incorrect Privilege Assignment vulnerability in WPMU DEV Forminator forminator allows Privilege Escalation.This issue affects Forminator: from n/a through 1.57.3.

  83. CVE-2026-94590 6.5 Moyenne

    CodePeople2 Sell Downloads

    Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3.

  84. CVE-2026-57806 7.1 Élevée

    drfuri Martfury - WooCommerce Marketplace WordPress Theme

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in drfuri Martfury - WooCommerce Marketplace WordPress Theme martfury allows Reflected XSS.This issue affects Martfury - WooCommerce Marketplace WordPress Theme: from n/a through 3.3.9.

  85. CVE-2026-108600 4.7 Moyenne

    open-multi-agent

    open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that allows attackers to create files outside the workspace root by using dangling symlinks. Attackers can plant a dangling symlink in the workspace and steer the agent via prompt injection to write attacker-influenced content anywhere the agent process can write.

  86. CVE-2026-108599 4.7 Moyenne

    pulseaiclub phi

    phi 0.1.1 through 0.28.4 contains an improper link resolution vulnerability that allows malicious repositories to bypass workspace_only_writes by exploiting lexical-only path checks in the permission gate. Attackers can commit symlinks pointing outside the workspace and use prompt injection to make the write tool write attacker-influenced content to external files without approval.

  87. CVE-2026-108597 4.8 Moyenne

    cohere-ai cohere-python

    Cohere Python SDK 5.11.0 through 7.2.0 contains a path traversal (tar slip) vulnerability in _s3_models_dir_to_tarfile that allows arbitrary file write via unvalidated tarfile.extractall calls. Attackers who can write model archives to the victim's S3 prefix can include absolute paths or ../ members to overwrite files on the SDK host.

  88. CVE-2026-108596 5.3 Moyenne

    openlit

    OpenLIT 2.1.0 contains an authorization bypass vulnerability that allows authenticated users to read other projects' telemetry by supplying a forged x-openlit-project-id header. Attackers who know a victim project id and database config id can query the trace read API to obtain traces including LLM prompts and completions.

  89. CVE-2026-108595 5.3 Moyenne

    pulseaiclub phi

    Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and readonly mode by supplying an unchecked workdir to agent_spawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker rooted elsewhere, causing unapproved file writes anywhere the user can write.

  90. CVE-2026-108593 6.4 Moyenne

    decolua 9router

    9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and newlines to add hooks_auto_accept and a hooks.post_llm_call shell command, which Hermes Agent executes without approval after an LLM call.

  91. CVE-2026-108592 5.3 Moyenne

    SWE-agent mini-swe-agent

    mini-swe-agent 1.10.0 through 2.4.6 contains an information exposure vulnerability in BubblewrapEnvironment because bwrap omits --clearenv, so sandboxed commands inherit the host environment. Attackers using prompt injection in processed task content can make the agent read API keys from the environment and exfiltrate them over the shared network.

  92. CVE-2026-108591 4.4 Moyenne

    innocommerce InnoShop

    InnoShop 0.9.2 contains a local file disclosure vulnerability that allows authenticated administrators with files_create permission to read server files by abusing the AI Core MCP file_upload tool's source argument. Attackers can supply file:// or php:// stream wrappers passed to file_get_contents(), storing contents on the public media disk to expose the .env file with APP_KEY and database credentials.

  93. CVE-2026-94160 7.1 Élevée

    ThemeStek Extras for LabtechCO Theme

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4.

  94. CVE-2026-62044 7.2 Élevée

    bPlugins Super Video Player

    Deserialization of Untrusted Data vulnerability in bPlugins Super Video Player super-video-player allows Object Injection.This issue affects Super Video Player: from n/a through 1.8.13.

  95. CVE-2026-108586 5.4 Moyenne

    1mcp-app @1mcp/agent

    1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass OAuth tag-scope enforcement using negated advanced tag-filter expressions. Attackers holding a single-tag token can send a filter like not <granted-tag> to list and invoke tools on backend MCP servers outside their granted scopes.

  96. CVE-2026-108585 5.4 Moyenne

    argoproj-labs argocd-mcp

    argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions.

  97. CVE-2026-106609 7.5 Élevée

    Web Impian Bayarcash WooCommerce

    Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

  98. CVE-2026-106608 7.2 Élevée

    Automattic WooCommerce

    Incorrect Privilege Assignment vulnerability in Automattic WooCommerce woocommerce allows Privilege Escalation.This issue affects WooCommerce: from 9.8.0 through 11.1.2.

  99. CVE-2026-103357 6.9 Moyenne

    VillaTheme GIFT4U

    Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3.

  100. CVE-2026-103071 7.5 Élevée

    VillaTheme Thank You Page Customizer for WooCommerce

    Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3.

  101. CVE-2026-108583 4.2 Moyenne

    54yyyu zotero-mcp

    zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation. Attackers can steer the agent via prompt injection into calling zotero_add_by_url, causing requests to loopback, private, or link-local hosts directly or via redirects, leaking citation meta-tags and error details.

  102. CVE-2026-108582 5.5 Moyenne

    genspark-ai GenOffice

    GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged users to read uploaded and generated documents. Attackers can list the world-readable genoffice-mcp-http directory under the system temporary directory to read client uploads and converted outputs, bypassing the HTTP bearer token.

  103. CVE-2026-108581 6.5 Moyenne

    TencentCloud Octop

    TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query these endpoints, which only validate the JWT, to obtain plaintext LLM and voice provider API keys and abuse the upstream provider accounts.

  104. CVE-2026-108580 6.5 Moyenne

    phoenixthrush AniWorld Downloader

    AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler that allows unauthenticated attackers to guess passwords without throttling. Attackers can enumerate usernames through verify_user response timing and brute-force passwords on exposed WebUI instances to take over accounts.

  105. CVE-2026-108579 4.2 Moyenne

    Openpanel-dev openpanel

    OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas by supplying crafted profile IDs to the /track endpoint. Attackers can send tracking events with profile IDs like =HYPERLINK(...) matching a cohort, so exported cohort CSVs execute formulas that exfiltrate adjacent cell data.

  106. CVE-2026-108555 4.2 Moyenne

    schlagmichdoch PairDrop

    PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery rooms by supplying a forged cf-connecting-ip header. Attackers who know a victim's public IP can appear as a local device on self-hosted instances not behind Cloudflare to send or receive files.

  107. CVE-2026-108554 5.3 Moyenne

    PDFMathTranslate

    PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs.

  108. CVE-2026-108553 7.5 Élevée

    OpenRefine

    OpenRefine through 3.10.1 contains a cross-site request forgery vulnerability in the get-rows command that allows remote attackers to execute Jython facet expressions. Attackers can lure a user to a malicious page issuing a cross-origin GET with a crafted engine parameter, executing operating system commands as the OpenRefine user.

  109. CVE-2026-108550 8.8 Élevée

    iflytek skillhub

    SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authenticated attackers to take over other accounts by abusing the merge flow. Attackers can call the merge initiate endpoint with a target username or OAuth identity, receive the verification token directly, and confirm the merge to inherit the victim's API tokens, roles and namespace ownership.

  110. CVE-2026-108549 8.1 Élevée

    chenhg5 cc-connect

    cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

  111. CVE-2026-108548 7.3 Élevée

    iflytek astron-rpa

    AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer token without validation. Unauthenticated attackers can send arbitrary Bearer values to reach /api/resource/ and /api/rpa-ai-service/ routes and spoof X-User-Id or user_id headers to act as any user.

  112. CVE-2026-108547 6.5 Moyenne

    iflytek astron-rpa

    AstronRPA through 1.1.6 contains a missing tenant authorization check in robot-service that allows authenticated users to read other tenants' shared variables via the get-batch-shared-var endpoint. Attackers can enumerate sequential shared variable IDs and decrypt all-users variables re-encrypted with their own tenant key to recover other tenants' credentials in plaintext.

  113. CVE-2026-108546 7.5 Élevée

    spotweb

    Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process.

  114. CVE-2026-108545 5.9 Moyenne

    SillyTavern

    SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resources because body-parser middleware runs before authentication and whitelist checks. Attackers can send large or compressed JSON or urlencoded bodies up to 500 MB, optionally in parallel, to exhaust memory and CPU and deny service.

  115. CVE-2026-108115 4.9 Moyenne

    kortix-ai suna

    Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateIp guard by supplying IPv6 6to4 or Teredo addresses that embed private IPv4 destinations. Attackers holding project.connector.write can set connector base_url, OpenAPI, Postman, or MCP URLs to reach internal services and cloud metadata endpoints and read responses.

  116. CVE-2026-108114 4.3 Moyenne

    strapi

    Strapi 5.47.0 through 5.57.0 contains an improper authorization vulnerability that allows admin API tokens to retain all-field Content Manager access after the owner's role is field-restricted. Because reconcileTokenPermissionsToUserCeiling ignores token permissions with omitted or null fields, token holders can keep reading content fields an administrator removed from the role.

  117. CVE-2026-97264 7.1 Élevée

    Greg Winiarski WPAdverts

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Reflected XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  118. CVE-2026-97263 7.1 Élevée

    Greg Winiarski WPAdverts

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows Stored XSS.This issue affects WPAdverts: from n/a through 2.3.4.

  119. CVE-2026-94676 7.2 Élevée

    Tainacan Community Tainacan

    Deserialization of Untrusted Data vulnerability in Tainacan Community Tainacan tainacan allows Object Injection.This issue affects Tainacan: from n/a through 1.3.0.

  120. CVE-2026-66435 5.9 Moyenne

    Devin Walker WP Rollback

    Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2.

  121. CVE-2026-108165 4.3 Moyenne

    immich-app immich

    Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attackers with an active partner relationship can call POST /api/sync/stream with PartnerAssetsV2 and PartnerAssetExifsV1 types to obtain GPS coordinates, capture times, descriptions and camera details.

  122. CVE-2026-108164 6.5 Moyenne

    opensource-socialnetwork

    Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification.

  123. CVE-2026-108163 6.5 Moyenne

    smp46 pingvin-share-x

    Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are interpreted as milliseconds. Unauthenticated attackers can send effectively unthrottled requests to /api/auth/signIn, /api/auth/signIn/totp and /api/auth/resetPassword to brute-force passwords and TOTP codes.

  124. CVE-2026-108162 6.5 Moyenne

    smp46 pingvin-share-x

    Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP throttling because backend/src/main.ts unconditionally trusts proxy headers. Attackers can rotate spoofed X-Forwarded-For values against /api/auth/signIn, /api/auth/signIn/totp, and /api/auth/resetPassword to brute-force passwords and TOTP codes and forge logged client IP addresses.

  125. CVE-2026-108161 7.5 Élevée

    fusionpbx

    FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers to execute commands by placing calls with malicious caller ID values. When the record_name filename template is enabled, attackers can embed shell metacharacters like $(...) in the Caller-ID name or number, executing commands as the web server user once a privileged user downloads multiple recordings as a ZIP.

  126. CVE-2026-105885 8.8 Élevée

    10Web Slider by 10Web

    Deserialization of Untrusted Data vulnerability in 10Web Slider by 10Web slider-wd allows Object Injection.This issue affects Slider by 10Web: from n/a through 1.2.62.

  127. CVE-2026-102388 7.1 Élevée

    WPMU DEV Forminator

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

  128. CVE-2026-107794 7.5 Élevée

    ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion. Note that a similar issue was fixed in ExtUtils::Typemaps::STL::Vector version 1.05.

  129. CVE-2013-10076 7.5 Élevée

    ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list. The OUTPUT typemaps call av_extend( av, len-1 ). On an empty list, this undeflows, and av_extend will allocate an array with 2^32 slots, leading to memory exhaustion.

  130. CVE-2026-103636 7.5 Élevée

    Apache Software Foundation Apache DataSketches

    Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() read the 32-byte preamble of a non-empty union after checking that only 8 bytes were available, so a truncated serialized union could cause a read of up to 24 bytes past the end of the input. For such inputs, the size remaining for the embedded sketch was also computed by an unsigned subtraction that could wrap around, so the embedded sketch's own size checks no longer limited reads to the input. The bytes read can become part of the deserialized union's state. This can cause a crash (denial of service) and could expose adjacent memory contents. This issue affects Apache DataSketches C++: from 2.0.0-incubating before 5.3.0. Only applications that deserialize VarOpt unions from untrusted sources are affected. Users are recommended to upgrade to version 5.3.0, which fixes this issue.

  131. CVE-2026-108506 5.5 Moyenne

    ZTE Z80 Ultra

    ZTE Z80 Ultra's system interfaces do not have robust invocation authentication, with inadequate access control. Third-party apps may call the interfaces through reflection and retrieve relevant information.

  132. CVE-2026-106139 5.4 Moyenne

    Progress Software Kendo UI for Vue

    In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.

  133. CVE-2026-106138 5.4 Moyenne

    Progress Software KendoReact

    In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.

  134. CVE-2026-91136 7.5 Élevée

    Divi Essential Divi Plus

    The Divi Plus plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 2.4.0 via the 'svg_image' parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. This is due to the endpoint's permission callback (SVGAnimatorController::index_permission) returning true unconditionally combined with insufficient validation of the 'svg_image' input — sanitize_text_field() and esc_html() do not restrict filesystem paths, the file:// stream wrapper, or arbitrary URLs — before it is passed to file_get_contents() (with a wp_remote_get() fallback) and the raw response body is returned in the JSON 'html' field. This makes it possible for unauthenticated attackers to read arbitrary files on the affected site's server which may make remote code execution possible.

  135. CVE-2026-4791 6.4 Moyenne

    PeproDev Ultimate Profile Solutions

    The PeproDev Ultimate Profile Solutions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `logout-url` shortcode's 'button' attribute in all versions up to, and including, 8.2.36 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  136. CVE-2026-107657 7.2 Élevée

    HivePress – Business Directory, Listings & Classified Ads Plugin

    The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have configured a text-type custom user attribute whose display format places %value% inside an HTML attribute context (e.g., the documented pattern &lt;a href="%value%"&gt;Custom link&lt;/a&gt;), and for front-end user profiles to be enabled — both of which reflect the plugin's standard, documented configuration.

  137. CVE-2026-104722 4.9 Moyenne

    webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings

    The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the LSD_Menus_IX_CSV::import function in all versions up to, and including, 6.1.2 This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).

  138. CVE-2026-97396 6.4 Moyenne

    retainful Email Marketing for WordPress and WooCommerce – Retainful

    The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  139. CVE-2026-97340 6.4 Moyenne

    ThemeFusion Avada | Website Builder For WordPress & WooCommerce

    The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields (author_facebook, author_twitter, author_linkedin, author_dribble, author_whatsapp, author_email) in versions up to, and including, 7.16.1. Avada registers these fields through the user_contactmethods filter and, on the author archive, emits them inside an anchor href using only esc_attr() in Fusion_Social_Icon::get_markup(), which escapes HTML metacharacters but does not reject dangerous URL schemes such as javascript:. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses their author page and clicks the injected social icon (a click is required, and the site must have 'Open Social Icons in a New Window' set to Off so the browser doesn't block the javascript: URL from opening in a new tab).

  140. CVE-2026-96765 7.2 Élevée

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)

    The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id_token' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored in the wpo365_errors transient for up to three days by submitting a crafted unauthenticated request with a forged id_token whose base64url-decoded unique_name or iss claim contains malicious HTML, requiring no prior authentication or user interaction beyond an administrator later visiting the WPO365 wizard page.

  141. CVE-2026-96662 7.5 Élevée

    latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

    The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

  142. CVE-2026-96653 6.5 Moyenne

    wpdirectorykit WP Directory Kit

    The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink.

  143. CVE-2026-96563 6.4 Moyenne

    stylemix Motors – Car Dealership & Classified Listings Plugin

    The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce required by the stm_ajax_add_a_car AJAX handler is emitted in wp_footer on every page, making it accessible to any authenticated user and removing any practical barrier to exploitation at the Subscriber level.

  144. CVE-2026-96278 7.2 Élevée

    opajaap WP Photo Album Plus

    The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The bypass works because esc_url_raw() strips literal angle brackets but retains HTML entities, which wppaEntityDecode() silently converts back to live HTML tags before jQuery('#wppa-modal-container').html() renders them.

  145. CVE-2026-93951 7.1 Élevée

    Bracketweb Zeinet

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0.

  146. CVE-2026-93950 7.5 Élevée

    StylemixThemes Motors

    Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

  147. CVE-2026-93949 7.1 Élevée

    Omegathemes Grocery Shopping Store

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Omegathemes Grocery Shopping Store grocery-shopping-store allows Password Recovery Exploitation.This issue affects Grocery Shopping Store: from n/a through 1.3.3.

  148. CVE-2026-93746 7.5 Élevée

    WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels

    The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.0.2 via the 'email' parameter of the guest print_document_from_the_mail_link handler dispatched from print_window() on init. This is due to the handler authorizing access to an order's printable documents when the attacker-supplied (base64-encoded) 'email' equals the order's billing email — a non-secret identifier — instead of requiring the WooCommerce order_key. This makes it possible for unauthenticated attackers, when the site is configured to allow guest access to documents ('wt_pklist_print_button_access_for' != 'logged_in'), to retrieve any other customer's invoice, packing slip, delivery note, dispatch label or shipping label — including customer name, billing/shipping address, phone number, purchased products, prices, taxes and invoice metadata — by knowing the target order ID and the associated billing email address.

  149. CVE-2026-108504 5.5 Moyenne

    ZTE Z80 Ultra

    ZTE Z80 Ultra has an unauthorized information disclosure vulnerability. The access control for methods within the framework is insufficient. An attacker can exploit this method to read device-related information.

  150. CVE-2026-106606 7.2 Élevée

    YITH WooCommerce Affiliates

    Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This issue affects YITH WooCommerce Affiliates: from n/a through 3.31.0.