CVE records
39770 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.
| CVE | Title | Published | Top score | KEV |
|---|---|---|---|---|
| CVE-2026-120522 | Cloud Storage Manager for Fluent Forms <= 1.2.0 - Unauthenticated Arbitrary File Write via Google Drive Filename Path Traversal | 14 Nov 2026 | 9.8 | |
| CVE-2025-71464 | @kolkov/angular-editor before 3.0.4 XSS via toggleEditorMode() | 14 Nov 2026 | 6.1 | |
| CVE-2025-71465 | @kolkov/angular-editor before 3.0.3 XSS via refreshView() | 14 Nov 2026 | 6.1 | |
| CVE-2026-129428 | Pulse 5.0.17 before 6.8.0 Missing Authorization via AI Assistant Approval API | 14 Nov 2026 | 5.4 | |
| CVE-2026-129429 | Frappe india-payroll before 16.0.4 Missing Authorization via Tax Regime Selector | 14 Nov 2026 | 7.1 | |
| CVE-2026-129430 | axeloz filesharing before 2.14.3 Stored XSS via Bundle Description Markdown Links | 14 Nov 2026 | 5.4 | |
| CVE-2026-129431 | Ettercap through 0.8.5.1 Heap Out-of-Bounds Read via SOCKS5 Dissector | 14 Nov 2026 | 7.1 | |
| CVE-2026-129432 | Ettercap through 0.8.5.1 Heap Out-of-Bounds Read in NFS mountd Dissector | 14 Nov 2026 | 7.1 | |
| CVE-2026-129433 | Dokploy before 0.31.1 OS Command Injection via Compose Backup serviceName | 14 Nov 2026 | 9.9 | |
| CVE-2026-129255 | CoolerMaster MASTERPLUS+ Device Driver WinRing0x64.sys sub_11504 default permission | 14 Nov 2026 | 9.3 | |
| CVE-2026-129254 | Opixido OCMS Admin TUI index.php cross site scripting | 14 Nov 2026 | 5.3 | |
| CVE-2026-129115 | JSON::XS versions from 3.0 before 4.05 for Perl read freed stack memory when a FREEZE result's serialisation grows the Perl stack under allow_tags in encode_rv | 14 Nov 2026 | ||
| CVE-2026-129114 | JSON::XS versions from 3.04 before 4.05 for Perl write one byte past a heap buffer when appending a one-byte chunk in incr_parse | 14 Nov 2026 | ||
| CVE-2026-129113 | JSON::XS versions from 4.0_00 before 4.05 for Perl corrupt the incremental buffer length by chopping past its end in incr_skip after a top-level number | 14 Nov 2026 | ||
| CVE-2026-124541 | JSON::XS versions before 4.05 for Perl leak the decoded part of a rejected long string in decode_str | 14 Nov 2026 | ||
| CVE-2026-124540 | JSON::XS versions before 4.05 for Perl allow stack exhaustion via nested tagged values under allow_tags in decode_tag | 14 Nov 2026 | ||
| CVE-2026-124539 | JSON::XS versions before 4.05 for Perl leak the decoded key of an object rejected for a missing colon in decode_hv | 14 Nov 2026 | ||
| CVE-2026-124536 | JSON::XS versions before 4.05 for Perl allow memory exhaustion by buffering incremental input past max_size after a NUL byte in incr_parse | 14 Nov 2026 | ||
| CVE-2026-129251 | hrshadhin CloudSchool Event Description EventController.php cross site scripting | 14 Nov 2026 | 4.8 | |
| CVE-2026-129250 | Edimax BR6478ACV2 webs formPPTPSetup buffer overflow | 14 Nov 2026 | 9.9 | |
| CVE-2026-129427 | Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO | 14 Nov 2026 | 8.7 | |
| CVE-2026-129248 | Akaunting Invoice Item Validation helpers.php calculation_to_quantity numeric range comparison without minimum check | 14 Nov 2026 | 5.3 | |
| CVE-2026-129247 | yangzongzhuan RuoYi Code Generator VelocityUtils.java VelocityUtils.getFileName path traversal | 14 Nov 2026 | 5.8 | |
| CVE-2026-18742 | Flatsome <= 3.20.12 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and 'title' Attributes via Custom HTML Block | 14 Nov 2026 | 6.4 | |
| CVE-2026-129181 | projectworlds Visitor Management System Login Endpoint user%20page.php mysqli_query sql injection | 14 Nov 2026 | 7.5 | |
| CVE-2026-129319 | create-ecdh: computeSecret does not validate that the peer public key is on the curve (invalid-curve attack) | 14 Nov 2026 | 8.2 | |
| CVE-2026-126697 | Quick Page/Post Redirect 5.2.1 - 5.2.3 - Backdoor via Off-Repository Update Channel | 14 Nov 2026 | ||
| CVE-2026-126640 | WP Ultimate CSV Importer < 9.3 - Admin+ SQLi via LifterLMS Import | 14 Nov 2026 | ||
| CVE-2026-126639 | WP Ultimate CSV Importer (Free & Pro) - Unauthenticated Post Data Disclosure via Predictable Single Export Path | 14 Nov 2026 | ||
| CVE-2026-124649 | Lightbox with PhotoSwipe < 5.19.0 - Unauthenticated Stored XSS via Comment Link Title | 14 Nov 2026 | ||
| CVE-2026-123122 | Checkout Files Upload for WooCommerce 2.4.0 - Unauthenticated Stored XSS via Uploaded File | 14 Nov 2026 | ||
| CVE-2026-123046 | SEOJuice < 2.12.0 - Administrator Account Creation via CSRF | 14 Nov 2026 | ||
| CVE-2026-119258 | Swipe <= 1.4 - Unauthenticated Authentication Bypass | 14 Nov 2026 | ||
| CVE-2026-118183 | Copy & Delete Posts < 1.5.8 - Authenticated Post Publishing Restriction Bypass | 14 Nov 2026 | ||
| CVE-2026-118182 | Copy & Delete Posts < 1.5.8 - Authenticated Arbitrary Post Slug Takeover | 14 Nov 2026 | ||
| CVE-2026-118181 | Copy & Delete Posts < 1.5.8 - Authenticated Plugin Settings and Access Control Modification | 14 Nov 2026 | ||
| CVE-2026-117490 | Flatsome < 3.20.13 - Contributor+ Post Type and Status Overwrite via ux_builder_save | 14 Nov 2026 | ||
| CVE-2026-117487 | Flatsome < 3.20.13 - Unauthenticated Unpublished Post Disclosure via flatsome_ajax_apply_shortcode | 14 Nov 2026 | ||
| CVE-2026-116528 | Chargely Free Subscriptions <= 1.0 - Unauthenticated WooCommerce REST API Credential Disclosure | 14 Nov 2026 | ||
| CVE-2026-105984 | Email Marketing 4Dem <= 2.0.5 - Unauthenticated Configuration Destruction and Arbitrary Plugin Record Deletion | 14 Nov 2026 | ||
| CVE-2026-105983 | Email Marketing 4Dem <= 2.0.5 - Unauthenticated Settings Modification and Configuration Disclosure | 14 Nov 2026 | ||
| CVE-2026-111034 | Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Subscriber+ Non-Public Post Title Disclosure via select2Ajax | 14 Nov 2026 | ||
| CVE-2026-111033 | Countdown, Coming Soon, Maintenance – Countdown & Clock <= 3.0.8 - Author+ Stored XSS via savePost | 14 Nov 2026 | ||
| CVE-2026-124969 | Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename | 14 Nov 2026 | 7.1 | |
| CVE-2026-126173 | AutomatorWP Pro Webhooks addon <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary User Password Reset / Account Takeover via Webhook with 'Is the user ID' Field | 14 Nov 2026 | 9.8 | |
| CVE-2026-71519 | PrestaShop Webservice API Broken Access Control via Customer Endpoint | 13 Nov 2026 | 8.6 | |
| CVE-2026-71531 | PrestaShop Webservice API Authorization Bypass via id_shop Parameter | 13 Nov 2026 | 8.6 | |
| CVE-2026-129180 | projectworlds Visitor Management System actionpage.php mysqli_query sql injection | 13 Nov 2026 | 7.5 | |
| CVE-2026-128134 | NLTK dot2img runs Graphviz 'dot' without the trusted-exec chokepoint, enabling local code execution via a writable PATH element | 13 Nov 2026 | 7.8 | |
| CVE-2026-129173 | Stirling-Tools Stirling-PDF Participant Details Endpoint WorkflowParticipantController.java session timeout | 13 Nov 2026 | 6.9 |