Publikacje w kolejności czasu
Wszystkie technologie
| Oprogramowanie | Podatność i krótki opis | Zapisz | |||
|---|---|---|---|---|---|
| Payment Gateway for Telcell | CVE-2026-103301 The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as… |
5,3 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| Simple Shopping Cart | CVE-2026-104641 The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a payment received by the site owner's PayPal account in its default configuration, allowing unauthenticated attackers to have their orders marked as paid using a payment made to an… |
5,3 | 0,15 % | Brak wpisu w KEV nie wyklucza ataków | |
| Red Hat OpenShift AI (RHOAI) | CVE-2026-17557 A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication… |
6,5 | 0,33 % | Brak wpisu w KEV nie wyklucza ataków | |
| Ninja Forms | CVE-2026-110899 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.15.5. |
7,1 | 0,22 % | Brak wpisu w KEV nie wyklucza ataków | |
| Eclipse OpenJ9 | CVE-2026-111074 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial of service. When processing the initial 4-byte length field of an incoming TCP connection, an integer overflow in `MessageBuffer::computeRequiredCapacity()` causes the receiving… |
8,7 | 0,42 % | Brak wpisu w KEV nie wyklucza ataków | |
| Eclipse OpenJ9 | CVE-2026-111075 In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on attacker-controlled `_size`, `_paddingSize`, and `_dataOffset` fields during `DataDescriptor` message deserialization. An unauthenticated remote attacker can send a crafted network… |
8,7 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| Strong Testimonials | CVE-2026-107435 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.12. |
7,1 | 0,19 % | Brak wpisu w KEV nie wyklucza ataków | |
| Cinder | CVE-2026-93856 In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API. A non-admin user with the project-scoped 'member' or 'reader' role making the Block Storage API v3.3 "List messages" call finds the non-expired user messages for other projects included in the… |
4,3 | 0,37 % | Brak wpisu w KEV nie wyklucza ataków | |
| Cart Abandonment Recovery for WooCommerce | CVE-2026-96901 The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its cart-recovery token before acting on it and still accepts an unsigned legacy token format, allowing unauthenticated attackers who know a victim's cart session identifier to modify that… |
3,7 | 0,21 % | Brak wpisu w KEV nie wyklucza ataków | |
| Formidable Forms | CVE-2026-85642 The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the timestamp it uses to rate limit payment gateway verification requests, allowing unauthenticated attackers to consume the daily allowance and cause legitimate verification attempts to… |
7,5 | 0,39 % | Brak wpisu w KEV nie wyklucza ataków | |
| Download Manager | CVE-2026-86611 The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF checks in some places, allowing attackers to make a logged in admin update its privacy and storage settings via a crafted link, including the credential that gates its… |
4,3 | 0,13 % | Brak wpisu w KEV nie wyklucza ataków | |
| Wava Payment Plugin | CVE-2026-87837 The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, including marking an unpaid order as… |
5,3 | 0,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Wava Payment Plugin | CVE-2026-87838 The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification on one of its public REST endpoints, allowing unauthenticated attackers to overwrite the stored credential that identifies the merchant account the store's payments are created… |
6,5 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Translate WordPress with Weglot 2.0 | CVE-2026-88784 The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes… |
7,5 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Click n Chat (Chat Widget Integration) | CVE-2026-92997 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. |
8,6 | 0,36 % | Brak wpisu w KEV nie wyklucza ataków | |
| Click n Chat (Chat Widget Integration) | CVE-2026-92998 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks. |
8,6 | 1,25 % | Brak wpisu w KEV nie wyklucza ataków | |
| Click n Chat (Chat Widget Integration) | CVE-2026-92999 The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a lead-export handler, allowing unauthenticated users to download every captured contact record (names, email addresses and phone numbers). |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Manila | CVE-2026-71195 In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns the share. The API controllers authorize operations against the caller's own project context, then load a foreign public share without re-authorizing against the share's actual… |
9,9 | 0,48 % | Brak wpisu w KEV nie wyklucza ataków | |
| Advanced File Manager | CVE-2026-79627 The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone… |
7,1 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Elementor Website Builder | CVE-2026-81812 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered… |
6,4 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Elementor Website Builder | CVE-2026-81813 The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes… |
6,8 | 0,41 % | Brak wpisu w KEV nie wyklucza ataków | |
| AI Engine | CVE-2026-110982 The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content they cannot otherwise edit such as… |
4,9 | 0,27 % | Brak wpisu w KEV nie wyklucza ataków | |
| Redirection for Contact Form 7 | CVE-2026-111574 The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the… |
7,5 | 0,31 % | Brak wpisu w KEV nie wyklucza ataków | |
| Kliken: Ads + Pixel for Meta | CVE-2026-111596 The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other… |
5,3 | 0,28 % | Brak wpisu w KEV nie wyklucza ataków | |
| Pricing Table WordPress Plugin | CVE-2026-111947 The Pricing Table WordPress Plugin WordPress plugin before 4.1.3 does not perform authorisation checks when duplicating a legacy pricing table, allowing users with the contributor role and above to clone and publish any post or page on the site, including private and draft content belonging to… |
5,5 | 0,26 % | Brak wpisu w KEV nie wyklucza ataków |
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 15.11.2026, 15:02 UTC – 15.11.2026, 20:17 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.