Skip to content
OpenAdvisories

Archive

29 May 2026

Vulnerabilities first published on this day (UTC), newest first.

← April 2026 2026 / May /29 June 2026 →
  1. 1256
  2. 282
  3. 349
  4. 4193
  5. 5203
  6. 6504
  7. 7223
  8. 8430
  9. 969
  10. 10104
  11. 11361
  12. 12555
  13. 13349
  14. 14312
  15. 15214
  16. 1648
  17. 1764
  18. 18112
  19. 19220
  20. 20204
  21. 21192
  22. 22153
  23. 2342
  24. 2465
  25. 25187
  26. 26276
  27. 27714
  28. 28545
  29. 29257
  30. 3051
  31. 3151
All Critical High Medium Low Exploited only Public exploit

94 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-10039

    Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter

    The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to generic SQL Injection via the 'order' parameter in all versions up to, and including, 3.28.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation…

    shabti Frontend Admin by DynamiApps Web / CMS
  • Medium 4.3
    CVE-2026-49322

    Indian Scout Bobber 2025 Infotainment-to-WCM weak authentication allows recovery of user PIN from observed exchange

    Weak authentication in the Wireless Control Module (WCM) of the Indian Motorcycle Scout Bobber + Tech 2025 model year allows an adjacent-network attacker with read access to the in-vehicle network to recover the user-set unlock PIN by passively observing a si…

    Indian Motorcycle Scout Bobber + Tech
  • Medium 6.4
    CVE-2026-9243

    The Plus Addons for Elementor <= 6.4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'carousel_direction' Parameter

    The Plus Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carousel_direction' parameter of the Carousel Anything widget in versions up to, and including, 6.4.15 This is due to insufficient output escaping in the …

    posimyththemes The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce Web / CMS
  • Medium 6.5
    CVE-2026-9493

    BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference

    Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify the parameter of a specific query function to access other users' EC order details.

    BankPro E-Service Technology Service Center
  • Medium 6.4
    CVE-2025-14042

    Automotive Car Dealership Business WordPress Theme <= 13.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Portfolio Project Details

    The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Portfolio Items in all versions up to, and including, 13.4.1. This is due to insufficient input sanitiz…

    Themesuite Automotive Car Dealership Business WordPress Theme Web / CMS
  • Medium 6.4
    CVE-2026-9714

    Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

    The Simple Divi Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the [showmodule] shortcode in versions up to, and including, 1.2 This is due to insufficient input sanitization and output escaping in the sh…

    creaweb2b Simple Divi Shortcode Web / CMS
  • Medium 6.4
    CVE-2026-6275

    StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname

    The StatCounter – Free Real Time Visitor Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.1.1 This is due to insufficient output escaping on the post author's nickname in the statcounter_addToTags() f…

    StatCounter StatCounter – Free Real Time Visitor Stats Web / CMS
  • Medium 4.8
    CVE-2026-6324

    Libsoup: libsoup: http request smuggling via unsigned to signed conversion error

    A flaw was found in libsoup. A remote attacker could exploit an unsigned to signed conversion error in the `soup_body_input_stream_read_chunked()` function by sending a malicious HTTP request. This vulnerability occurs when libsoup operates behind a non-libso…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2026-2128

    Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie

    The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.p…

    Cloudways Breeze Cache Web / CMS
  • Medium 4.3
    CVE-2026-8995

    Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action

    The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 6.3.7. This is due to insufficient access controls on the 'ays_poll_get_user_information' AJAX act…

    Ays Pro Poll Maker by AYS – Versus Polls, Anonymous Polls, Image Polls Web / CMS
  • Medium 4.4
    CVE-2026-7430

    Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import

    The Post Snippets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.0.19. This is due to insufficient output escaping of imported snippet content when rendering JavaScript variables in the post editor. S…

    Saad Iqbal Post Snippets – Custom WordPress Code Snippets Customizer Web / CMS
  • Medium 5.0
    CVE-2026-6892

    Improper handling of symbolic links in the installer of CUPS Printer Driver for macOS(*) may allow a local attacker wit…

    Canon Canon PIXUS iX6800 Series CUPS Printer Driver for macOS PIXMA iX6800 Series CUPS Printer Driver for macOS PIXMA MG2500 Series CUPS Printer Driver for macOS macOS
  • Medium 6.5
    CVE-2026-39229

    Bolt CMS through 3.7.0 allows SQL Injection in the 'order' parameter of the content listing pages. An authenticated att…

  • Medium 6.1
    CVE-2026-36324

    SourceCodester Doctor Appointment System 1.0 is vulnerable to Cross Site Scripting (XSS) due to improper handling of us…