Skip to content
OpenAdvisories

Source

ENISA EU Vulnerability Database

Source: https://euvd.enisa.europa.eu/

All Critical High Medium Low Exploited only Public exploit

406,220 results · Feed

  • Critical 9.2
    CVE-2026-112256

    Logon bypass (trust of attacker-controlled completed-methods list)

    Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.8…

    OpenText Advanced Authentication Server
  • Low 2.9
    CVE-2026-112255

    Endpoint credential minting (insecure default allow-list)

    Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.4.0.0 through 6.4.3.x, from 6.5.0.0 through 6.5.0.x, and from…

    OpenText Advanced Authentication Server
  • Medium 6.5
    CVE-2026-118084

    WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability

    Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.

    nicdark Hotel Booking
  • High 7.5
    CVE-2026-118083

    WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

    Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

    Themeum WP Crowdfunding
  • High 8.8
    CVE-2026-118082

    WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

    Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.

    BuddyBoss Buddyboss Platform
  • High 8.8
    CVE-2026-118080

    WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

    Social Snap Social Snap
  • High 8.8
    CVE-2026-118081

    WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

    10web 10Web Social Photo Feed
  • High 7.2
    CVE-2026-118079

    WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212.

    foliovision FV Flowplayer Video Player
  • High 7.2
    CVE-2026-118078

    WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

    PixelYourSite Product Catalog Feed by PixelYourSite
  • High 7.2
    CVE-2026-118077

    WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vulnerability

    Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

    Fast Themes Sastra Essential Addons for Elementor
  • High 8.8
    CVE-2026-118076

    WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.

    Frisbii Frisbii Pay
  • High 8.8
    CVE-2026-118075

    WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

    dbarrere WP Media folders
  • High 7.2
    CVE-2026-118074

    WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.

    Daman Jeet Finale Lite
  • High 8.8
    CVE-2026-118073

    WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

    blazethemes News Kit Elementor Addons
  • High 7.2
    CVE-2026-116869

    WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

    Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

    myPOS Payments myPOS Checkout
  • High 8.8
    CVE-2026-116868

    WordPress BuddyPress Xprofile Custom Field Types plugin <= 1.3.1 - PHP Object Injection vulnerability

    Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.

    BuddyDev BuddyPress Xprofile Custom Field Types
  • High 8.8
    CVE-2026-116867

    WordPress Dynamic QR Code – generator plugin <= 1.0.1 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Dynamic QR Code &#8211; generator <= 1.0.1 versions.

    sosidee Dynamic QR Code &#8211; generator
  • High 8.8
    CVE-2026-116866

    WordPress Extra Fees Plugin for WooCommerce plugin <= 4.4.0 - PHP Object Injection vulnerability

    Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.

    Dotstore Extra Fees Plugin for WooCommerce Web / CMS
  • High 7.2
    CVE-2026-116865

    WordPress Zippy plugin <= 1.7.0 - PHP Object Injection vulnerability

    Editor PHP Object Injection in Zippy <= 1.7.0 versions.

    Gesundheit Bewegt Zippy
  • High 7.2
    CVE-2026-116864

    WordPress WPCargo Track & Trace plugin <= 8.0.5 - PHP Object Injection vulnerability

    Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.

    Arni Cinco WPCargo Track & Trace
  • High 7.1
    CVE-2026-108494

    WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.

    Bob Chained Quiz
  • Critical 9.8
    CVE-2026-62018

    WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.

    ThemeREX Gunslinger
  • Critical 9.8
    CVE-2026-62131

    WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.

    Zoho Flow Zoho Flow
  • Critical 9.8
    CVE-2026-62017

    WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.

    ThemeREX Good Homes
  • Critical 9.8
    CVE-2026-62016

    WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.

    ThemeREX Gamic
  • Critical 9.8
    CVE-2026-62015

    WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.

    ThemeREX Gamezone
  • Critical 9.8
    CVE-2026-62014

    WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.

    ThemeREX EmojiNation
  • Critical 9.8
    CVE-2026-62013

    WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.

    ThemeREX Edge Decor Browsers
  • Critical 9.8
    CVE-2026-62012

    WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.

    ThemeREX Coinpress
  • Critical 9.8
    CVE-2026-62010

    WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.

    ThemeREX Avventure
  • Critical 9.8
    CVE-2026-62011

    WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.

    ThemeREX Bonbon
  • Critical 9.8
    CVE-2026-62009

    WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.

    ThemeREX Filmax
  • Critical 9.8
    CVE-2026-62008

    WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.

    ThemeREX Orpheus
  • Critical 9.8
    CVE-2026-62006

    WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Nuts <= 1.12 versions.

    ThemeREX Nuts
  • Critical 9.8
    CVE-2026-62005

    WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions.

    ThemeREX Muzicon
  • Critical 9.8
    CVE-2026-62004

    WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Motorix <= 1.11 versions.

    ThemeREX Motorix
  • Critical 9.8
    CVE-2026-62003

    WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Mission <= 1.22 versions.

    ThemeREX Mission
  • Critical 9.8
    CVE-2026-62002

    WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.

    ThemeREX Meals & Wheels
  • Critical 9.8
    CVE-2026-62001

    WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Marcell <= 1.2.14 versions.

    ThemeREX Marcell
  • Critical 9.8
    CVE-2026-61998

    WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability

    Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.

    ThemeREX Le Truffe