Latest vulnerabilities
Every new CVE with its exploitation status, public exploits and fixes — from nearly 30 public sources, updated hourly.
- Tracked
- 409,707
- Last 24h
- 356
- Critical, 7 days
- 343
- Known exploited
- 1,779
108,129 results · Clear filters · Feed
-
Medium 6.5
WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
-
Medium 5.3
WordPress Mailjet Email Marketing plugin <= 6.2.3 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Mailjet Email Marketing <= 6.2.3 versions.
-
Medium 6.5
WordPress Front End PM plugin <= 11.4.6 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.
-
Medium 6.5
WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
-
Medium 5.3
WordPress Captcha by BestWebSoft plugin <= 5.2.8 - Bypass Vulnerability vulnerability
Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions.
-
Medium 6.5
WordPress WPBase Cache plugin <= 5.5.6 - Denial of Service Attack vulnerability
Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions.
-
Medium 6.5
WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscrip…
-
Medium 6.5
WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Wappointment <= 2.7.7 versions.
-
Medium 6.5
WordPress Piotnet Addons For Elementor plugin <= 7.1.71 - Arbitrary File Download vulnerability
Contributor Arbitrary File Download in Piotnet Addons For Elementor <= 7.1.71 versions.
-
Medium 6.5
WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
-
Medium 6.5
WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
-
Medium 6.5
WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
-
Medium 4.3
SourceCodester Simple Student Information System Profile Field register.php cross site scripting
A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to c…
-
Medium 6.5
WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
-
Medium 5.4
Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement
A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devices with limited input capabilities to obtain security tokens. The issue occurs because the flow fails to check the min…
-
Medium 6.5
Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated ext…
-
Medium 6.7
Use After Free in Windows WLAN Host
Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization.
-
Medium 6.7
Out-of-bounds Write in Camera Driver
Memory Corruption when processing camera operations due to out-of-bounds write during driver updates.
-
Medium 6.7
Out-of-bounds Write in Camera Driver
Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation.
-
Medium 6.7
Out-of-bounds Write in Camera Driver
Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver.
-
Medium 6.7
Out-of-bounds Write in Camera Driver
Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size.
-
Medium 6.6
Out of Bounds write in Linux Camera
Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters.
-
Medium 5.3
Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce orde…
-
Medium 5.5
File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat
The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachment, allowing any user with file-upload privileges to rename attachments belonging to other users, including administrato…
-
Medium 5.3
Slider Pro <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via sliderpro_multiple_images
The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, schedu…
-
Medium 5.3
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Bypass and Order Manipulation via Webhook
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and ships with that verification disabled by default, allowing unauthenticated attackers to mark an unpaid order as paid, or …
-
Medium 6.5
elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback
The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment notification requests, allowing unauthenticated attackers to forge payment confirmations and change the status of arbit…
-
Medium 5.3
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from the hosted checkout, and does not check the payment status or amount, allowing unauthenticated users to have orders ma…
-
Medium 4.3
vllm-project vLLM Completions Request mamba_mixer2.py conv_ssm_forward out-of-bounds
A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/model_executor/layers/mamba/mamba_mixer2.py of the component Completions Request Handler. The manipulation leads to out-o…
-
Medium 4.3
imgproxy SVG svg.go sanitizeElement cross site scripting
A flaw has been found in imgproxy up to 4.0.17. Affected by this vulnerability is the function sanitizeElement of the file processing/svg/svg.go of the component SVG Handler. Executing a manipulation can lead to cross site scripting. It is possible to launch …
-
Medium 6.5
WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.
-
Medium 4.3
WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
-
Medium 6.5
WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.
-
Medium 6.5
WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability
Authorization Bypass Through User-Controlled Key vulnerability in ZWEISCHNEIDER Faktur Pro for WooCommerce woorechnung allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Faktur Pro for WooCommerce: from n/a through 3.2.…
-
Medium 5.3
uptrace user_handler.go Login information exposure
A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file pkg/org/user_handler.go. The manipulation leads to information exposure through error message. It is possible to initiat…
-
Medium 4.3
SourceCodester Drug Recommendation System cross-site request forgery
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to …
-
Medium 4.3
SourceCodester Drug Recommendation System add_drug.php cross site scripting
A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file Admin/add_drug.php. Performing a manipulation results in cross site scripting. The attack is possible to be carried out remotely…
-
Medium 4.7
PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization
A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown function of the file loginsystem/admin/change-password.php of the component Change Password Handler. This manipulation of…
-
Medium 5.4
jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization
A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Perfor…
-
Medium 4.7
chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization
A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Managem…