Search vulnerabilities

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,601

Export CSV
CVE-2026-126128

Improper Input Validation in Auth0 Node.js SDK Enables Unauthorized Endpoint Redirection

The Management API client in the Auth0 Node.js SDK improperly neutralizes path parameters, allowing a request and its attached management API token to be redirected to an unintended endpoint on the same tenant, resulting in unintended access to data or operations that the token's existing scopes already permit.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126129

Improper Back‑Channel Logout Handling in Auth0 ASP.NET Core Authentication SDK

The Auth0 ASP.NET Core Authentication SDK incorrectly determines a session's OIDC Back-Channel Logout status, which may result in a logged-out session being accepted for access to protected endpoints.

CVSS n/a EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-109904

X.Org Server XRes QueryClientIds Request Size Overflow

A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X Server before 21.1.26 could be used by attackers on authenticated X clients to crash the server or leak out information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
X.org
Products
Xorg-x11-server Xwayland
CVE-2026-112306

NocoBase plugin-collection-sql through 2.2.46 SQL Injection via sqlCollection:setFields

NocoBase @nocobase/plugin-collection-sql through 2.2.46 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL() through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection query with dangerous statements executed on reload, reading pg_shadow password hashes or calling pg_read_file.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Nocobase
Products
Nocobase
CVE-2026-129092

CCC Attestation SIG attested-tls-poc through commit 731ca82 TOCTOU via Handshake-Only Attestation

CCC Attestation SIG attested-tls-poc through commit 731ca82 contains a time-of-check time-of-use vulnerability because Evidence is appraised only once during the TLS handshake, without post-handshake re-attestation. Attackers with local access to the attesting endpoint can alter workload code, data, configuration, or attached devices like GPUs while peers keep trusting the original Evidence.

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-127119

Unverified ownership of the default EMR cluster log location in AWS SDK for pandas

Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Aws
Products
Aws-sdk-pandas
CVE-2026-125432

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-119517

WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Catna – Woo Name Your Price and Offers catna-woo-name-your-price-and-offers allows Reflected XSS.This issue affects Catna – Woo Name Your Price and Offers: from n/a through 2.0.3.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124415

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

CVSS 3.1 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124410

WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpLingua Translation Service Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua wplingua allows Stored XSS.This issue affects Translate and boost SEO &#8211; Automatic AI translation &#8211; wpLingua: from n/a through 3.1.1.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124965

WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Inc. rtMedia for WordPress, BuddyPress and bbPress buddypress-media allows Stored XSS.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.7.16.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124265

WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows Blind SQL Injection.This issue affects Newsletters: from n/a through 4.18.1.

CVSS 3.1 · 8.5 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124414

WordPress Broadcast Live Video plugin <= 7.3.15 - Broken Authentication vulnerability

Weak Authentication vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Authentication Abuse.This issue affects Broadcast Live Video: from n/a through 7.3.15.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124418

WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124267

WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability

Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23.

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124272

WordPress Salon booking system plugin <= 10.31.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.14.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-121776

WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124260

WordPress WP Photo Album Plus plugin <= 9.3.06.001 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124420

WordPress Woody ad snippets plugin <= 2.7.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-119512

WordPress Newsletters plugin <= 4.18.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through 4.18.2.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed
Vendors
—
Products
—