Export limit exceeded: 12759 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 12,759

Export CSV
CVE-2026-121518

Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126490

OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php

OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-126939

Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter

Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-126941

Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints

Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-128019

FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak

FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Php
Products
Frankenphp
CVE-2026-128021

FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode

FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Php
Products
Frankenphp
CVE-2026-128033

OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed

OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-57500

REVA: Access to internal metadata

REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opencloud-eu
Products
Reva
CVE-2026-126920

chromium-browser: skia: Information leak in Skia

Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-126957

ICMPv4 Record Route / Timestamp option: stack OOB read via ptr underflow in icmpv4.c

An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zephyrproject-rtos
Products
Zephyr
CVE-2026-125329

Kaneo: Gitea integration access token and webhook secret exposed to any workspace member

Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Usekaneo
Products
Kaneo
CVE-2026-114444

Security by CleanTalk < 2.191 - Admin+ Sensitive Data Disclosure via FSWatcher File Viewer

The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher file viewer to Super Admins or to the files it legitimately tracks, allowing a non-super-admin administrator, including a subsite administrator on WordPress multisite, to read the contents of sensitive tracked files such as the main configuration file and disclose the site's authentication keys, salts and, on a standard install, database credentials.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Security By Cleantalk
CVE-2026-118100

BuddyForms < 2.10.3 - Unauthenticated Form Configuration Disclosure

The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configuration, allowing unauthenticated users to download any form's stored settings, including notification recipient email addresses and reCAPTCHA secret keys that are not shown on the public form.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Buddyforms
CVE-2026-82214

Quick Event Manager 8.4.6 - 9.18 - Unauthenticated Private and Draft Content Disclosure via ICS Download

The Quick Event Manager WordPress plugin before 9.19 does not verify the status or type of the requested post before returning its details through a calendar export, allowing unauthenticated users to read the content of draft and private posts.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Quick Event Manager
CVE-2026-118168

MapPress Maps for WordPress < 2.97.15 - Unauthenticated Email Address Disclosure

The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenticated visitors to retrieve the email address and display name of any user on the site by enumerating user IDs.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Mappress Maps
CVE-2026-121509

Headless CMS Plugin REST API post get_required_post_data information disclosure

A security flaw has been discovered in Headless CMS Plugin up to 2.0.4 on WordPress. This affects the function get_required_post_data of the file /wp-json/rae/v1/post of the component REST API. The manipulation of the argument post_id/post_slug results in information disclosure. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Headless Cms Plugin Wordpress-extensions
Products
Headless Cms Plugin Headless Cms Plugin
CVE-2026-111740

Post Duplicator < 3.0.17 - Contributor+ Draft and Private Post Title Disclosure

The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of posts for a post type, allowing users with a role as low as Contributor to read the titles and hierarchy of other users' draft and private posts.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Post Duplicator
CVE-2026-118523

EventPrime < 4.3.6.1 - Unauthenticated Pending Post Disclosure via Public Post Status Override

The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated users to view posts, pages and other content that are awaiting review.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Eventprime
CVE-2026-105971

Car Dealer <= 4.73 - Unauthenticated Private/Draft/Pending Post Content Disclosure via cardealer_single_car_ajax

The Car Dealer (Dealership) and Vehicle sales WordPress plugin through 4.73 does not restrict its unauthenticated single-listing AJAX action to published content, allowing an unauthenticated attacker to read the title, content and metadata of any private, draft, pending, future or trashed post by supplying its numeric id.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Car Dealer
CVE-2026-121380

Tournamatch < 4.7.1 - Unauthenticated Team Invitation Email Disclosure via REST API

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Tournamatch