CVE-2026-86838 | Medium | 5.3 | 2026-09-28 | The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowin… |
CVE-2026-94374 | | | 2026-09-21 | MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module results, the… |
CVE-2026-85010 | Medium | 5.3 | 2026-09-21 | The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in th… |
CVE-2026-82189 | | | 2026-09-15 | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-serv… |
CVE-2026-84762 | Medium | 5.3 | 2026-09-03 | Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. |
CVE-2026-77999 | | | 2026-09-03 | Joomla Extension - j2commerce.com - Unauthenticated PayPal callback forgery leading to order confirmation fraud in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4… |
CVE-2026-84654 | Medium | 5.4 | 2026-09-02 | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, form data binding… |
CVE-2026-77794 | Medium | 5.3 | 2026-09-02 | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total price of a paid regist… |
CVE-2026-67363 | | | 2026-08-19 | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge… |
CVE-2026-15045 | Medium | 6.5 | 2026-08-12 | The Wallet System for WooCommerce WordPress plugin before 2.7.10 does not validate a user-supplied wallet amount against the customer's actual stored balance d… |
CVE-2026-16620 | High | 7.5 | 2026-08-06 | The WPC Name Your Price for WooCommerce WordPress plugin before 2.2.5 does not enforce its server-side price allowlist for products configured in "Select" pric… |
CVE-2026-16067 | Medium | 5.3 | 2026-08-06 | The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommer… |
CVE-2026-15149 | Medium | 5.3 | 2026-08-06 | The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking… |
CVE-2026-10524 | High | 7.5 | 2026-08-06 | The CoCart WordPress plugin before 4.9.0 does not validate a user-supplied price value against the actual product price when items are added to the cart throug… |
CVE-2026-1982 | Medium | 5.3 | 2026-07-30 | The Persian Elementor (المنتور فارسی) plugin for WordPress is vulnerable to Price Manipulation in all versions up to, and including, 2.8.1. This is due to the… |
CVE-2026-7484 | Medium | 5.3 | 2026-07-24 | External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by… |
CVE-2026-65052 | High | 7.5 | 2026-07-21 | Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbit… |
CVE-2026-16089 | Medium | 5.4 | 2026-07-17 | A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound… |
CVE-2026-56877 | Medium | 6.3 | 2026-07-13 | The SCORM lab launch endpoint in Skillable (scorm.skillable.com) through 2026-07-13 does not validate the client-supplied userId parameter against the authenti… |
CVE-2026-59817 | Medium | 5.3 | 2026-07-09 | Ghost is a Node.js content management system. From 6.27.0 before 6.44.0, Ghost's public donation checkout flow allowed an unauthenticated attacker to control d… |
CVE-2026-14430 | High | 8.8 | 2026-07-01 | Integer overflow in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-14391 | Medium | 5.3 | 2026-07-01 | Integer overflow in ANGLE in Google Chrome on Windows prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to obtain poten… |
CVE-2026-14389 | High | 8.3 | 2026-07-01 | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-14387 | Critical | 9.6 | 2026-07-01 | Integer overflow in Skia in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Ch… |
CVE-2026-14069 | Medium | 6.5 | 2026-06-30 | Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via… |
CVE-2026-13974 | High | 8.1 | 2026-06-30 | Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a malicious fi… |
CVE-2026-13938 | High | 8.8 | 2026-06-30 | Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (… |
CVE-2026-13841 | High | 8.3 | 2026-06-30 | Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-13801 | High | 8.3 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-13796 | Critical | 9.6 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-13281 | High | 8.3 | 2026-06-25 | Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-42655 | Medium | 5.9 | 2026-06-15 | Unauthenticated Bypass Vulnerability in Best Payments Plugin for WP <= 4.6.19 versions. |
CVE-2025-59382 | | | 2026-06-10 | QTS, QuTS hero, QuTScloud are not affected.
We have already fixed the vulnerability in the following version: |
CVE-2026-11678 | Medium | 5.3 | 2026-06-09 | Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obtain potentially se… |
CVE-2026-11669 | Medium | 5.3 | 2026-06-09 | Out of bounds read in Media in Google Chrome on ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obtain p… |
CVE-2026-11655 | High | 8.3 | 2026-06-09 | Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially per… |
CVE-2026-11640 | High | 8.3 | 2026-06-09 | Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-11290 | Medium | 5.0 | 2026-06-05 | Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to cause a denial of service via a malicious file. (Chr… |
CVE-2026-11281 | Medium | 5.0 | 2026-06-05 | Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information from pro… |
CVE-2026-11211 | High | 8.8 | 2026-06-04 | Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-11171 | High | 8.8 | 2026-06-04 | Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-11088 | Critical | 9.6 | 2026-06-04 | Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-11085 | High | 8.8 | 2026-06-04 | Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a c… |
CVE-2026-11058 | High | 7.5 | 2026-06-04 | Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-11044 | Medium | 6.5 | 2026-06-04 | Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process mem… |
CVE-2026-10987 | High | 8.8 | 2026-06-04 | Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-10986 | High | 8.8 | 2026-06-04 | Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a malicious file. (C… |
CVE-2026-10965 | High | 8.8 | 2026-06-04 | Integer overflow in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-10964 | High | 8.8 | 2026-06-04 | Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-10963 | High | 8.8 | 2026-06-04 | Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-10924 | High | 8.3 | 2026-06-04 | Integer overflow in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-10921 | High | 8.3 | 2026-06-04 | Integer overflow in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sa… |
CVE-2026-9998 | High | 8.3 | 2026-05-28 | Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-9968 | High | 8.8 | 2026-05-28 | Integer overflow in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-9966 | High | 8.3 | 2026-05-28 | Integer overflow in XML in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-9960 | High | 7.5 | 2026-05-28 | Integer overflow in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary cod… |
CVE-2026-9911 | Medium | 4.3 | 2026-05-28 | Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (… |
CVE-2026-9909 | High | 7.5 | 2026-05-28 | Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code… |
CVE-2026-9882 | Medium | 6.5 | 2026-05-28 | Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-10019 | High | 8.8 | 2026-05-28 | Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium secur… |
CVE-2026-10018 | Medium | 6.5 | 2026-05-28 | Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory vi… |
CVE-2026-10015 | High | 8.8 | 2026-05-28 | Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-10009 | High | 7.5 | 2026-05-28 | Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to execute arbitrary code… |
CVE-2026-7571 | High | 7.1 | 2026-05-19 | A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the imp… |
CVE-2026-8577 | High | 8.8 | 2026-05-14 | Integer overflow in Fonts in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-8573 | High | 8.3 | 2026-05-14 | Integer overflow in Codecs in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted… |
CVE-2026-8567 | Medium | 4.3 | 2026-05-14 | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted… |
CVE-2026-8559 | Medium | 4.3 | 2026-05-14 | Integer overflow in Internationalization in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write… |
CVE-2026-8534 | High | 8.3 | 2026-05-14 | Integer overflow in GPU in Google Chrome on Linux and ChromeOS prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to po… |
CVE-2026-8532 | High | 8.8 | 2026-05-14 | Integer overflow in XML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-8519 | High | 8.8 | 2026-05-14 | Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted… |
CVE-2026-8510 | High | 7.5 | 2026-05-14 | Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an o… |
CVE-2026-7973 | High | 8.8 | 2026-05-06 | Integer overflow in Dawn in Google Chrome on Windows prior to 148.0.7778.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2026-7969 | Medium | 4.3 | 2026-05-06 | Integer overflow in Network in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass same origin po… |
CVE-2026-7942 | Medium | 4.3 | 2026-05-06 | Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium securi… |
CVE-2026-7912 | Medium | 4.2 | 2026-05-06 | Integer overflow in GPU in Google Chrome on Android prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to perform arbitr… |
CVE-2026-7903 | High | 8.8 | 2026-05-06 | Integer overflow in ANGLE in Google Chrome on Mac,Windows prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2026-7896 | High | 8.8 | 2026-05-06 | Integer overflow in Blink in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-32699 | | | 2026-05-05 | FacturaScripts is an open source accounting and invoicing software. In versions 2025.92 and earlier, the application fails to validate the nick parameter durin… |
CVE-2026-7340 | Medium | 4.3 | 2026-04-28 | Integer overflow in ANGLE in Google Chrome on Windows prior to 147.0.7727.138 allowed a remote attacker to perform an out of bounds memory read via a crafted H… |
CVE-2026-4911 | Medium | 5.3 | 2026-04-28 | The Booking Package plugin for WordPress is vulnerable to Price Manipulation in versions up to, and including, 1.7.06 This is due to the intentForStripe() func… |
CVE-2026-41353 | High | 8.1 | 2026-04-23 | OpenClaw before 2026.3.22 contains an access control bypass vulnerability in the allowProfiles feature that allows attackers to circumvent profile restrictions… |
CVE-2026-2519 | Medium | 5.3 | 2026-04-09 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parameter in all versions… |
CVE-2026-5912 | High | 8.8 | 2026-04-08 | Integer overflow in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page… |
CVE-2026-5910 | High | 8.8 | 2026-04-08 | Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (C… |
CVE-2026-5909 | High | 8.8 | 2026-04-08 | Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (C… |
CVE-2026-5908 | High | 8.8 | 2026-04-08 | Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (C… |
CVE-2026-5870 | High | 8.8 | 2026-04-08 | Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-5859 | High | 8.8 | 2026-04-08 | Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-39364 | High | 7.5 | 2026-04-07 | Vite is a frontend tooling framework for JavaScript. From 7.1.0 to before 7.3.2 and 8.0.5, on the Vite dev server, files that should be blocked by server.fs.de… |
CVE-2026-34751 | Critical | 9.1 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.79.1 in @payloadcms/graphql and payload, a vulnerability in the passwo… |
CVE-2026-5277 | High | 7.5 | 2026-04-01 | Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an… |
CVE-2026-5274 | High | 8.8 | 2026-04-01 | Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromiu… |
CVE-2026-4679 | High | 8.8 | 2026-03-24 | Integer overflow in Fonts in Google Chrome prior to 146.0.7680.165 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page… |
CVE-2026-4464 | High | 8.8 | 2026-03-20 | Integer overflow in ANGLE in Google Chrome prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2026-4453 | Medium | 4.3 | 2026-03-20 | Integer overflow in Dawn in Google Chrome on Mac prior to 146.0.7680.153 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-4452 | High | 8.8 | 2026-03-20 | Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.153 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2026-3914 | High | 8.8 | 2026-03-11 | Integer overflow in WebML in Google Chrome prior to 146.0.7680.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-3538 | High | 8.8 | 2026-03-04 | Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HT… |
CVE-2026-3536 | High | 8.8 | 2026-03-04 | Integer overflow in ANGLE in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted H… |