High-severity CVEs (page 35)

Page 35 of 100 — high-severity CVEs, newest first, with CVSS scores and publication dates.

All high-severity CVEs — newest first (page 35 of 100)
CVESeverityScorePublishedSummary
CVE-2026-108760High7.62026-10-11LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI si…
CVE-2026-108758High8.22026-10-11Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers to modify any appoi…
CVE-2026-108746High8.82026-10-11Vearch 3.5.2 through 3.5.9 contains an incorrect authorization vulnerability in Role.HasPermissionForResources that ignores stored ReadOnly or None privilege l…
CVE-2026-108744High7.02026-10-11pbi-cli 3.10.1 through 3.12.0 contains an OS command injection vulnerability in desktop_sync.py that passes unquoted .pbip paths to cmd /c start when reopening…
CVE-2026-108740High8.32026-10-11GoatCounter through 2.7.0 contains a mass assignment privilege escalation vulnerability in the userPrefSave handler that allows logged-in users to modify prote…
CVE-2026-108739High7.52026-10-11OpenAgents Workspace backend through launcher-v1.0.17 contains an information disclosure vulnerability that allows unauthenticated attackers to list all worksp…
CVE-2026-108718High8.12026-10-11Rill 0.77.0 through 0.90.5 contains a missing authorization vulnerability in the admin OAuth server that issues authorization codes to dynamically registered c…
CVE-2026-108714High7.52026-10-11MCP Kotlin SDK through 0.15.0 contains an uncontrolled memory allocation vulnerability that allows remote clients to exhaust server memory because Application…
CVE-2026-108571High7.32026-10-11A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. This impacts the function kqjcmdModel::returnchuli of the file webmain/task/openapi/openkq…
CVE-2026-96227High8.82026-10-11The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file t…
CVE-2026-91829High7.12026-10-11The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticate…
CVE-2026-89302High8.62026-10-11The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated…
CVE-2026-89299High8.62026-10-11The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated use…
CVE-2026-89297High8.62026-10-11The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated u…
CVE-2026-89287High8.62026-10-11The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowing unauthenticated…
CVE-2026-89285High8.62026-10-11The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL query, allowing unauthe…
CVE-2026-89283High8.62026-10-11The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an…
CVE-2026-89234High8.62026-10-11The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to ap…
CVE-2026-89232High8.62026-10-11The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to…
CVE-2026-89214High8.62026-10-11The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, which allows unauthenti…
CVE-2026-89213High8.62026-10-11The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticate…
CVE-2026-89195High8.62026-10-11The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthe…
CVE-2026-88930High8.62026-10-11The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not san…
CVE-2026-88905High8.82026-10-11The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before out…
CVE-2026-88903High8.82026-10-11The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitt…
CVE-2026-88827High8.82026-10-11The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account…
CVE-2026-88826High8.82026-10-11The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and does not sanitise or…
CVE-2026-87764High8.82026-10-11The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is being added to, nor…
CVE-2026-87762High8.82026-10-11The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, and the secret compar…
CVE-2026-87761High8.02026-10-11The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authenticated user to overwr…
CVE-2026-87760High8.82026-10-11The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated visitors before storin…
CVE-2026-86798High8.82026-10-11The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored thr…
CVE-2026-85126High7.22026-10-11The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of its own low privilege…
CVE-2026-84261High8.82026-10-11The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint befor…
CVE-2026-84260High8.82026-10-11The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before…
CVE-2026-84259High8.82026-10-11The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outpu…
CVE-2026-84258High8.82026-10-11The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before o…
CVE-2026-81420High8.62026-10-11The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauthenticated AJAX acti…
CVE-2026-14854High7.52026-10-11The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of its unauthenticated A…
CVE-2026-106029High7.52026-10-11The WeddingCity Lite WordPress plugin through 1.0.4 does not perform any authorisation or validity checks before deleting posts, pages and media attachments…
CVE-2026-104680High7.22026-10-11The Envira Gallery WordPress plugin before 1.16.2 does not verify that a user holds the capability WordPress reserves for installing Envira Gallery WordPress…
CVE-2026-103695High8.62026-10-11The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users t…
CVE-2026-103694High8.82026-10-11The Mobile builder WordPress plugin through 1.4.2 does not properly restrict which user meta keys a logged-in user can update through one of its REST routes, a…
CVE-2026-103305High8.82026-10-11The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when out…
CVE-2026-108522High8.32026-10-11A vulnerability was found in Studio-Saelix Sencho up to 0.94.1. This affects an unknown part of the file /api/auth/login of the component Login Endpoint. Perfo…
CVE-2026-108708High8.82026-10-11Wukong_HRM through commit 186115e contains a missing authorization vulnerability because EmployeeAspect assigns every caller the HR administrator role and Empl…
CVE-2026-108695High7.12026-10-11MultiVendorX WordPress plugin through 5.0.19 contains an incorrect authorization vulnerability that allows vendor accounts to modify marketplace-wide settings…
CVE-2026-108693High7.02026-10-11ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by ba…
CVE-2026-108657High8.12026-10-10JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController passApply handler that allows any authenticated user to appro…
CVE-2026-108628High8.12026-10-10JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any…
CVE-2026-108623High7.12026-10-10JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete…
CVE-2026-78534High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
CVE-2026-78532High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-78530High7.72026-10-10Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions.
CVE-2026-66566High8.12026-10-10Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
CVE-2026-65459High7.52026-10-10Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.
CVE-2026-62130High7.22026-10-10Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions.
CVE-2026-62118High7.32026-10-10Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
CVE-2026-62117High8.52026-10-10Subscriber SQL Injection in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
CVE-2026-62116High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
CVE-2026-62115High8.12026-10-10Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
CVE-2026-62100High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.
CVE-2026-62099High8.12026-10-10Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
CVE-2026-62096High8.12026-10-10Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
CVE-2026-62095High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.
CVE-2026-62094High8.12026-10-10Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
CVE-2026-62093High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.
CVE-2026-62092High8.12026-10-10Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
CVE-2026-62091High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.
CVE-2026-62082High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.
CVE-2026-62075High8.12026-10-10Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.
CVE-2026-62074High8.12026-10-10Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
CVE-2026-62070High8.12026-10-10Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.
CVE-2026-62069High8.12026-10-10Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.
CVE-2026-62068High8.12026-10-10Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.
CVE-2026-62067High8.12026-10-10Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.
CVE-2026-62066High8.12026-10-10Unauthenticated Local File Inclusion in Volos <= 1.2 versions.
CVE-2026-62065High8.12026-10-10Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.
CVE-2026-62064High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
CVE-2026-62043High7.52026-10-10Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions.
CVE-2026-62038High7.32026-10-10Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.
CVE-2026-62037High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
CVE-2026-62034High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
CVE-2026-62033High7.62026-10-10Subscriber Settings Change in uListing <= 2.2.0 versions.
CVE-2026-62030High7.22026-10-10Unauthenticated Server Side Request Forgery (SSRF) in StreamCast <= 2.4.5 versions.
CVE-2026-62027High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
CVE-2026-62021High8.82026-10-10Subscriber PHP Object Injection in Angio <= 1.1.1 versions.
CVE-2026-62020High8.12026-10-10Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
CVE-2026-57742High7.12026-10-10Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This is…
CVE-2026-48194High8.12026-10-10Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
CVE-2026-48193High8.12026-10-10Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.
CVE-2026-45440High7.62026-10-10Administrator SQL Injection in WP Ultimate CSV Importer <= 9.2 versions.
CVE-2026-42777High8.12026-10-10Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
CVE-2026-42724High8.12026-10-10Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
CVE-2026-42722High7.62026-10-10Administrator SQL Injection in Frontend Admin by DynamiApps <= 3.29.13 versions.
CVE-2026-42717High7.62026-10-10Administrator SQL Injection in Leyka <= 3.32.3 versions.
CVE-2026-42715High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.
CVE-2026-42712High8.52026-10-10Subscriber SQL Injection in Qode Tours <= 3.1.3.2 versions.
CVE-2026-42711High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.
CVE-2026-42709High7.12026-10-10Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.