KATALOG PODATNOŚCI
Wyszukuj po identyfikatorze CVE, nazwie produktu lub opisie. Filtruj według sygnałów ryzyka.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV.
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues
The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping. This makes it…
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and…
Wtyczka WPC Shop dla WooCommerce umożliwia eskalację uprawnień przez przejęcie konta administratora.
The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to…
Wtyczka Form Maker od 10Web umożliwia zdalne wstrzyknięcie skryptów przez nieprawidłową sanitizację.
Wtyczka Super Forms dla WordPressa pozwala na usunięcie dowolnych plików przez uwierzytelnionych użytkowników.
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and…
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes.…
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an…
Niezabezpieczony dostęp w LearnPress pozwala nieautoryzowanym użytkownikom pobierać materiały kursów.
MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP verification logic compared the submitted token against a counter value that…
Podatność w ByteCoreStack MCP Connector dla WordPressa pozwala na eskalację uprawnień do Administratora.
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those…
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked…
The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks.
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those callbacks can be forged when the gateway is enabled without credentials,…
Wtyczka Extendify dla WordPressa jest podatna na przechowywane XSS, co pozwala na wstrzykiwanie skryptów.
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the…
The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on those callbacks can be forged when the gateway is enabled without…
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the…
The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion to the cache directory, allowing unauthenticated users to delete…
The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce, disabling the check for the whole request when a crafted URL is used, which…
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization.
| CVE / produkt | Sygnały | Oceny | Publikacja | Zapisz |
|---|---|---|---|---|
| CVE-2026-103488 In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access restricted issues |
Monitoruj |
CVSS 7,1EPSS 0,21 % | ||
| CVE-2026-97661 The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all versions up to, and including, 1.2.1 due to… |
Monitoruj |
CVSS 7,2EPSS 0,24 % | ||
| CVE-2026-92244 The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up… |
Monitoruj |
CVSS 7,2EPSS 0,28 % | ||
| CVE-2026-95687 Wtyczka WPC Shop dla WooCommerce umożliwia eskalację uprawnień przez przejęcie konta administratora. |
Monitoruj |
CVSS 8,8EPSS 0,46 % | ||
| CVE-2026-96573 The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List… |
Monitoruj |
CVSS 7,2EPSS 0,26 % | ||
| CVE-2026-96813 Wtyczka Form Maker od 10Web umożliwia zdalne wstrzyknięcie skryptów przez nieprawidłową sanitizację. |
Monitoruj |
CVSS 7,2EPSS 0,3 % | ||
| CVE-2026-15983 Wtyczka Super Forms dla WordPressa pozwala na usunięcie dowolnych plików przez uwierzytelnionych użytkowników. |
Monitoruj |
CVSS 8,1EPSS 0,52 % | ||
| CVE-2026-85235 The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up… |
Monitoruj |
CVSS 7,2EPSS 0,28 % | ||
| CVE-2026-103659 MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from… |
Monitoruj |
CVSS 7,1EPSS 0,23 % | ||
| CVE-2026-14995 The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization… |
Monitoruj |
CVSS 7,2EPSS 0,28 % | ||
| CVE-2026-103431 colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a… |
Monitoruj |
CVSS 7,7EPSS 0,18 % | ||
| CVE-2026-93882 Niezabezpieczony dostęp w LearnPress pozwala nieautoryzowanym użytkownikom pobierać materiały kursów. |
Monitoruj |
CVSS 7,5EPSS 0,36 % | ||
| CVE-2026-103651 MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rewinding of the token counter. The HOTP… |
Monitoruj |
CVSS 7,6EPSS 0,2 % | ||
| CVE-2026-19807 Podatność w ByteCoreStack MCP Connector dla WordPressa pozwala na eskalację uprawnień do Administratora. |
Monitoruj |
CVSS 8,8EPSS 0,37 % | ||
| CVE-2026-96255 The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API… |
Monitoruj |
CVSS 7,5EPSS 0,26 % | ||
| CVE-2026-92412 The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to… |
Monitoruj |
CVSS 7,1EPSS 0,16 % | ||
| CVE-2026-89296 The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection… |
Monitoruj |
CVSS 8,6EPSS 0,26 % | ||
| CVE-2026-81809 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL statement, and the integrity check on those… |
Monitoruj |
CVSS 7,5EPSS 0,19 % | ||
| CVE-2026-85679 Wtyczka Extendify dla WordPressa jest podatna na przechowywane XSS, co pozwala na wstrzykiwanie skryptów. |
Monitoruj |
CVSS 7,2EPSS 0,31 % | ||
| CVE-2026-80276 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through… |
Monitoruj |
CVSS 7,5EPSS 0,37 % | ||
| CVE-2026-81739 The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting it in an admin page, and the integrity check on… |
Monitoruj |
CVSS 7,5EPSS 0,22 % | ||
| CVE-2026-80275 Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An… |
Monitoruj |
CVSS 8,8EPSS 0,25 % | ||
| CVE-2026-19253 The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routine, and does not confine the resulting deletion… |
Monitoruj |
CVSS 8,7EPSS 0,23 % | ||
| CVE-2026-101147 The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do not correctly enforce the REST API nonce,… |
Monitoruj |
CVSS 8,8EPSS 0,13 % | ||
| CVE-2026-78210 In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without possessing the required authorization. |
Monitoruj |
CVSS 7,1EPSS 0,26 % |
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
Ostatnio zakończone okno publikacji NVD: 12.11.2026, 11:02 UTC – 12.11.2026, 16:02 UTC. To pojedyncze okno importu, nie granica pokrycia katalogu.