CVE-2026-24xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

890 records · Page 1 of 9

• CVE-2026-24999: WordPress Alma plugin <= 5.16.1 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Alma Alma alma-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Alma: from n/a through <= 5.16.1.

  Updated 2026-04-28
• CVE-2026-24998: WordPress Hustle plugin <= 7.8.9.2 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hustle wordpress-popup allows Retrieve Embedded Sensitive Data.This issue affects Hustle: from n/a through <= 7.8.9.2.

  Updated 2026-04-28
• CVE-2026-24997: WordPress Wired Impact Volunteer Management plugin <= 2.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wired Impact Volunteer Management: from n/a through <= 2.8.

  Updated 2026-04-28
• CVE-2026-24996: WordPress WPElemento Importer plugin <= 0.6.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in wpelemento WPElemento Importer wpelemento-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPElemento Importer: from n/a through <= 0.6.4.

  Updated 2026-04-28
• CVE-2026-24995: WordPress Latest Post Shortcode plugin <= 14.2.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Latest Post Shortcode: from n/a through <= 14.2.0.

  Updated 2026-04-28
• CVE-2026-24994: WordPress Sunshine Photo Cart plugin <= 3.5.7.2 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.

  Updated 2026-04-28
• CVE-2026-24993: WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.3 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.3.

  Updated 2026-04-28
• CVE-2026-24992: WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.2 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Retrieve Embedded Sensitive Data.This issue affects Advanced WooCommerce Product Sales Reporting: from n/a through <= 4.1.2.

  Updated 2026-04-28
• CVE-2026-24991: WordPress Extensions For CF7 plugin <= 3.4.0 - Insecure Direct Object References (IDOR) vulnerability 5.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in HT Plugins Extensions For CF7 extensions-for-cf7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Extensions For CF7: from n/a through <= 3.4.0.

  Updated 2026-04-28
• CVE-2026-24990: WordPress WP Docs plugin <= 2.2.8 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Fahad Mahmood WP Docs wp-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Docs: from n/a through <= 2.2.8.

  Updated 2026-04-28
• CVE-2026-24989: WordPress SUMO Affiliates Pro plugin < 11.4.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.

  Updated 2026-04-28
• CVE-2026-24988: WordPress The Events Calendar Shortcode & Block plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Hogg The Events Calendar Shortcode & Block the-events-calendar-shortcode allows Stored XSS.This issue affects The Events Calendar Shortcode & Block: from n/a through <= 3.1.1.

  Updated 2026-04-28
• CVE-2026-24987: WordPress WP System Log plugin <= 1.2.7 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in activity-log.com WP System Log winterlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP System Log: from n/a through <= 1.2.7.

  Updated 2026-04-28
• CVE-2026-24986: WordPress Simple Membership WP user Import plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in wp.insider Simple Membership WP user Import simple-membership-wp-user-import allows Cross Site Request Forgery.This issue affects Simple Membership WP user Import: from n/a through <= 1.9.1.

  Updated 2026-04-28
• CVE-2026-24985: WordPress WP Forms Signature Contract Add-On plugin <= 1.8.2 - Broken Access Control to Notice Dismissal vulnerability 4.3 Medium

  Missing Authorization vulnerability in approveme WP Forms Signature Contract Add-On wp-forms-signature-contract-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Forms Signature Contract Add-On: from n/a through <= 1.8.2.

  Updated 2026-04-28
• CVE-2026-24984: WordPress Visual Link Preview plugin <= 2.2.9 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Brecht Visual Link Preview visual-link-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Link Preview: from n/a through <= 2.2.9.

  Updated 2026-04-28
• CVE-2026-24983: WordPress UpSolution Core plugin <= 8.41 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through <= 8.41.

  Updated 2026-04-28
• CVE-2026-24982: WordPress Spectra plugin <= 2.19.17 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spectra: from n/a through <= 2.19.17.

  Updated 2026-04-28
• CVE-2026-24981: WordPress Visionary Core plugin <= 1.4.9 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in NooTheme Visionary Core noo-visionary-core allows Object Injection.This issue affects Visionary Core: from n/a through <= 1.4.9.

  Updated 2026-04-28
• CVE-2026-24980: WordPress Visionary Core plugin <= 1.4.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Visionary Core noo-visionary-core allows Reflected XSS.This issue affects Visionary Core: from n/a through <= 1.4.9.

  Updated 2026-04-28
• CVE-2026-24979: WordPress Jobica Core plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobica Core jobica-core allows Reflected XSS.This issue affects Jobica Core: from n/a through <= 1.4.1.

  Updated 2026-04-28
• CVE-2026-24978: WordPress Jobica Core plugin <= 1.4.1 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in NooTheme Jobica Core jobica-core allows Object Injection.This issue affects Jobica Core: from n/a through <= 1.4.1.

  Updated 2026-04-28
• CVE-2026-24977: WordPress Organici Library plugin <= 2.1.2 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Organici Library noo-organici-library allows Blind SQL Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

  Updated 2026-04-28
• CVE-2026-24976: WordPress Organici Library plugin <= 2.1.2 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in NooTheme Organici Library noo-organici-library allows Object Injection.This issue affects Organici Library: from n/a through <= 2.1.2.

  Updated 2026-04-28
• CVE-2026-24975: WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through <= 2.1.2.

  Updated 2026-04-28
• CVE-2026-24974: WordPress CitiLights theme <= 3.7.1 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in NooTheme CitiLights noo-citilights allows Object Injection.This issue affects CitiLights: from n/a through <= 3.7.1.

  Updated 2026-04-28
• CVE-2026-24973: WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1.

  Updated 2026-04-28
• CVE-2026-24972: WordPress Elated Listing plugin <= 1.4 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Elated-Themes Elated Listing eltd-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elated Listing: from n/a through <= 1.4.

  Updated 2026-04-28
• CVE-2026-24971: WordPress Search & Go theme <= 2.8 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through <= 2.8.

  Updated 2026-04-28
• CVE-2026-24970: WordPress Energox theme <= 1.2 - Arbitrary File Deletion vulnerability 7.7 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2026-24969: WordPress Instant VA theme <= 1.0.1 - Arbitrary File Deletion vulnerability 7.7 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in designingmedia Instant VA instantva allows Path Traversal.This issue affects Instant VA: from n/a through <= 1.0.1.

  Updated 2026-04-28
• CVE-2026-24968: WordPress Xagio SEO plugin <= 7.1.0.30 - Privilege Escalation vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.

  Updated 2026-04-28
• CVE-2026-24967: WordPress Amelia plugin <= 1.2.38 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.38.

  Updated 2026-04-28
• CVE-2026-24966: WordPress Copyscape Premium plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Copyscape Copyscape Premium copyscape-premium allows Cross Site Request Forgery.This issue affects Copyscape Premium: from n/a through <= 1.4.1.

  Updated 2026-04-28
• CVE-2026-24965: WordPress Contest Gallery plugin <= 28.1.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contest Gallery: from n/a through <= 28.1.1.

  Updated 2026-04-28
• CVE-2026-24964: WordPress Contest Gallery plugin <= 28.1.2.1 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Server Side Request Forgery.This issue affects Contest Gallery: from n/a through <= 28.1.2.1.

  Updated 2026-04-28
• CVE-2026-24963: WordPress Amelia plugin <= 1.2.38 - Privilege Escalation vulnerability 7.2 High

  Incorrect Privilege Assignment vulnerability in ameliabooking Amelia ameliabooking allows Privilege Escalation.This issue affects Amelia: from n/a through <= 1.2.38.

  Updated 2026-04-28
• CVE-2026-24962: WordPress Sigmize plugin <= 0.0.9 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Sigmize sigmize allows Cross Site Request Forgery.This issue affects Sigmize: from n/a through <= 0.0.9.

  Updated 2026-04-28
• CVE-2026-24961: WordPress Grand Blog theme < 3.1.5 - Server Side Request Forgery (SSRF) vulnerability 5.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Grand Blog grandblog allows Server Side Request Forgery.This issue affects Grand Blog: from n/a through < 3.1.5.

  Updated 2026-04-28
• CVE-2026-24960: WordPress Charety theme < 2.0.2 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Charety charety allows Using Malicious Files.This issue affects Charety: from n/a through < 2.0.2.

  Updated 2026-04-28
• CVE-2026-24959: WordPress JS Help Desk plugin <= 3.0.1 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

  Updated 2026-04-28
• CVE-2026-24958: WordPress JetElements For Elementor plugin <= 2.7.12.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows DOM-Based XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.12.2.

  Updated 2026-04-28
• CVE-2026-24957: WordPress Strong Testimonials plugin <= 3.2.20 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through <= 3.2.20.

  Updated 2026-04-28
• CVE-2026-24956: WordPress Download Manager Addons for Elementor plugin <= 1.3.0 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada Download Manager Addons for Elementor wpdm-elementor allows Blind SQL Injection.This issue affects Download Manager Addons for Elementor: from n/a through <= 1.3.0.

  Updated 2026-04-28
• CVE-2026-24955: WordPress Whizz Plugins plugin <= 1.9 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Whizz Plugins whizz-plugins allows Reflected XSS.This issue affects Whizz Plugins: from n/a through <= 1.9.

  Updated 2026-04-28
• CVE-2026-24954: WordPress WpEvently plugin <= 5.0.8 - Deserialization of untrusted data vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a through <= 5.0.8.

  Updated 2026-04-28
• CVE-2026-24953: WordPress Simple File List plugin <= 6.1.15 - Arbitrary File Download vulnerability 6.5 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.15.

  Updated 2026-04-28
• CVE-2026-24952: WordPress Seriously Simple Podcasting plugin <= 3.14.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.14.1.

  Updated 2026-04-28
• CVE-2026-24951: WordPress myCred plugin <= 2.9.7.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 2.9.7.3.

  Updated 2026-04-28
• CVE-2026-24950: WordPress Authorsy plugin <= 1.0.6 - Insecure Direct Object References (IDOR) vulnerability 7.5 High

  Authorization Bypass Through User-Controlled Key vulnerability in themeplugs Authorsy authorsy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Authorsy: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2026-24949: WordPress PhotoMe theme <= 5.7.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods PhotoMe photome allows DOM-Based XSS.This issue affects PhotoMe: from n/a through <= 5.7.1.

  Updated 2026-04-28
• CVE-2026-24948: WordPress Reflector plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fox-themes Reflector reflector-plugins allows Reflected XSS.This issue affects Reflector: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2026-24947: WordPress LA-Studio Element Kit for Elementor plugin < 1.5.6.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through < 1.5.6.3.

  Updated 2026-04-28
• CVE-2026-24946: WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.8.0 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.8.0.

  Updated 2026-04-28
• CVE-2026-24945: WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.34 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Themefic Ultimate Addons for Contact Form 7 ultimate-addons-for-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Addons for Contact Form 7: from n/a through <= 3.5.34.

  Updated 2026-04-28
• CVE-2026-24944: WordPress Subscribe2 plugin <= 10.44 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in weDevs Subscribe2 subscribe2 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe2: from n/a through <= 10.44.

  Updated 2026-04-28
• CVE-2026-24943: WordPress Grand Conference theme <= 5.3.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Conference grandconference allows Reflected XSS.This issue affects Grand Conference: from n/a through <= 5.3.4.

  Updated 2026-04-28
• CVE-2026-24942: WordPress WpEvently plugin <= 5.1.1 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in magepeopleteam WpEvently mage-eventpress allows Cross Site Request Forgery.This issue affects WpEvently: from n/a through <= 5.1.1.

  Updated 2026-04-28
• CVE-2026-24941: WordPress WP Job Portal plugin <= 2.4.4 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through <= 2.4.4.

  Updated 2026-04-28
• CVE-2026-24940: WordPress Travelfic Toolkit plugin <= 1.3.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Themefic Travelfic Toolkit travelfic-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelfic Toolkit: from n/a through <= 1.3.3.

  Updated 2026-04-28
• CVE-2026-24939: WordPress Modula Image Gallery plugin <= 2.13.6 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modula Image Gallery: from n/a through <= 2.13.6.

  Updated 2026-04-28
• CVE-2026-24938: WordPress Better Search plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Better Search better-search allows Stored XSS.This issue affects Better Search: from n/a through <= 4.2.1.

  Updated 2026-04-28
• CVE-2026-24937: WordPress Broadcast Live Video plugin < 7.1.3 - Remote Code Execution (RCE) vulnerability 7.2 High

  Improper Control of Generation of Code ('Code Injection') vulnerability in VideoWhisper.Com Broadcast Live Video allows Code Injection. This issue affects Broadcast Live Video: from n/a before 7.1.3.

  Updated 2026-05-26
• CVE-2026-24936: An improper input validation vulnerability was found in ADM while joining a AD Domain. 9.5 Critical

  When a specific function is enabled while joining a AD Domain from ADM, an improper input parameters validation vulnerability in a specific CGI program allowing an unauthenticated remote attacker to write arbitrary data to any file on the system. By exploiting this vulnerability, attackers can overwrite critical system files, leading to a complete system compromise. Affected products and versions

  Updated 2026-02-04
• CVE-2026-24935: An improper certificate validation vulnerability was found in a third-party NAT traversal module. 6.3 Medium

  A third-party NAT traversal module fails to validate SSL/TLS certificates when connecting to the signaling server. While subsequent access to device services requires additional authentication, a Man-in-the-Middle (MitM) attacker can intercept or redirect the NAT tunnel establishment. This could allow an attacker to disrupt service availability or facilitate further targeted attacks by acting as a

  Updated 2026-02-03
• CVE-2026-24934: An improper certificate validation vulnerability was found in ADM while querying an external server for the device's WAN IP address. 6.3 Medium

  The DDNS function uses an insecure HTTP connection or fails to validate the SSL/TLS certificate when querying an external server for the device's WAN IP address. An unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to spoof the response, leading the device to update its DDNS record with an incorrect IP address. Affected products and versions include: from ADM 4.1.0 thro

  Updated 2026-02-03
• CVE-2026-24933: An improper certificate validation vulnerability was found in ADM while sending HTTPS requests to the server. 8.9 High

  The API communication component fails to validate the SSL/TLS certificate when sending HTTPS requests to the server. An improper certificates validation vulnerability allows an unauthenticated remote attacker can perform a Man-in-the-Middle (MitM) attack to intercept the cleartext communication, potentially leading to the exposure of sensitive user information, including account emails, MD5 hashed

  Updated 2026-02-03
• CVE-2026-24932: An improper certificate validation vulnerability was found in ADM while updating the DDNS settings. 8.9 High

  The DDNS update function in ADM fails to properly validate the hostname of the DDNS server's TLS/SSL certificate. Although the connection uses HTTPS, an improper validated TLS/SSL certificates allows a remote attacker can intercept the communication to perform a Man-in-the-Middle (MitM) attack, which may obtain the sensitive information of DDNS updating process, including the user's account email,

  Updated 2026-02-03
• CVE-2026-24931: Vulnerability of improper criterion security check in the card module. 5.9 Medium

  Vulnerability of improper criterion security check in the card module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  Updated 2026-02-06
• CVE-2026-24930: UAF concurrency vulnerability in the graphics module. 8.4 High

  UAF concurrency vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24929: Out-of-bounds read vulnerability in the graphics module. 5.9 Medium

  Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24928: Out-of-bounds write vulnerability in the file system module. 5.8 Medium

  Out-of-bounds write vulnerability in the file system module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  Updated 2026-02-06
• CVE-2026-24927: Out-of-bounds access vulnerability in the frequency modulation module. 5.5 Medium

  Out-of-bounds access vulnerability in the frequency modulation module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24926: Out-of-bounds write vulnerability in the camera module. 8.4 High

  Out-of-bounds write vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24925: Heap-based buffer overflow vulnerability in the image module. 7.3 High

  Heap-based buffer overflow vulnerability in the image module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24924: Vulnerability of improper permission control in the print module. 6.1 Medium

  Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  Updated 2026-03-05
• CVE-2026-24923: Permission control vulnerability in the HDC module. 6.3 Medium

  Permission control vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  Updated 2026-02-06
• CVE-2026-24922: Buffer overflow vulnerability in the HDC module. 6.9 Medium

  Buffer overflow vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24921: Address read vulnerability in the HDC module. 4.8 Medium

  Address read vulnerability in the HDC module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

  Updated 2026-02-06
• CVE-2026-24920: Permission control vulnerability in the AMS module. 6.2 Medium

  Permission control vulnerability in the AMS module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24919: Out-of-bounds write vulnerability in the DFX module. 6.0 Medium

  Out-of-bounds write vulnerability in the DFX module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24918: Address read vulnerability in the communication module. 6.8 Medium

  Address read vulnerability in the communication module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24917: UAF vulnerability in the security module. 6.5 Medium

  UAF vulnerability in the security module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24916: Identity authentication bypass vulnerability in the window module. 5.9 Medium

  Identity authentication bypass vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

  Updated 2026-02-06
• CVE-2026-24915: Out-of-bounds read issue in the media subsystem. 6.2 Medium

  Out-of-bounds read issue in the media subsystem. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality.

  Updated 2026-02-06
• CVE-2026-24914: Type confusion vulnerability in the camera module. 4.0 Medium

  Type confusion vulnerability in the camera module. Impact: Successful exploitation of this vulnerability may affect availability.

  Updated 2026-02-06
• CVE-2026-24913: SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained or altered by a user 8.7 High

  SQL Injection vulnerability exists in MATCHA INVOICE 2.6.6 and earlier. If this vulnerability is exploited, information stored in the database may be obtained or altered by a user who can log in to the product.

  Updated 2026-04-08
• CVE-2026-24912: ePower epower.ie Insufficient Session Expiration 6.9 Medium

  The WebSocket backend uses charging station identifiers to uniquely associate sessions but allows multiple endpoints to connect using the same session identifier. This implementation results in predictable session identifiers and enables session hijacking or shadowing, where the most recent connection displaces the legitimate charging station and receives backend commands intended for that station

  Updated 2026-03-09
• CVE-2026-24911: Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an 8.3 High

  Stack-based buffer overflow for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge

  Updated 2026-08-12
• CVE-2026-24910: In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github 5.9 Medium

  In Bun before 1.3.5, the default trusted dependencies list (aka trust allow list) can be spoofed by a non-npm package in the case of a matching name (for file, link, git, or github).

  Updated 2026-01-28
• CVE-2026-24909: vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction. 5.9 Medium

  vlt before 1.0.0-rc.10 mishandles path sanitization for tar, leading to path traversal during extraction.

  Updated 2026-01-28
• CVE-2026-24908: OpenEMR has SQL Injection in Patient API Sort Parameter 10.0 Critical

  OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, an SQL injection vulnerability in the Patient REST API endpoint allows authenticated users with API access to execute arbitrary SQL queries through the `_sort` parameter. This could potentially lead to database access, PHI (Protected Health Information) exposure, and cre

  Updated 2026-02-26
• CVE-2026-24907: October CMS has Stored XSS via Event Log Mail Preview 5.1 Medium

  October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the Event Log mail preview feature. When viewing logged mail messages, HTML content was rendered in an iframe without proper sandboxing, allowing JavaScript execution in the viewer's browser context. This issue has been fixed in versions 3.

  Updated 2026-04-14
• CVE-2026-24906: October CMS has Stored XSS in its Backend Editor Markup Classes 5.1 Medium

  October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a Stored Cross-Site Scripting (XSS) vulnerability in the Backend Editor Settings. The Markup Classes fields (used for paragraph styles, inline styles, table styles, etc.) did not sanitize input to valid CSS class name characters. Malicious values were rendered unsanitized in Froala editor dro

  Updated 2026-04-16
• CVE-2026-24905: Inspektor Gadget has a Command Injection vulnerability in Makefile.build 6.6 Medium

  Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The `ig` binary provides a subcommand for image building, used to generate custom gadget OCI images. A part of this functionality is implemented in the file `inspektor-gadget/cmd/common/image/build.go`. The `Makefile.build` file is the Makefile template empl

  Updated 2026-04-30
• CVE-2026-24904: TrustTunnel has `client_random_prefix` rule bypass via fragmented or partial TLS ClientHello 5.3 Medium

  TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In `tls_listener.rs`, `TlsListener::listen()` peeks 1024 bytes and calls `extract_client_random(...)`. If `parse_tls_plaintext` fails (for example, a fragmented/partial ClientHello split across TCP writes), `extract_client_random` returns `None`. In `rules.rs`, `RulesEngine::evaluate` only evaluates `

  Updated 2026-01-29
• CVE-2026-24903: OrcaStatLLM Researcher Stored Cross-Site Scripting (XSS) via Log Message Injection in Session Page 5.3 Medium

  OrcaStatLLM Researcher is an LLM Based Research Paper Generator. A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the Log Message in the Session Page in OrcaStatLLM-Researcher that allows attackers to inject and execute arbitrary JavaScript code in victims' browsers through malicious research topic inputs.

  Updated 2026-02-06
• CVE-2026-24902: TrustTunnel has SSRF and private network restriction bypass via numeric address destinations 7.1 High

  TrustTunnel is an open-source VPN protocol with a server-side request forgery and and private network restriction bypass in versions prior to 0.9.114. In `tcp_forwarder.rs`, SSRF protection for `allow_private_network_connections = false` was only applied in the `TcpDestination::HostName(peer)` path. The `TcpDestination::Address(peer) => peer` path proceeded to `TcpStream::connect()` without equiva

  Updated 2026-01-29
• CVE-2026-24901: Outline's IDOR allows unauthorized viewing and seizing of private deleted drafts 8.1 High

  Outline is a service that allows for collaborative documentation. Prior to 1.4.0, an Insecure Direct Object Reference (IDOR) vulnerability in the document restoration logic allows any team member to unauthorizedly restore, view, and seize ownership of deleted drafts belonging to other users, including administrators. By bypassing ownership validation during the restore process, an attacker can acc

  Updated 2026-03-17
• CVE-2026-24900: MarkUs has a submission-view IDOR exposes all student submissions 6.5 Medium

  MarkUs is a web application for the submission and grading of student assignments. Prior to 2.9.1, the courses/<:course_id>/assignments/<:assignment_id>/submissions/html_content accepted a select_file_id parameter to serve SubmissionFile objects containing a record of files submitted by students. This parameter was not correctly scoped to the requesting user, allowing users access arbitrary submis

  Updated 2026-02-10

Search a CVE ID or check dependency files →