CVE-2026-56xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
687 records · Page 7 of 7
Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.
UpdatedDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection.
UpdatedDell ThinOS 10, versions prior to 2605_10.2100 contain a Protection Mechanism Failure vulnerability. An attacker with physical access could potentially exploit this vulnerability, leading to unauthorized access to encrypted data.
UpdatedDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.
UpdatedDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an use of uninitialized resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure.
UpdatedDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Serv
UpdatedCapgo (Cap-go/capgo) before 12.128.2 contains an improper access control vulnerability in the SECURITY DEFINER PostgREST RPC function public.record_build_time, which is granted to the anon role and callable with only the public Supabase publishable (sb_publishable_*) anon key. An unauthenticated attacker can insert rows into public.build_logs for arbitrary organizations and, because the function u
UpdatedCap-go before 12.128.2 contains an authentication logic flaw that lets an attacker register and control an account bound to a victim's email address before that email is verified. By enabling two-factor authentication on the pre-registered account, the attacker gains control over the account claimed under the victim's identity, allowing them to read and modify its state and enforce organization-le
UpdatedCapgo before 12.128.2 contains a flaw in the Enforce Password Policy feature: after a Super Admin enables the policy and successfully changes their password to a compliant one, the backend does not update the password-compliance state. As a result, the backend continues to treat the account as non-compliant and repeatedly forces password-reset prompts, permanently locking the Super Admin out of or
UpdatedCapgo before 12.128.2 contains a cross-tenant authorization bypass vulnerability in PostgREST endpoints that allows org-scoped read API keys to access other tenants' webhook secrets and delivery logs. Attackers can query the webhooks and webhook_deliveries endpoints to exfiltrate HMAC signing secrets and delivery payloads, enabling forged webhook events against victim organizations.
Updated- CVE-2026-56078: PraisonAI - Arbitrary File Read and Write via Path Traversal in MultiAgentMonitor 8.7 High
PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files, enabling sensitive disclosure, denial of service, or code execution.
Updated PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. Attackers can exploit the lack of agent ID uniqueness enforcement to share ledger instances and expose system prompts and conversation history between agents.
UpdatedPraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, combined with Starlette's Content-Type-agnostic JSON parsing, enabling attackers to bypass CORS preflight checks via simple requests a
Updated- CVE-2026-56075: PraisonAI - Arbitrary Shell Command Execution via Hardcoded Approval Mode Override 8.7 High
PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands via subprocess.run with shell=True, bypassing the manual approval gate and insufficient
Updated PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and credentials via subsequent shell commands without user consent.
UpdatedCap-go before 12.128.2 contains an authentication bypass vulnerability in OTP verification that allows attackers to bypass email verification by modifying server responses. Attackers can intercept OTP verification requests and manipulate HTTP responses to falsely mark verification successful, enabling unauthorized 2FA enablement and account takeover.
Updated- CVE-2026-56072: WordPress WoodMart theme <= 8.5.3 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WoodMart <= 8.5.3 versions.
Updated - CVE-2026-56071: WordPress Forminator plugin <= 1.53.1 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.
Updated - CVE-2026-56070: WordPress Advance Product Search plugin <= 1.4.4 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions.
Updated Unauthenticated Insecure Direct Object References (IDOR) in Toolset Forms <= 2.6.24 versions.
UpdatedUnauthenticated SQL Injection in JetEngine <= 3.8.10.2 versions.
Updated- CVE-2026-56067: WordPress JetSmartFilters plugin <= 3.8.3 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in JetSmartFilters <= 3.8.3 versions.
Updated Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
UpdatedSubscriber SQL Injection in Tourfic <= 2.22.5 versions.
Updated- CVE-2026-56063: WordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability 8.3 High
Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.
Updated Unauthenticated SQL Injection in Quotes llama <= 3.1.5 versions.
UpdatedUnauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions.
Updated- CVE-2026-56059: WordPress Travel Booking theme <= 2.2.5 - Arbitrary File Upload vulnerability 9.9 Critical
Subscriber Arbitrary File Upload in Travel Booking <= 2.2.5 versions.
Updated - CVE-2026-56058: WordPress Quform plugin <= 2.23.0 - Arbitrary File Upload vulnerability 9.9 Critical
Subscriber Arbitrary File Upload in Quform <= 2.23.0 versions.
Updated - CVE-2026-56057: WordPress Uncanny Automator Pro plugin <= 7.3.0.6 - PHP Object Injection vulnerability 9.8 Critical
Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions.
Updated - CVE-2026-56056: WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.
Updated Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.
Updated- CVE-2026-56054: WordPress JS Help Desk plugin <= 3.1.1 - Arbitrary File Deletion vulnerability 7.7 High
Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.
Updated - CVE-2026-56053: WordPress EventPrime plugin <= 4.3.4.1 - PHP Object Injection vulnerability 8.8 High
Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.
Updated Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in FunnelKit Funnel Builder by FunnelKit allows Blind SQL Injection. This issue affects Funnel Builder by FunnelKit: from n/a through 3.15.0.5.
UpdatedUnauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.
UpdatedImproper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.
Updated- CVE-2026-56049: WordPress Post Snippets plugin <= 4.0.19 - Remote Code Execution (RCE) vulnerability 8.5 High
Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.
Updated Unauthenticated Insecure Direct Object References (IDOR) in Payment Gateway Based Fees and Discounts for WooCommerce <= 3.0.0 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in perfmatters <= 2.6.3 versions.
Updated- CVE-2026-56046: WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Subscriber Cross Site Scripting (XSS) in ListingPro <= 2.9.11 versions.
Updated - CVE-2026-56045: WordPress Automatic plugin < 3.135.1 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions.
Updated - CVE-2026-56044: WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions.
UpdatedCustomer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Responsive Lightbox <= 2.7.6 versions.
Updated- CVE-2026-56040: WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Gutenverse Form <= 2.4.7 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Quick Interest Slider <= 3.1.6 versions.
UpdatedContributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.
Updated- CVE-2026-56037: WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability 8.8 High
Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3.
Updated Unauthenticated SQL Injection in 워드프레스 결제 심플페이 <= 5.5.6 versions.
Updated- CVE-2026-56035: WordPress BitFire Security plugin <= 5.0.3 - Multiple Vulnerabilities vulnerability 8.6 High
Unauthenticated Multiple Vulnerabilities in BitFire Security <= 5.0.3 versions.
Updated - CVE-2026-56034: WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in Library Management System <= 3.5.7 versions.
Updated - CVE-2026-56033: WordPress Dokan Pro plugin <= 5.0.4 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in Dokan Pro <= 5.0.4 versions.
Updated - CVE-2026-56032: WordPress Buddyboss Platform plugin <= 3.0.4 - PHP Object Injection vulnerability 9.8 Critical
Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions.
Updated - CVE-2026-56031: WordPress Uncanny Automator plugin <= 7.3.1.2 - PHP Object Injection vulnerability 8.1 High
Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions.
Updated Unauthenticated Privilege Escalation in Paytium <= 5.0.2 versions.
UpdatedUnauthenticated Broken Authentication in CorvusPay WooCommerce Payment Gateway <= 2.7.4 versions.
UpdatedUnauthenticated Privilege Escalation in Easy Elements for Elementor – Addons & Website Templates <= 1.4.9 versions.
Updated- CVE-2026-56027: WordPress Booster for WooCommerce plugin <= 8.0.1 - Arbitrary File Upload vulnerability 9.9 Critical
Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions.
Updated Subscriber Server Side Request Forgery (SSRF) in utm.codes <= 1.9.0 versions.
UpdatedUnauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal WP EasyPay allows Cross Site Request Forgery. This issue affects WP EasyPay: from n/a through 4.5.0.
UpdatedCustomer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
Updated- CVE-2026-56022: Webmin MFA bypass 6.9 Medium
Webmin accepts basic authentication without session cookies when an attacker provides the 'User-Agent: webmin' header, allowing bypass of additional MFA requirements. Fixed in 2.640.
Updated Webmin allows unauthenticated attackers to read the contents of any file ending in .conf within module directories, due to a bypassable regex pattern.
UpdatedThe Webmin HTTP server (miniserv.pl) allows unauthenticated attackers to impersonate any user with a configured SSL client certificate by sending a forged HTTP header. A remote attacker can spoof certificate DNs and authenticate as any user. Fixed in 2.202.
UpdatedJavaScript::Minifier::XS versions before 0.16 for Perl leak memory on every call to minify(), allowing unbounded memory growth. In JsMinify (XS.xs) the cleanup frees only the NodeSet structures and never the per-token contents buffers allocated in JsSetNodeContents; JsDiscardNode unlinks nodes without freeing their contents. Each token's contents buffer is therefore leaked on every call, and the
UpdatedJavaScript::Minifier::XS versions before 0.16 for Perl crash with a NULL pointer dereference when the first meaningful token of the input is a slash. The regexp versus division disambiguator in JsTokenizeString (XS.xs) inspects the previous token's last byte to choose between a regexp literal and a division operator. When a slash is the first meaningful token, with the start of input or only whit
UpdatedCGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The generate_id method builds the session id from a MD5 digest of the process id, the epoch time, and the built-in rand() function. All three are predictable, low-entropy sources: the PID is drawn from a small range, the epoch time can be guessed or read from the HTTP Date header, and Pe
UpdatedNet::IP::LPM versions before 1.11 for Perl allow a heap out-of-bounds read via an unbounded prefix length. add() passes the prefix string to the trie builder addPrefixToTrie() without checking it against the address width. addPrefixToTrie() then walks the prefix buffer by prefix_length bits, reading prefix[byte] for byte up to prefix_len/8, where prefix is the 4-byte (IPv4) or 16-byte (IPv6) pac
Updated- CVE-2026-56014: WordPress Master Slider plugin <= 3.11.5 - Cross Site Scripting (XSS) vulnerability 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5.
Updated Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.
Updated- CVE-2026-56012: WordPress Media LIbrary Assistant plugin <= 3.35 - SQL Injection vulnerability 8.5 High
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant allows Blind SQL Injection. This issue affects Media LIbrary Assistant: from n/a through 3.35.
Updated Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions.
UpdatedSubscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bricksable for Bricks Builder allows Stored XSS. This issue affects Bricksable for Bricks Builder: from n/a through 1.6.83.
Updated- CVE-2026-56008: WordPress Fusion Builder plugin <= 3.15.4 - Privilege Escalation vulnerability 8.8 High
Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions.
Updated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Product Sharing allows Stored XSS. This issue affects Ocean Product Sharing: from n/a through 2.2.2.
Updated- CVE-2026-56006: WordPress H5P plugin <= 1.17.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.
Updated Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
UpdatedA shellcode injection in the mercurial handler of the obs tar_scm source service before version 0.12.4 could be used by attackers able to provide a _service file to execute code as the source service or the local user checking out the malicious services
UpdatedA heap buffer overflow due to missing size checking in the property buffer when parsing PCF files in libXfont2 ComputeScaledProperties() before libXfont2 before 2.0.8 could be used by attackers using authenticated X clients to execute code within the X server.
UpdatedA heap bufferflow in pcfReadFont() due to missing glyph bounds checking in libXfont2 before 2.0.8 allows attackers authenticated as X client to execute code within the X server.
UpdatedA heap buffer overflow in BitmapScaleBitmaps in libXfont2 before 2.0.8 due to an overflowing 32bit size could be used by attackers able to access the X Server to execute code within the X server cont
Updated- CVE-2026-56000: xorg-x11-server / xwayland GLX contextTags Use-After-Free in CommonMakeCurrent() 9.0 Critical
Local attackers with a X connection able to provide GLX commit to the X server xorg-server before 21.2.24 and xwayland before 24.1.13 could cause a Heap Use After Free, due to CommonMakeCurrent() pointing into potentially reallocated memory.
Updated