CVE-2026-61xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
795 records · Page 1 of 8
- CVE-2026-61998: WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
Updated - CVE-2026-61997: WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions.
Updated Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
Updated- CVE-2026-61994: WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability 5.4 Medium
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.
Updated - CVE-2026-61993: WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions.
Updated - CVE-2026-61992: WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions.
Updated - CVE-2026-61991: WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability 10.0 Critical
Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.5 versions.
Updated- CVE-2026-61985: WordPress Car Rental Manager plugin <= 1.3.7 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Rental Manager: from n/a through <= 1.3.7.
Updated - CVE-2026-61984: WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability 7.5 High
Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.
Updated - CVE-2026-61983: WordPress Church Admin plugin <= 5.0.30 - Broken Access Control vulnerability 5.3 Medium
Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Church Admin: from n/a through <= 5.0.30.
Updated Unauthenticated Cross Site Scripting (XSS) in SiteGuard WP Plugin <= 1.8.6 versions.
UpdatedUnauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
UpdatedUnauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.
UpdatedUnauthenticated Privilege Escalation in SAML SP Single Sign On <= 5.4.3 versions.
UpdatedUnauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
Updated- CVE-2026-61977: WordPress JetSearch plugin <= 3.6.1.2 - Sensitive Data Exposure vulnerability 5.3 Medium
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetSearch jet-search allows Retrieve Embedded Sensitive Data.This issue affects JetSearch: from n/a through <= 3.6.1.2.
Updated Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.5.0.
Updated- CVE-2026-61975: WordPress JetReviews plugin <= 3.0.1 - Sensitive Data Exposure vulnerability 5.3 Medium
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Crocoblock JetReviews jet-reviews allows Retrieve Embedded Sensitive Data.This issue affects JetReviews: from n/a through <= 3.0.1.
Updated - CVE-2026-61974: WordPress Mang Board WP plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions.
Updated - CVE-2026-61973: WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability 4.3 Medium
Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
Updated - CVE-2026-61972: WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability 5.3 Medium
Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
Updated Authorization Bypass Through User-Controlled Key vulnerability in Cozmoslabs User Profile Picture metronet-profile-picture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Profile Picture: from n/a through <= 2.6.3.
UpdatedServer-Side Request Forgery (SSRF) vulnerability in Themeisle Auto Featured Image (Auto Post Thumbnail) auto-post-thumbnail allows Server Side Request Forgery.This issue affects Auto Featured Image (Auto Post Thumbnail): from n/a through <= 5.0.4.
UpdatedUnauthenticated SQL Injection in Listdom <= 5.6.0 versions.
UpdatedMissing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through <= 3.1.2.
Updated- CVE-2026-61967: WordPress miniorange otp verification plugin <= 5.5.1 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in miniorange otp verification <= 5.5.1 versions.
Updated Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions.
Updated- CVE-2026-61965: WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in GeekyBot <= 1.2.6 versions.
Updated - CVE-2026-61964: WordPress Ninja Tables plugin <= 5.2.9 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Ninja Tables <= 5.2.9 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions.
Updated- CVE-2026-61962: WordPress WP BASE Booking plugin <= 6.3.0 - Arbitrary Code Execution vulnerability 10.0 Critical
Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions.
Updated - CVE-2026-61961: WordPress EmbedPress plugin <= 4.5.6 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in EmbedPress <= 4.5.6 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions.
UpdatedSubscriber Cross Site Scripting (XSS) in Business Directory <= 6.4.24 versions.
UpdatedMissing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects License Manager for WooCommerce: from n/a through <= 3.0.17.
UpdatedUnauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in hamsalam ووسلام – همگام سازی ووکامرس و باسلام sync-basalam allows Cross Site Request Forgery.This issue affects ووسلام – همگام سازی ووکامرس و باسلام: from n/a through <= 1.9.1.
UpdatedImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hannan گرویتی فرم فارسی persian-gravity-forms allows Blind SQL Injection.This issue affects گرویتی فرم فارسی: from n/a through <= 3.0.2.
UpdatedUnauthenticated Broken Access Control in PayU India <= 3.8.9 versions.
UpdatedUnauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.
UpdatedMissing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Bulk Edit Products – WP Sheet Editor: from n/a through <= 1.8.21.
Updated- CVE-2026-61951: WordPress TrueBooker plugin <= 1.2.3 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in TrueBooker <= 1.2.3 versions.
Updated Unauthenticated SQL Injection in TrueBooker <= 1.2.3 versions.
UpdatedUnauthenticated SQL Injection in Bookly <= 27.7 versions.
Updated- CVE-2026-61948: WordPress WPDM – Premium Packages plugin <= 6.2.0 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions.
UpdatedUnauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
UpdatedExposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedded Sensitive Data. This issue affects WooCommerce Product Stock Alert: from n/a through 3.0.6.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions.
UpdatedUnauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.
UpdatedUse after free in Winlogon allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedInteger overflow or wraparound in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.
UpdatedMissing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.
UpdatedUse after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Perception Simulation Service allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedCleartext storage of sensitive information in Windows Hello allows an authorized attacker to perform tampering locally.
UpdatedUse after free in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows USB Driver allows an authorized attacker to elevate privileges locally.
UpdatedIncorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in Windows Display Enhancement Service allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network.
UpdatedOut-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
UpdatedOut-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned, such as ARM64, allow remote attackers to cause a process crash and denial of service by sending crafted input containing bytes with the high bit set. Root Cause: Two 256-entry lookup tables are accessed through pointers biased by 128 so that valid i
UpdatedAn issue was discovered in Cyrus IMAP before 3.12.4. There is a VPATCH BYPARAM double-free. An authenticated calendar user could crash a Cyrus CalDAV worker with a PATCH containing PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector would be freed once on each iteration over the properties.
UpdatedAn issue was discovered in Cyrus IMAP before 3.12.4. There is a Sieve mailbox existence oracle. An authenticated user could install a Sieve script that probed whether another user's private mailbox existed, or read the value of shared mailbox annotations, by observing which fileinto branch fired during LMTP delivery.
UpdatedAn issue was discovered in Cyrus IMAP before 3.12.4. Mailbox/set let a sharee change a special-use role on shared mailboxes. An authenticated user with maySetKeywords on another user's mailbox could change that mailbox's specialuse annotation. This could allow the sharee to change the shared mailbox to perform the archived, snoozed, or other role, which might cause mail mail to be written to the s
UpdatedAn issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL. An authenticated DAV user with some shared access to another user's calendar or address book could read even unshared events or contacts by including the target hrefs in a calendar-multiget or addressbook-multiget REPORT.
UpdatedAn issue was discovered in Cyrus IMAP before 3.12.4. A JMAP email-header blob ID can reference an out-of-bounds index. An authenticated user could attempt to download a crafted JMAP blob ID of the form H<emailid>-<index>, which could read past the end of the internal blob_headers array during download, exposing adjacent heap memory.
UpdatedAn issue was discovered in Cyrus IMAP before 3.12.4. JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.
UpdatedApache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in memcache and couchbase response parsing. A remote unauthenticated peer can cause an affected process to buffer message data beyond the configured limit, which may lead to memory exhaustion and denial of service. Users should upgrade to 1.18.0 or ap
UpdatedJoomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect.
Updated- CVE-2026-61900: Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 10.0 Critical
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.
Updated Vulnerability in tapestry-core in Apache Tapestry 5.5.0+ on all platforms allows attackers to download clsspath assets via specially crafted URLs. Users are recommended to upgrade to version 5.9.1, which fixes this issue.
UpdatedThe Ubuntu-specific language helper scripts (save-to-pam-env, update-langlist) shipped with accountsservice before 23.13.9-8ubuntu7 treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input. The value is interpolated unescaped into a GNU sed replacement expression, allowing an attacker to inject a sed 'e' flag and arbitrary shell commands that execute with the privileges of t
UpdatedAn Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 (root). A shell spawned by a helper script inherits ruid=0 and may reset its effective UID to root, enabling local privilege escalation.
UpdatedA crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer.
UpdatedWeintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.
UpdatedIn Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /files/`) that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any allow-listed root. In browser (non-Electron) deployments the connection token is enforced only on WebS
UpdatedWeintek cMT3092X HMI stores user account passwords in plaintext.
Updated- CVE-2026-61884: Tycon Systems TPDIN-Monitor-WEB2 Missing Authentication for Critical Function 9.3 Critical
The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can reach full device controls, including power relay management, device reboot, remot
Updated LuCI versions fail to properly encode DHCPv6 lease hostnames before rendering in status tables, allowing adjacent network attackers to inject HTML markup. Attackers can send a DHCPv6 Client FQDN containing script tags that execute in the administrator's browser when viewing DHCP lease pages.
Updatedluci-app-upnp contains a stored cross-site scripting vulnerability that allows unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which miniupnpd stores and luci-app-upnp renders without output encoding, executing the payload when administrators view the UPnP or Status pages.
Updatedfilebrowser versions before 2.63.17 fail to normalize paths before querying the share index in DeleteWithPathPrefix, allowing authenticated users to leave stale public shares behind. Attackers can delete a shared directory using a trailing-slash path, then recreate the same directory to expose new contents through the dormant public share URL.
UpdatedGrav before 9.1.8 contains an arbitrary file write vulnerability in the Form plugin's process.save.filename parameter, which is validated against path traversal before Twig processing but never re-validated after rendering. Attackers can submit form data containing path traversal sequences that are processed through Twig templates, allowing them to write arbitrary files including PHP webshells to
UpdatedImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to increased memory consumption.
UpdatedImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of service.
UpdatedImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause denial of service.
UpdatedImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.
UpdatedImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).
Updated