CVE-2026-66xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
551 records · Page 2 of 6
Relative Path Traversal in the ISA-Tab parser in Apache Software Foundation Apache Tika from 1.8 through 3.3.1, and 4.0.0-alpha-1, allows an attacker who can place files in a directory that the application subsequently parses to read arbitrary files accessible to the Tika process and have their contents emitted into the extracted text output, via a "Study Assay File Name" value in the ISA-Tab inve
Updated- CVE-2026-66754: Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding 8.2 High
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix while the raw percent-encoded path does not, causing the assert! to fail and triggering either a 500 erro
Updated tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return (0x0D) and line feed (0x0A) bytes into HTTP header values on both request and response sides due to insufficient validation in header parsing and serialization. Attackers can exploit this injection primitive to perform response splitting, cache poisoning, session fixation via Se
Updatedtiny-http through 0.12.0 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize request framing by sending a Transfer-Encoding header with any value, including non-chunked codings, which causes the library to unconditionally apply chunk-decoding and discard Content-Length. Attackers can exploit the discrepancy between tiny_http's improper Transfer-Encoding p
UpdatedLet's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers can enumerate room IDs via the rooms listing endpoint and permanently archive private or password-protected rooms they cannot access, with no application-level
Updated- CVE-2026-66750: Let's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route 5.3 Medium
Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other u
Updated - CVE-2026-66749: Let's Chat 0.4.0 - 0.4.8 Denial of Service via Null Dereference in Room Lookup 7.1 High
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an uncaught TypeError in an asynchronous Mongoose callback that terminates the Node.js server process, with th
Updated Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with custom_fields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the select_eval custom field type. Attackers can store an attacker-controlled Ruby expression in the field options command parameter, which is evaluated via instance_
UpdatedZbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP
UpdatedRouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arbitrary response headers by embedding carriage return (0x0D) or line feed (0x0A) bytes into attacker-controlled input. Attackers can exploit percent-decoded query parameters reflected into response headers or inject bare LF characters into Cookie header values that are interpolate
UpdatedArtica Proxy before 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controlled session identifier and wait for a victim to authenticate through fw.login.php, after which the att
UpdatedSPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value to break out of an internal quoted string context when evaluated as PHP. An authenticated attacker with at minimum editor (redacteur) privileges can submit a single crafted GET reque
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Updated · Rejected recordSonic 3 A.I.R. before commit 2492d18 contains an unbounded memory allocation vulnerability in ReceivedPacketCache::enqueuePacket() that allows unauthenticated remote attackers to crash the server process by sending a crafted UDP packet with mUniquePacketID set to the maximum uint32 value. The mUniquePacketID field is read directly from the UDP wire-format packet header without bounds checking, cau
UpdatedSonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved by a two-byte local connection handle alone without verifying that the datagram source address matches the registered remote address for the connection. An on-path attacker who can observe cleartext UDP traffic can inject arbitrary packets
Updatedfacil.io 0.7.5 through 0.7.6 contains a denial-of-service vulnerability in the HTTP/1.1 chunked transfer encoding parser that allows unauthenticated remote attackers to crash the server by sending a negative chunk size value. Attackers can send a single POST request with a Transfer-Encoding: chunked header containing a leading minus sign in the chunk size field, causing the parser in http1_parser.
Updatedfacil.io 0.6.0 through 0.7.6 contains a denial-of-service vulnerability in the multipart body parser that allows an unauthenticated remote attacker to permanently freeze worker processes at 100% CPU by sending a multipart/form-data request with a partial closing boundary. The missing progress guard in the parser loop causes http_mime_parse to return 0 bytes consumed without setting done or error f
Updated- CVE-2026-66729: facil.io 0.6.0 - 0.7.6 Integer Underflow DoS via Multipart MIME Body Parser 8.7 High
facil.io 0.6.0 through 0.7.6 contains an integer underflow vulnerability in the multipart MIME body parser that allows unauthenticated remote attackers to crash the server process by sending a crafted Content-Disposition header with an empty field name. Attackers can trigger a uint32_t wraparound in http_mime_parser.h causing an out-of-bounds memory read past the name pointer, resulting in a bus f
Updated MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to the documented PUT method. This allows any authenticated user without the adding_configs or adding_blobs capabilities to upload config and text blob objects to th
Updated- CVE-2026-66723: Missing authentication requirement in Remote Instances proxy API in MWDB Core 7.0 High
MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send arbitrary requests to a remote MWDB instance using the identity and permissions associated with the configured API key. This can result in unauthorized actions
Updated Improper authorization for CRUD operations on Project Roles and Project Role permissions for domain admins in CloudStack. A Domain Admin can create, update, delete, and list project roles and project role permissions for projects in any domain, not just their own. The check only confirms the caller is a Domain Admin, without verifying whether the target project belongs to their domain or subdo
UpdatedMissing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment without domain scoping. It should instead be restricted to only the hosts dedicated to that admin's domain. This issue affects Apache CloudStack: from 4.12.0.0
UpdatedThe GOOSE subscriber component improperly validates the UTC timestamp field in unauthenticated IEC 61850 GOOSE (EtherType 0x88B8) Layer-2 multicast messages. A specially crafted GOOSE frame containing an undersized timestamp field can trigger a heap out-of-bounds read during message processing, causing the process to crash and resulting in a denial-of-service condition.
UpdatedDeserialization of Untrusted Data (CWE-502) in the Tribes-based clustering component in Apache Software Foundation Apache Axis2/Java through 2.0.0 on Apache Tomcat (only when Tribes clustering is enabled, which is off by default) allows an unauthenticated remote attacker with network access to the clustering port to execute arbitrary code via a crafted serialized Java object delivered
Updated- CVE-2026-66712: WordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability 7.5 High
Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.
Updated Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.
UpdatedUnauthenticated Local File Inclusion in e2pdf <= 1.32.40 versions.
Updated- CVE-2026-66709: WordPress CTX Feed plugin <= 6.6.42 - Remote Code Execution (RCE) vulnerability 9.1 Critical
Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions.
Updated - CVE-2026-66708: WordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability 8.2 High
Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.
UpdatedAuthor Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.
UpdatedUnauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.
Updated- CVE-2026-66703: WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.
Updated- CVE-2026-66701: WordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability 5.3 Medium
Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions.
UpdatedCustom role Broken Access Control in Dokan <= 5.0.10 versions.
Updated- CVE-2026-66698: WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
UpdatedContributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions.
UpdatedUnauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.
UpdatedSubscriber Broken Access Control in Motors <= 1.4.113 versions.
UpdatedCustomer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions.
UpdatedUnauthenticated Broken Access Control in Nokri <= 1.6.6 versions.
Updated- CVE-2026-66690: WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.
Updated Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
UpdatedContributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.
Updated- CVE-2026-66687: WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions.
Updated Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Export Import Menus <= 1.9.2 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions.
Updated- CVE-2026-66682: WordPress Abandoned Cart Pro for WooCommerce plugin <= 10.4.0 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions.
Updated Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions.
Updated- CVE-2026-66680: WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.
Updated Unauthenticated Broken Access Control in Appointment Hour Booking <= 1.5.91 versions.
UpdatedContributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.
UpdatedSubscriber Broken Authentication in Leyka <= 3.32.3 versions.
Updated- CVE-2026-66676: WordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability 5.3 Medium
Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions.
Updated Unauthenticated Bypass Vulnerability in Simple Cloudflare Turnstile <= 1.42.1 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions.
UpdatedUnauthenticated PHP Object Injection in Flatastic <= 2.0 versions.
UpdatedUnauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
UpdatedUnauthenticated Local File Inclusion in Måne <= 1.7 versions.
Updated- CVE-2026-66668: WordPress Community by PeepSo plugin <= 9.0.5.2 - SQL Injection vulnerability 8.5 High
Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions.
Updated - CVE-2026-66667: WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.
Updated Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue affects WordPress: from 7.1 through 7.1.2, from 7.0 through 7.0.6, from 6.9 through 6.9.9, from 6.8 through 6.8.10, from 6.7 through 6.7.9, and from 6.6 through 6.6.9.
Updated- CVE-2026-66665: WordPress Type Hub plugin <= 2.0.6 - Arbitrary File Upload vulnerability 10.0 Critical
Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.
Updated- CVE-2026-66663: WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.
Updated - CVE-2026-66662: WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps <= 3.29.10 versions.
Updated - CVE-2026-66661: WordPress Directories Pro plugin <= 2.0.5 - Privilege Escalation vulnerability 7.7 High
Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions.
Updated Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
Updated- CVE-2026-66659: WordPress Tablesome Table plugin <= 1.2.9 - SQL Injection vulnerability 9.3 Critical
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tablesome Table: from n/a through 1.2.9.
Updated Subscriber SQL Injection in Reviewer <= 3.14.2 versions.
Updated- CVE-2026-66657: WordPress Biagiotti Core plugin <= 2.1.1 - Local File Inclusion vulnerability 8.1 High
Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions.
Updated Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions.
UpdatedSubscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.
UpdatedUnauthenticated Local File Inclusion in Barista <= 2.5.1 versions.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in ThemeGoods Grand Tour allows Cross Site Request Forgery. This issue affects Grand Tour: from n/a through 5.5.1.
Updated- CVE-2026-66651: WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability 6.5 Medium
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20.
Updated - CVE-2026-66650: WordPress FreightCo theme <= 1.1.15 - PHP Object Injection vulnerability 9.8 Critical
Unauthenticated PHP Object Injection in FreightCo <= 1.1.15 versions.
Updated Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions.
UpdatedUnauthenticated Privilege Escalation in Jawn <= 1.4.2 versions.
UpdatedSubscriber Broken Access Control in Homlisti <= 3.1.2 versions.
Updated- CVE-2026-66646: WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.
Updated Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.
Updated- CVE-2026-66644: WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.
Updated - CVE-2026-66643: WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.
Updated Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrella allows Cross Site Request Forgery. This issue affects WP Umbrella: from 2.24.2 through 2.26.2.
UpdatedContributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.
Updated- CVE-2026-66640: WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.
Updated Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.
UpdatedContributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.
UpdatedContributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.
Updated- CVE-2026-66636: WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.
Updated Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.
Updated