CVE-2026-66xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
551 records · Page 4 of 6
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
UpdatedUnauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions.
UpdatedUnauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions.
UpdatedUnauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
UpdatedSubscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions.
Updated- CVE-2026-66459: WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability 6.5 Medium
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
Updated Unauthenticated SQL Injection in RealPress <= 1.1.2 versions.
Updated- CVE-2026-66457: WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability 7.1 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.
Updated Subscriber Cross Site Scripting (XSS) in Profile Extra Fields by BestWebSoft <= 1.3.4 versions.
Updated- CVE-2026-66455: WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability 6.0 Medium
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
Updated - CVE-2026-66454: WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability 6.5 Medium
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
Updated - CVE-2026-66453: WordPress Salon booking system plugin <= 10.30.26 - Broken Authentication vulnerability 9.8 Critical
Unauthenticated Broken Authentication in Salon booking system <= 10.30.26 versions.
Updated Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.
Updated- CVE-2026-66451: WordPress WP Event SOlution plugin <= 4.1.9 - Broken Authentication vulnerability 6.5 Medium
Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.
Updated - CVE-2026-66450: WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability 8.1 High
Unauthenticated Local File Inclusion in Geo Mashup <= 1.13.18 versions.
Updated - CVE-2026-66449: WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions.
Updated Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
Updated- CVE-2026-66447: WordPress WordPress File Upload plugin <= 5.1.7 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in WordPress File Upload <= 5.1.7 versions.
Updated - CVE-2026-66446: WordPress If-So Dynamic Content Personalization plugin <= 1.10 - SQL Injection vulnerability 9.3 Critical
Subscriber SQL Injection in If-So Dynamic Content Personalization <= 1.10 versions.
Updated - CVE-2026-66445: WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability 6.5 Medium
Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.
Updated Subscriber Sensitive Data Exposure in Payment Forms for Paystack <= 4.0.5 versions.
Updated- CVE-2026-66443: WordPress REST API Log plugin <= 1.7.1 - Sensitive Data Exposure vulnerability 7.5 High
Unauthenticated Sensitive Data Exposure in REST API Log <= 1.7.1 versions.
Updated - CVE-2026-66442: WordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability 5.4 Medium
Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.
Updated - CVE-2026-66441: WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability 7.5 High
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.
Updated Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.
UpdatedUnauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.
Updated- CVE-2026-66437: WordPress Feedzy plugin <= 5.2.4 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.
Updated - CVE-2026-66436: WordPress Active Products Tables for WooCommerce plugin <= 1.1.1 - SQL Injection vulnerability 9.3 Critical
Unauthenticated SQL Injection in Active Products Tables for WooCommerce <= 1.1.1 versions.
Updated - CVE-2026-66435: WordPress WP Rollback plugin <= 3.1.2 - Sensitive Data Exposure vulnerability 5.9 Medium
Insertion of Sensitive Information Into Sent Data vulnerability in Devin Walker WP Rollback wp-rollback allows Retrieve Embedded Sensitive Data.This issue affects WP Rollback: from n/a through 3.1.2.
Updated Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
UpdatedContributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.
Updated- CVE-2026-66432: WordPress WPJAM Basic plugin <= 7.0.2.1 - Sensitive Data Exposure vulnerability 7.5 High
Subscriber Sensitive Data Exposure in WPJAM Basic <= 7.0.2.1 versions.
Updated Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
UpdatedSubscriber SQL Injection in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
UpdatedUnauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.10 versions.
UpdatedUnauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
Updated- CVE-2026-66427: WordPress WP Google Review Slider plugin <= 18.4 - SQL Injection vulnerability 7.6 High
Administrator SQL Injection in WP Google Review Slider <= 18.4 versions.
Updated - CVE-2026-66426: WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability 7.1 High
Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions.
Updated Unauthenticated Broken Authentication in Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 versions.
Updated- CVE-2026-66424: WordPress SMS Alert Order Notifications plugin <= 3.9.7 - Privilege Escalation vulnerability 9.8 Critical
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.7 versions.
Updated - CVE-2026-66422: Apache Tomcat: Servlet role references can bypass declarative role constraints 8.1 High
Improper Authorization vulnerability in Apache Tomcat cause by security-role-ref definitions being incorrectly used as role aliases within the Realm in additional to the correct usage with Request.isUserInRole(). This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.24, from 10.1.0-M1 through 10.1.57, from 9.0.25 through 9.0.120. The following versions were EOL at the time the CVE wa
Updated OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute with
UpdatedMeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of th
UpdatedOpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive C
UpdatedLeantime 3.6.2 contains a cross-site request forgery vulnerability that allows unauthenticated attackers to perform state-changing actions on behalf of authenticated users by excluding the Laravel VerifyCsrfToken middleware from the global middleware stack in app/Http/Kernel.php. Attackers can craft malicious pages delivered via phishing emails or malicious websites to trigger unauthorized POST, P
UpdatedLeantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC AP
UpdatedLeantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for p
UpdatedLeantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by supplying arbitrary integer milestone IDs to the tickets.getMilestone JSON-RPC endpoint. Attackers can enumerate integer milestone IDs through the JSON-RPC API to access project planning information, milestone titles, descriptions,
UpdatedDEEBOT PRO M1 and DEEBOT PRO K1VAC incorrectly implement authentication algorithm in Websocket communications. An unauthenticated attacker may connect and operate the affected robot.
Updated- CVE-2026-66410: Android and iOS apps ECOVACS PRO App improperly validate server certificates. 2.3 Low
Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered.
Updated DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot.
UpdatedThe root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password of the root account.
UpdatedDEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered.
UpdatedDEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected products. As a result, arbitrary code may be executed with the administrative privilege.
UpdatedDEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.
UpdatedDEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.
UpdatedDEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved.
UpdatedFreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepti
UpdatedFreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.
UpdatedGrav Login Plugin versions before 3.8.13 contain an insufficient session expiration vulnerability in TokenStorage.php where the findTriplet() method fails to properly validate Remember Me token timestamps. Attackers with a captured Remember Me cookie can authenticate indefinitely instead of the configured timeout period, as the expiry check compares an array to a scalar value which always evaluate
UpdatedphpMyFAQ before 4.1.6 contains a privilege escalation vulnerability in GroupController::updateMembers() that allows administrators with only group-management permissions to join privileged groups without verification of required rights. Attackers can add themselves to pre-existing groups holding user-management rights and immediately inherit those permissions to modify or delete user accounts.
UpdatedphpMyFAQ before v4.1.6 contains a remote code execution vulnerability in the configuration API that allows authenticated administrators with CONFIGURATION_EDIT and ATTACHMENT_ADD privileges to write arbitrary PHP files by manipulating the upgrade.lastDownloadedPackage setting. Attackers can upload a malicious ZIP file as an attachment, point the updater configuration to its stored path, and extrac
UpdatedphpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during category updates, allowing authenticated attackers to delete arbitrary files by exploiting insufficient sanitization in Image::delete(). Attackers can delete the database.php configuration file to disable the installation gate and access the public setup wizard to create new superadmin accounts.
UpdatedSiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary code in the Electron renderer with full Node.js access when victims open affected documents.
UpdatedSiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with full Node.js access through insertAdjacentHTML rendering in an insecurely configured Electron renderer.
UpdatedSiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML parser treats as raw text but browsers interpret as executable SVG content when served as image/svg+xml, e
UpdatedNLTK versions before 3.9.4 contain an unbounded recursion vulnerability in JSONTaggedDecoder.decode_obj() that allows attackers to cause denial of service by supplying deeply nested JSON structures. Attackers can craft JSON payloads exceeding the recursion limit to trigger an unhandled RecursionError that crashes the Python process.
UpdatedApache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the certificate to an expected DNS name or IP address. A network attacker who can redirect or intercept a connection and who possesses a certificate issued by a CA trusted by the client for another name may impersonate the requested TLS endpoint. Affected Scenari
UpdatedUse of Insufficiently Random Values, Protection Mechanism Failure vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.
Updated- CVE-2026-66390: Apache Wicket: crafted Link URL strings can break out of the JavaScript sequence 6.1 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue.
Updated - CVE-2026-66384: Authenticated users may write data outside the intended Docker cache path 5.3 Medium
An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.
Updated - CVE-2026-66382: Authenticated users may write files outside the intended Artifactory work directory 4.3 Medium
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.
Updated A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.
UpdatedAn authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
UpdatedAn authenticated user may view private Puppet module metadata without repository read access.
UpdatedAn authenticated user without repository read permission may access private NuGet metadata under specific conditions.
UpdatedAn unauthenticated user may access restricted repository information under specific conditions.
UpdatedCredentials for a deleted user may remain valid for a short period under specific conditions.
UpdatedA low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
UpdatedKnot Resolver before 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.
UpdatedRedis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243.
UpdatedThe affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space.
UpdatedURL Redirection to Untrusted Site ('Open Redirect') vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to retarget a form already on the rendering page and receive whatever the victim submits, including credentials, via the form and formaction attributes on an <input> element in sanitized HTML. HTML's form attribute associates an input with any
UpdatedThe GOOSE parser contains an off-by-one boundary-handling flaw that can be triggered by a single unauthenticated Layer-2 multicast frame on the process bus. When specific GOOSE message fields are processed, the parser advances its internal buffer position incorrectly, resulting in a heap out-of-bounds read. On affected platforms, this condition reliably terminates the subscriber process and c
UpdatedThe GOOSE payload parser contains a boundary handling flaw that can be triggered by a single unauthenticated Layer 2 multicast frame on the process bus. When processing specific payload fields, an attacker controlled inner element length may exceed its enclosing length, causing the parser to over read by one byte. This out-of-bounds read reliably terminates the subscriber process, resulting i
Updated- CVE-2026-66362: NGF vulnerability 8.6 High
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configuration generator component of NGINX Gateway Fabric. User-supplied string values from the Authentication Filter Custom Resource Definition clientID or cookieName fields, or in the clientSecret field of a Secret referenced by an Authentication Filter, are rende
Updated The ISO Presentation layer contains a flaw in the handling of specific parameters during normal mode negotiation. A missing length check in the processing of the encoded presentation data allows an attacker controlled field with a zero length value to trigger a bounded heap over read. This condition occurs before MMS session establishment, a crafted TCP/102 connection attempt can trigger the
UpdatedA cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.
Updatedhttpd has never implemented obs-fold (RFC 2616 §2.2 / RFC 7230 §3.2.4 header continuation lines). Every CRLF followed by a non-CRLF octet unconditionally starts a new header. This missing feature became a security concern as the understanding of HTTP request smuggling attacks evolved. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 b
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, so the value reached the value attribute of the <input> rendered by the field com
UpdatedThe MMS server connection handler contains a flaw in its processing of BER-encoded request data. When an MMS confirmed request PDU containing an extended BER tag is received over an established session, the decoder may advance its internal buffer incorrectly due to a missing bounds check. This results in a one byte heap out-of-bounds read and causes the MMS service process to terminate, leadi
UpdatedNetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.
UpdatedThe Mira cloud authentication endpoints do not enforce per-account rate limiting, per-IP throttling, or account lockout after repeated failed login attempts. An attacker can use brute-force methods to obtain gain access to user accounts.
UpdatedA flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.
UpdatedA flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests.
UpdatedA flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.
Updated- CVE-2026-66331: Apache Thrift: Buffered transport reads are not accounted against MaxMessageSize 6.9 Medium
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Delphi bindings buffered transport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
Updated Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
UpdatedServer-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
Updated