CyberStack

NIST

CVE intelligence

Cached from NVD. 2026-10-26 00:40 Perth time (AWST). Recent.

1756KEV listed
209Published, last 14 days
654Critical
981High
CVETitleVendorPublishedCVSSKEV listed
CVE-2026-85126The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of it—2026-10-11—
CVE-2026-85121The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated —2026-10-11—
CVE-2026-85118The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions, —2026-10-11—
CVE-2026-84737The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthent—2026-10-11—
CVE-2026-84734The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own—2026-10-11—
CVE-2026-84261The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthentic—2026-10-11—
CVE-2026-84260The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthentica—2026-10-11—
CVE-2026-84259The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated en—2026-10-11—
CVE-2026-84258The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticate—2026-10-11—
CVE-2026-84254The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not have authorisation and CSRF checks when updating options via—2026-10-11—
CVE-2026-84253The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via —2026-10-11—
CVE-2026-84252The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST—2026-10-11—
CVE-2026-84251The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a —2026-10-11—
CVE-2026-81649The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying ins—2026-10-11—
CVE-2026-81420The Tcard WP WordPress plugin through 1.8.0 does not sanitise and escape a parameter before using it in a SQL statement in one of its unauth—2026-10-11—
CVE-2026-81156The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the galle—2026-10-11—
CVE-2026-81155The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allow—2026-10-11—
CVE-2026-81154The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layout—2026-10-11—
CVE-2026-81153The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery p—2026-10-11—
CVE-2026-14854The WooCommerce Bookings WordPress plugin before 3.11.0 does not limit a user-supplied value before using it to allocate memory in one of it—2026-10-11—
CVE-2026-12980The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, —2026-10-11—
CVE-2026-108887JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authent—2026-10-11—
CVE-2026-108886JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows —2026-10-11—
CVE-2026-108885JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged—2026-10-11—
CVE-2026-108884JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageTemplateController delete handler that allows any au—2026-10-11—
CVE-2026-108883JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user —2026-10-11—
CVE-2026-108882JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows a—2026-10-11—
CVE-2026-108881JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getTenantPackInfo handler that allows any authenticated user t—2026-10-11—
CVE-2026-108880JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any auth—2026-10-11—
CVE-2026-108879JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability in AiragBaseApiController that allows authenticated users—2026-10-11—
CVE-2026-108878JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privilege—2026-10-11—
CVE-2026-108877JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delet—2026-10-11—
CVE-2026-108876JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the putCancelQuit handler of SysUserController, allowing any authe—2026-10-11—
CVE-2026-108875JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any auth—2026-10-11—
CVE-2026-108874JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department hea—2026-10-11—
CVE-2026-108873JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any departme—2026-10-11—
CVE-2026-108872JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any au—2026-10-11—
CVE-2026-108871JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-—2026-10-11—
CVE-2026-108870JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privile—2026-10-11—
CVE-2026-108869JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announc—2026-10-11—

Previous41–80 of 209Next