Tagged “nvd”
CVEs tagged nvd, newest first.
25282 CVEsRSS
CVE-2026-59990High· 7.5Jawn is an open source JSON parser
Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth limit, allowing a remote attacker who can submit untrusted JSON to grow parser contexts until th…
CVE-2026-55456NoneRejected reason: This CVE is a duplicate of another CVE.
Rejected reason: This CVE is a duplicate of another CVE.
CVE-2026-92284Medium· 6.9PoCCaddy is an extensible server platform that uses TLS by default
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body m…
CVE-2026-55632Medium· 4.3GoCD is a continuous deliver server
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal pipeline structure API used for autocompletion while editing pipeline, template, environment, and user-preference configuration returns its users-and-roles mode …
CVE-2026-52744Medium· 5.3GoCD is a continuous deliver server
GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authent…
CVE-2026-92700Medium· 6.3PoCCaddy is an extensible server platform that uses TLS by default
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rule…
CVE-2026-92730High· 7.4LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.
CVE-2026-71459Medium· 5.0JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user
JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_…
CVE-2026-71458Medium· 5.0URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC
URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 responses, leaving the pk=0 miss path with a different 404 de…
CVE-2026-96541High· 7.5PoCA denial-of-service flaw was found in gnome-remote-desktop
A denial-of-service flaw was found in gnome-remote-desktop. An unauthenticated remote attacker can open RDP connections without completing the handshake and retain the connection-throttling slots indefinitely because no pre-authenticatio…
CVE-2026-75131High· 7.8PoCNetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a cr…
NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains a privilege escalation vulnerability that allows local users with permission to create VPN connections to execute arbitrary code as root by injecting pppd options through a cr…
CVE-2026-93513Medium· 4.3Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.
CVE-2026-93529Medium· 6.5Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
CVE-2026-93526High· 7.1Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
CVE-2026-93620Medium· 6.5Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
CVE-2026-93527High· 8.5Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.
CVE-2026-93623Medium· 5.3Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.
CVE-2026-93622High· 7.1Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.
CVE-2026-93773High· 8.5Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.
CVE-2026-93772Medium· 6.5Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.
Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.
CVE-2026-93774High· 7.1Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.
CVE-2026-94118Medium· 6.5Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.
Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.
CVE-2026-94080Medium· 5.3Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.
CVE-2026-94079Medium· 5.3Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
CVE-2026-94168Medium· 6.5Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.
CVE-2026-94124High· 8.5Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.
CVE-2026-94174High· 7.6Administrator SQL Injection in Email Log <= 2.63 versions.
Administrator SQL Injection in Email Log <= 2.63 versions.
CVE-2026-94176High· 7.1Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.
CVE-2026-94457Medium· 4.8Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.
Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.
CVE-2026-94179High· 7.1Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.