Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions....
Fresh 2026 Zero-Days & Newly Disclosed CVEs
Continuous surveillance of newly registered CVE advisories with CVSS threat scores, attack vector metrics, and impacted software libraries.
Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions....
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions....
Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions....
Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions....
Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions....
An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscr...
Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions....
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions....
Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions....
Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions....
Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions....
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions....
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a...
A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependency, and workflow schedulers are configured to allow any user ...
Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best...
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.3.0, an authenticated actor can write the pypi_url setting t...
JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean...