Total
409156 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-67361 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - j2commerce.com - Unauthenticated file upload with missing directory protection in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - The file upload endpoint accepted POST requests from unauthenticated visitors with no CSRF token. Compounding this, the installer manifest omitted the upload and invoices directories, causing fresh installs to deploy those directories without .htaccess/web.config protection, making uploaded files directly web-accessible. | |||||
| CVE-2026-76565 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7 | |||||
| CVE-2026-74804 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - yootheme.com - Unauthenticated SQL injection in ItemController::element() in Zoo < 4.1.64 - The filter_type request value is interpolated into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting or escaping. | |||||
| CVE-2026-77993 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype parameter. | |||||
| CVE-2026-67363 | 2026-08-26 | N/A | N/A | ||
| Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomputing it from the form's configured product prices. Neither endpoint enforces authentication or CSRF checks. An unauthenticated attacker can purchase any priced item for an arbitrary amount (e.g., $0.01), and can additionally forge line items, quantities, and shipping. | |||||
| CVE-2026-58192 | 1 Appium | 1 Appium\/storage-plugin | 2026-08-26 | N/A | 8.6 HIGH |
| Appium is a cross-platform automation framework for all kinds of apps, built on top of the W3C WebDriver protocol. Prior to 1.1.6, the Appium storage plugin exposes POST /storage/delete, whose handler passes the user-supplied name value directly into path.join(storageRoot, name) and fs.rimraf() without path sanitization, allowing an unauthenticated remote client to escape the storage root with ../ sequences and recursively delete arbitrary writable files or directories. This issue is fixed in version 1.1.6. | |||||
| CVE-2026-49307 | 2026-08-26 | N/A | 6.2 MEDIUM | ||
| Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2026-49302 | 2026-08-26 | N/A | 6.2 MEDIUM | ||
| Permission control vulnerability in the notification service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2026-49306 | 2026-08-26 | N/A | 3.3 LOW | ||
| UAF vulnerability in the time and time zone module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2026-58561 | 2026-08-26 | N/A | 4.0 MEDIUM | ||
| Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2026-58560 | 2026-08-26 | N/A | 4.0 MEDIUM | ||
| Null pointer dereference issue in the image codec module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2026-49304 | 2026-08-26 | N/A | 6.2 MEDIUM | ||
| Permission control vulnerability in the device key management module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2026-49305 | 2026-08-26 | N/A | 6.2 MEDIUM | ||
| Permission control vulnerability in the Wi-Fi enhancement module. Impact: Successful exploitation of this vulnerability may affect availability. | |||||
| CVE-2026-49308 | 2026-08-26 | N/A | 5.5 MEDIUM | ||
| Permission control vulnerability in the clipboard module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2026-49301 | 2026-08-26 | N/A | 6.2 MEDIUM | ||
| Permission control vulnerability in the Gallery module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | |||||
| CVE-2026-15930 | 2026-08-26 | N/A | 9.4 CRITICAL | ||
| The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user ID to update an account, allowing unauthenticated attackers to overwrite the primary administrator's account data (including the email address) and take over that account through the password reset flow. | |||||
| CVE-2026-15206 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The SMS Alert WordPress plugin before 3.9.8 does not bind its "mobile verified" session flag to the phone number that was actually verified: after an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file. | |||||
| CVE-2026-16285 | 2026-08-26 | N/A | 7.5 HIGH | ||
| The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing unauthenticated users to download any attachment — including private or unlinked uploads — by enumerating its numeric ID. | |||||
| CVE-2026-14922 | 2026-08-26 | N/A | 6.1 MEDIUM | ||
| WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (double-encoding) flaw in the photo-comment pipeline. On write, `wppa_do_comment()` sanitizes the comment with `wppa_filter_html()` (wp_kses) followed by `wp_strip_all_tags()` (`wppa-functions.php:2623-2624`). Because `wp_strip_all_tags()` only removes *real* tags, an attacker who submits a **double HTML-entity-encoded** payload (e.g. `&lt;img src=... onload=...&gt;`) passes the write filters as harmless entity text and is stored one decode-level down (`<img ... onload=...>`). | |||||
| CVE-2026-14317 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled. | |||||