CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-5249

A vulnerability was found in gougucms 4.08.18. This impacts an unknown function of the file \gougucms-master\app\admin\view\user\record.html of the component Record Endpoint. Performing a manipulation of the argument value.content results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED

Vendor: n/a
Product: gougucms
Provider severity: LOW, MEDIUM
Conflicts: 2

CVE-2026-5248

A vulnerability has been found in gougucms 4.08.18. This affects the function reg_submit of the file gougucms-master\app\home\controller\Login.php of the component User Registration Handler. Such manipulation of the argument level leads to dynamically-determined object attributes. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED

Vendor: n/a
Product: gougucms
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-52476

SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52475

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-52474

An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52472

SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-52470

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the RecordStateMapper.xml file

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-5247

The Schedule Post Changes With PublishPress Future plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wrapper' attribute of the [futureaction] shortcode in all versions up to, and including, 4.10.0. This is due to insufficient input sanitization on the wrapper attribute. The plugin uses esc_html() to escape the value, but esc_html() only encodes HTML entities and does not prevent attribute injection when the value is used as an HTML tag name in a sprintf() call. An attack

PUBLISHED

Vendor: publishpress
Product: Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-52469

SQL injection vulnerability in Crocus v.1.3.44 allows a remote attacker to escalate privileges via the DeviceInfoMapper.xml file

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-5246

A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is ca

PUBLISHED

Vendor: Cesanta
Product: Mongoose
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-5245

A vulnerability was found in Cesanta Mongoose up to 7.20. This impacts the function handle_mdns_record of the file mongoose.c of the component mDNS Record Handler. Performing a manipulation of the argument buf results in stack-based buffer overflow. Remote exploitation of the attack is possible. A high degree of complexity is needed for the attack. The exploitability is said to be difficult. The exploit has been made public and could be used. Upgrading to version 7.21 will fix this issue. The pa

PUBLISHED

Vendor: Cesanta
Product: Mongoose
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-5244

A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the component TLS 1.3 Handler. Such manipulation of the argument pubkey leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 7.21 mitigates this issue. The name of the patch is 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. It is advisable to upgrade the affected compo

PUBLISHED

Vendor: Cesanta
Product: Mongoose
Provider severity: HIGH, MEDIUM
Conflicts: 2

CVE-2026-52439

An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-5243

The The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to stored cross-site scripting via the `menu_hover_click` parameter of the Navigation Menu Lite widget in all versions up to, and including, 6.4.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute

PUBLISHED

Vendor: posimyththemes
Product: The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5242

Improper neutralization of formula elements in a CSV file vulnerability in MIA Technology Inc. Pizzy Library allows Code Injection. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

PUBLISHED

Vendor: MIA Technology Inc.
Product: Pizzy Library
Provider severity: HIGH
Conflicts: 0

CVE-2026-5241

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization. The issue arises because the `trust_remote_code` parameter, intended to prevent remote code execution, is overridden by untrusted serialized configuration data in a nested code path. Specifically, when loading a LightGlue model using `AutoModel.from_pretrained()` with `trust_remote_code=False`, the `Lig

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, huggingface, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift AI 3.3, OpenShift Lightspeed, Red Hat OpenShift AI 2.25, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), huggingface/transformers, Red Hat AI Inference Server, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat AI Inference Server, OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.4, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI 2.25, Red Hat AI Inference Server, Red Hat AI Inference Server, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Enterprise Linux AI (RHEL AI) 3, OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.4, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI 3.3, Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI 2.25, Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.4, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI 3.4, Red Hat OpenShift AI (RHOAI), Red Hat AI Inference Server, Red Hat OpenShift AI 3.4, Red Hat AI Inference Server, Red Hat OpenShift AI 3.3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Ansible Automation Platform 2, Red Hat AI Inference Server, Red Hat Ansible Automation Platform 2
Provider severity: HIGH
Conflicts: 3

CVE-2026-5240

A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /admin_state.php. The manipulation of the argument statename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.

PUBLISHED

Vendor: code-projects
Product: BloodBank Managing System
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-5238

A weakness has been identified in itsourcecode Payroll Management System 1.0. Affected by this issue is some unknown functionality of the file /view_employee.php of the component Parameter Handler. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

PUBLISHED

Vendor: itsourcecode
Product: Payroll Management System
Provider severity: HIGH, MEDIUM
Conflicts: 2

CVE-2026-52371

A Server-Side Request Forgery (SSRF) in the xxl-job-admin/jobinfo/trigger component of xxl-job v3.4.0 allows authenticated attackers to scan resources via supplying a crafted HTTP request.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-5237

A security flaw has been discovered in itsourcecode Payroll Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /manage_user.php of the component Parameter Handler. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

PUBLISHED

Vendor: itsourcecode
Product: Payroll Management System
Provider severity: HIGH, MEDIUM
Conflicts: 2

CVE-2026-5236

A vulnerability was identified in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_BitReader::SkipBits of the file Ap4Dac4Atom.cpp of the component DSI v1 Parser. Such manipulation of the argument n_presentations leads to heap-based buffer overflow. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

PUBLISHED

Vendor: Axiomatic
Product: Bento4
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-5235

A vulnerability was determined in Axiomatic Bento4 up to 1.6.0-641. This impacts the function AP4_BitReader::ReadCache of the file Ap4Dac4Atom.cpp of the component MP4 File Parser. This manipulation causes heap-based buffer overflow. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

PUBLISHED

Vendor: Axiomatic
Product: Bento4
Provider severity: MEDIUM
Conflicts: 2

CVE-2026-52349

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file management, VehicleSpawner save/folder/rename functionality, WeaponOptions save/folder/rename functionality, PedComponentChanger create folder/createfile/rename functionality.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52348

cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-5234

The LatePoint plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.3.2. The vulnerability exists because the OsStripeConnectController::create_payment_intent_for_transaction action is registered as a public action (no authentication required) and loads invoices by sequential integer invoice_id without any access_key or ownership verification. This is in contrast to other invoice-related actions (view_by_key, payment_form, summary_before_p

PUBLISHED

Vendor: latepoint
Product: LatePoint – Calendar Booking Plugin for Appointments and Events
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5233

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

PUBLISHED

Vendor: MIA Technology Inc.
Product: Pizzy Library
Provider severity: HIGH
Conflicts: 0

CVE-2026-5231

The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_source' parameter in all versions up to, and including, 14.16.4. This is due to insufficient input sanitization and output escaping. The plugin's referral parser copies the raw utm_source value into the source_name field when a wildcard channel domain matches, and the chart renderer later inserts this value into legend markup via innerHTML without escaping. This makes it possible for unauthenticated

PUBLISHED

Vendor: veronalabs
Product: WP Statistics – Simple, privacy-friendly Google Analytics alternative
Provider severity: HIGH
Conflicts: 0

CVE-2026-5230

Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.26250.

PUBLISHED

Vendor: MIA Technology Inc.
Product: Pizzy Library
Provider severity: HIGH
Conflicts: 1

CVE-2026-5229

The Form Notify plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.1.10. This is due to the plugin trusting user-controlled cookie data to determine which WordPress account to authenticate after a LINE OAuth login. When LINE doesn't provide an email address (which is common), the plugin falls back to reading the 'form_notify_line_email' cookie value without verifying that the LINE account is associated with that email address. This makes it possible for

PUBLISHED

Vendor: m615926
Product: Receive Notifications After Form Submitting – Form Notify for Any Forms
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-5228

Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WriteUp Mobile App: from 1.3.0 through 04062026.

PUBLISHED

Vendor: Kurt Software Studio
Product: WriteUp Mobile App
Provider severity: HIGH
Conflicts: 1

CVE-2026-5226

The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which are inserted into JavaScript code via str_replace() without proper JavaScript context escaping in the replace_content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pag

PUBLISHED

Vendor: optimole
Product: Optimole – Optimize Images in Real Time
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-52232

A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-5223

Cargo incorrectly handled symlinks inside of crate tarballs downloaded from third-party registries, allowing a malicious crate to override the source code of another crate from the same registry. The severity of the vulnerability is **medium** for users of third-party registries. Users of crates.io are **not affected**, as crates.io forbids uploading crates containing any symlink.

PUBLISHED

Vendor: Rust Project
Product: Cargo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-5222

Cargo between 1.68 and 1.96 incorrectly normalized the URLs of third-party registries using the sparse index protocol. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a registry could obtain the credentials of others users of the same registry. The severity of the vulnerability is **low**, due to the extremely niche requirements needed to achieve the attack.

PUBLISHED

Vendor: Rust
Product: Cargo
Provider severity: LOW
Conflicts: 0

CVE-2026-52203

An issue in MCMS v.6.1.1 allows a remote attacker to obtain sensitive information via the source parameter.

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52200

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-5220

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in DivvyDrive Information Technologies Inc. DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from 4.8.2.23 before v.4.8.3.1.

PUBLISHED

Vendor: DivvyDrive Information Technologies Inc.
Product: DivvyDrive
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-52199

An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-52198

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_425994 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52197

An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52196

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_416f28 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52195

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_472f08 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52193

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_447CAC component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52192

An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_445C5C component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52191

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_444C8C component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52190

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_448384 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-5219

Cross-Site request forgery (CSRF) vulnerability in Softtr Information Technology Trade Ltd. Co. E-Commerce Pack allows Cross Site Request Forgery. This issue affects E-Commerce Pack: before 5.03.01.49.

PUBLISHED

Vendor: Softtr Information Technology Trade Ltd. Co.
Product: E-Commerce Pack
Provider severity: HIGH
Conflicts: 0

CVE-2026-52189

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_487330 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1

CVE-2026-52188

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead//sub_497498 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-52187

Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_483ba0 component

PUBLISHED

Vendor: n/a
Product: n/a
Provider severity: HIGH
Conflicts: 1