| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-57234 | Low | 0.10 | 2.6 | 0.00 | Jun 25, 2026 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a… | ||
| CVE-2026-49319 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock… | ||
| CVE-2026-46735 | Hig | 0.51 | 7.8 | 0.01 | Jun 25, 2026 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability,… | ||
| CVE-2026-13314 | Low | 0.00 | — | 0.00 | Jun 25, 2026 | Malicious HTML content could be injected into the content rendered by the pretix-digital plugin. | ||
| CVE-2026-13225 | Med | 0.27 | — | 0.00 | Jun 25, 2026 | Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order. | ||
| CVE-2026-13223 | Med | 0.34 | — | 0.00 | Jun 25, 2026 | Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid … | ||
| CVE-2026-13222 | Med | 0.34 | — | 0.00 | Jun 25, 2026 | Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid … | ||
| CVE-2026-57619 | Med | 0.35 | 6.5 | 0.00 | Jun 25, 2026 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. | ||
| CVE-2026-57429 | Med | 0.35 | 6.5 | 0.00 | Jun 25, 2026 | Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. | ||
| CVE-2026-56122 | Hig | 0.00 | 7.5 | 0.01 | Jun 25, 2026 | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot.… | ||
| CVE-2026-56071 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions. | ||
| CVE-2026-56054 | Hig | 0.00 | 7.7 | 0.00 | Jun 25, 2026 | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. | ||
| CVE-2026-56053 | Hig | 0.00 | 8.8 | 0.01 | Jun 25, 2026 | Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions. | ||
| CVE-2026-56051 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions. | ||
| CVE-2026-56050 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18. | ||
| CVE-2026-56049 | Hig | 0.00 | 8.5 | 0.01 | Jun 25, 2026 | Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions. | ||
| CVE-2026-56042 | Hig | 0.39 | 7.1 | 0.00 | Jun 25, 2026 | Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions. | ||
| CVE-2026-56023 | Med | 0.00 | 5.4 | 0.00 | Jun 25, 2026 | Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions. | ||
| CVE-2026-56014 | Hig | 0.46 | 7.1 | 0.00 | Jun 25, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5. | ||
| CVE-2026-56013 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions. | ||
| CVE-2026-56006 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions. | ||
| CVE-2026-56005 | Hig | 0.46 | 7.1 | 0.00 | Jun 25, 2026 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1. | ||
| CVE-2026-54849 | Cri | 0.00 | 9.3 | 0.00 | Jun 25, 2026 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. | ||
| CVE-2026-54848 | Hig | 0.00 | 8.3 | 0.00 | Jun 25, 2026 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3. | ||
| CVE-2026-54845 | Hig | 0.00 | 8.1 | 0.00 | Jun 25, 2026 | Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions. | ||
| CVE-2026-54844 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions. | ||
| CVE-2026-54843 | Cri | 0.00 | 9.3 | 0.00 | Jun 25, 2026 | Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | ||
| CVE-2026-54842 | Hig | 0.00 | 8.1 | 0.00 | Jun 25, 2026 | Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25. | ||
| CVE-2026-54841 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions. | ||
| CVE-2026-54838 | Hig | 0.00 | 8.5 | 0.00 | Jun 25, 2026 | Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions. | ||
| CVE-2026-54836 | Cri | 0.00 | 9.3 | 0.01 | Jun 25, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5. | ||
| CVE-2026-54830 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions. | ||
| CVE-2026-54829 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005. | ||
| CVE-2026-54828 | Hig | 0.00 | 7.5 | 0.00 | Jun 25, 2026 | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | ||
| CVE-2026-54823 | Cri | 0.00 | 9.9 | 0.01 | Jun 25, 2026 | Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions. | ||
| CVE-2026-54822 | Hig | 0.00 | 8.5 | 0.00 | Jun 25, 2026 | Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions. | ||
| CVE-2026-54821 | Hig | 0.00 | 7.4 | 0.00 | Jun 25, 2026 | Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions. | ||
| CVE-2026-52690 | — | Med | 0.31 | 5.9 | 0.00 | Jun 25, 2026 | Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail. | |
| CVE-2026-4526 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was… | ||
| CVE-2026-49506 | Hig | 0.00 | 7.2 | 0.01 | Jun 25, 2026 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code… | ||
| CVE-2026-47154 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the… | ||
| CVE-2026-47153 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | ||
| CVE-2026-47152 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | ||
| CVE-2026-47151 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices… | ||
| CVE-2026-47150 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only… | ||
| CVE-2026-47149 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was… | ||
| CVE-2026-47148 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the… | ||
| CVE-2026-47147 | Hig | 0.00 | 7.1 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has… | ||
| CVE-2026-47146 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. | ||
| CVE-2026-47145 | Med | 0.00 | 6.5 | 0.00 | Jun 25, 2026 | In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. |
- risk 0.10cvss 2.6epss 0.00
Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementation. As a result, a…
- risk 0.00cvss 6.5epss 0.00
Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutive lock or unlock…
- risk 0.51cvss 7.8epss 0.01
Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability,…
- risk 0.00cvss —epss 0.00
Malicious HTML content could be injected into the content rendered by the pretix-digital plugin.
- risk 0.27cvss —epss 0.00
Malicious HTML content could be injected into the email address of an order, which pretix showed without sanitization on the confirmation page for individual tickets in that order.
- risk 0.34cvss —epss 0.00
Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid …
- risk 0.34cvss —epss 0.00
Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid …
- risk 0.35cvss 6.5epss 0.00
Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.
- risk 0.35cvss 6.5epss 0.00
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
- risk 0.00cvss 7.5epss 0.01
Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot.…
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions.
- risk 0.00cvss 7.7epss 0.00
Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions.
- risk 0.00cvss 8.8epss 0.01
Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in TablePress <= 3.3.1 versions.
- risk 0.00cvss 6.5epss 0.00
Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18.
- risk 0.00cvss 8.5epss 0.01
Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions.
- risk 0.39cvss 7.1epss 0.00
Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions.
- risk 0.00cvss 5.4epss 0.00
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions.
- risk 0.00cvss 7.1epss 0.00
Unauthenticated Cross Site Scripting (XSS) in H5P <= 1.17.6 versions.
- risk 0.46cvss 7.1epss 0.00
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.3.1.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions.
- risk 0.00cvss 8.3epss 0.00
Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3.
- risk 0.00cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in MDTF <= 1.3.8 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.
- risk 0.00cvss 9.3epss 0.00
Unauthenticated SQL Injection in MDTF <= 1.3.7 versions.
- risk 0.00cvss 8.1epss 0.00
Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Sensitive Data Exposure in Vitepos <= 3.4.2 versions.
- risk 0.00cvss 8.5epss 0.00
Subscriber SQL Injection in WC Vendors Marketplace <= 2.6.8 versions.
- risk 0.00cvss 9.3epss 0.01
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YMC Filter allows SQL Injection. This issue affects YMC Filter: from n/a through 3.11.5.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
- risk 0.00cvss 7.5epss 0.00
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jacob N. Breetvelt WP Photo Album Plus allows Blind SQL Injection. This issue affects WP Photo Album Plus: from n/a through 9.1.13.005.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.
- risk 0.00cvss 9.9epss 0.01
Contributor Remote Code Execution (RCE) in Widget Options <= 4.2.3 versions.
- risk 0.00cvss 8.5epss 0.00
Subscriber SQL Injection in SALESmanago & Leadoo <= 3.11.2 versions.
- risk 0.00cvss 7.4epss 0.00
Subscriber Sensitive Data Exposure in Visual Link Preview <= 2.3.1 versions.
- risk 0.31cvss 5.9epss 0.00
Spoofing replies to Recursor might mark an IP of an authoritative server as not supporting EDNS, causing valdiation of DNSSEC records served by that server to fail.
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was…
- risk 0.00cvss 7.2epss 0.01
Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote Code…
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the…
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted.
- risk 0.00cvss 7.1epss 0.00
In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices…
- risk 0.00cvss 7.1epss 0.00
In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only…
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was…
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the…
- risk 0.00cvss 7.1epss 0.00
In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has…
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.
- risk 0.00cvss 6.5epss 0.00
In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted.