VYPR

CVEs

31,171 total · page 39 of 624

AllCriticalHighKEV
  • CVE-2026-33494CriMar 26, 2026
    Ory
    Oathkeeper
    risk 0.58cvss 10.0epss 0.01

    ORY Oathkeeper is an Identity & Access Proxy (IAP) and Access Control Decision API that authorizes HTTP requests based on sets of Access Rules. Versions prior to 26.2.0 are vulnerable to an authorization bypass via HTTP path traversal. An attacker can craft a URL containing path…

  • CVE-2026-27816CriMar 26, 2026
    Linux Foundation
    Everest
    risk 0.52cvss 9.1epss 0.00

    EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_update_energy_transfer_modes copies a variable-length list into a fixed-size array of length 6 without bounds checking. With schema validation disabled by default, oversized…

  • CVE-2026-27815CriMar 26, 2026
    Linux Foundation
    Everest
    risk 0.52cvss 9.1epss 0.00

    EVerest is an EV charging software stack. Prior to versions to 2026.02.0, ISO15118_chargerImpl::handle_session_setup copies a variable-length payment_options list into a fixed-size array of length 2 without bounds checking. With schema validation disabled by default, oversized…

  • CVE-2026-4809CriMar 26, 2026
    Plank
    Laravel Mediable
    risk 0.64cvss 9.8epss 0.01

    plank/laravel-mediable through version 6.4.0 can allow upload of a dangerous file type when an application using the package accepts or prefers a client-supplied MIME type during file upload handling. In that configuration, a remote attacker can submit a file containing…

  • CVE-2014-125112CriMar 26, 2026
    Miyagawa
    Plack::Middleware::Session::Cookie
    risk 0.64cvss 9.8epss 0.01

    Plack::Middleware::Session::Cookie versions through 0.21 for Perl allows remote code execution. Plack::Middleware::Session::Cookie versions through 0.21 has a security vulnerability where it allows an attacker to execute arbitrary code on the server during deserialization of…

  • CVE-2025-70888CriMar 25, 2026
    Osslsigncode Project
    Osslsigncode
    risk 0.57cvss 9.8epss 0.00

    An issue in mtrojnar Osslsigncode affected at v2.10 and before allows a remote attacker to escalate privileges via the osslsigncode.c component

  • CVE-2026-32573CriMar 25, 2026
    WordPress
    Nelio Ab Testing
    risk 0.59cvss 9.1epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Code Injection.This issue affects Nelio AB Testing: from n/a through <= 8.2.7.

  • CVE-2026-32539CriMar 25, 2026
    Publishpress
    Publishpress Future
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Revisions revisionary allows Blind SQL Injection.This issue affects PublishPress Revisions: from n/a through <= 3.7.23.

  • CVE-2026-32536CriMar 25, 2026
    halfdata
    Green Downloads
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in halfdata Green Downloads halfdata-paypal-green-downloads allows Using Malicious Files.This issue affects Green Downloads: from n/a through <= 2.08.

  • CVE-2026-32525CriMar 25, 2026
    jetmonsters
    JetFormBuilder
    risk 0.64cvss 9.9epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through <= 3.5.6.1.

  • CVE-2026-32524CriMar 25, 2026
    Meowapps
    Photo Engine
    risk 0.59cvss 9.1epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow Photo Engine wplr-sync allows Upload a Web Shell to a Web Server.This issue affects Photo Engine: from n/a through <= 6.4.9.

  • CVE-2026-32523CriMar 25, 2026
    Denishua
    WPJAM Basic
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in denishua WPJAM Basic wpjam-basic allows Using Malicious Files.This issue affects WPJAM Basic: from n/a through <= 6.9.2.

  • CVE-2026-32520CriMar 25, 2026
    Affiliatewp
    Affiliatewp
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Andrew Munro / AffiliateWP RewardsWP rewardswp allows Privilege Escalation.This issue affects RewardsWP: from n/a through <= 1.0.4.

  • CVE-2026-32519CriMar 25, 2026
    Bit Apps
    Bit SMTP
    risk 0.59cvss 9.0epss 0.00

    Incorrect Privilege Assignment vulnerability in Bit Apps Bit SMTP bit-smtp allows Privilege Escalation.This issue affects Bit SMTP: from n/a through <= 1.2.2.

  • CVE-2026-32512CriMar 25, 2026
    Edge-Themes
    Pelicula
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

  • CVE-2026-32502CriMar 25, 2026
    Select Themes
    Borgholm
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.

  • CVE-2026-32499CriMar 25, 2026
    WordPress
    Chatbot
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in QuantumCloud ChatBot chatbot allows Blind SQL Injection.This issue affects ChatBot: from n/a through <= 7.7.9.

  • CVE-2026-32482CriMar 25, 2026
    Deothemes
    Ona
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in deothemes Ona ona allows Upload a Web Shell to a Web Server.This issue affects Ona: from n/a through < 1.24.

  • CVE-2026-31920CriMar 25, 2026
    Devteam HaywoodTech
    Product Rearrange for WooCommerce
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Blind SQL Injection.This issue affects Product Rearrange for WooCommerce: from n/a…

  • CVE-2026-2414CriMar 25, 2026
    Hypr
    Hypr
    risk 0.64cvss 9.8epss 0.00

    Authorization bypass through User-Controlled key vulnerability in HYPR Server allows Privilege Escalation.This issue affects Server: from 9.5.2 before 10.7.2.

  • CVE-2026-27095CriMar 25, 2026
    Mage People
    Bus Ticket Booking With Seat Reservation
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Ticket Booking with Seat Reservation: from n/a through <= 5.6.0.

  • CVE-2026-27084CriMar 25, 2026
    Themerex
    Buisson
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11.

  • CVE-2026-27083CriMar 25, 2026
    Themerex
    Work & Travel Company
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2.

  • CVE-2026-27082CriMar 25, 2026
    Themerex
    Love Story
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.

  • CVE-2026-27071CriMar 25, 2026
    Themewinter
    Wpcafe
    risk 0.59cvss 9.1epss 0.00

    Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.

  • CVE-2026-27051CriMar 25, 2026
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0.

  • CVE-2026-27049CriMar 25, 2026
    risk 0.64cvss 9.8epss 0.01

    Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2.

  • CVE-2026-27044CriMar 25, 2026
    TotalSuite
    Total Poll Lite
    risk 0.64cvss 9.9epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Remote Code Inclusion.This issue affects Total Poll Lite: from n/a through <= 4.12.0.

  • CVE-2026-25447CriMar 25, 2026
    risk 0.59cvss 9.1epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Jonathan Daggerhart Widget Wrangler widget-wrangler allows Code Injection.This issue affects Widget Wrangler: from n/a through <= 2.3.9.

  • CVE-2026-25429CriMar 25, 2026
    WordPress
    Nexa Blocks
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in wpdive Nexa Blocks nexa-blocks allows Object Injection.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

  • CVE-2026-25413CriMar 25, 2026
    Iqonicdesign
    Wpbookit
    risk 0.64cvss 9.9epss 0.00

    Unrestricted Upload of File with Dangerous Type vulnerability in iqonicdesign WPBookit Pro wpbookit-pro allows Using Malicious Files.This issue affects WPBookit Pro: from n/a through <= 1.6.18.

  • CVE-2026-25377CriMar 25, 2026
    Eyecix
    Addon Jobsearch Chat
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in eyecix Addon Jobsearch Chat addon-jobsearch-chat allows SQL Injection.This issue affects Addon Jobsearch Chat: from n/a through <= 3.0.

  • CVE-2026-25371CriMar 25, 2026
    King Theme
    Lumise Product Designer
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in King-Theme Lumise Product Designer lumise allows Blind SQL Injection.This issue affects Lumise Product Designer: from n/a through < 2.0.9.

  • CVE-2026-25366CriMar 25, 2026
    Themeisle
    Woody ad snippets
    risk 0.64cvss 9.9epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Themeisle Woody ad snippets insert-php allows Code Injection.This issue affects Woody ad snippets: from n/a through <= 2.7.1.

  • CVE-2026-25345CriMar 25, 2026
    Ventrian
    Simple Gallery
    risk 0.64cvss 9.9epss 0.00

    Improper Validation of Specified Quantity in Input vulnerability in GalleryCreator SimpLy Gallery simply-gallery-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SimpLy Gallery: from n/a through <= 3.3.2.

  • CVE-2026-25340CriMar 25, 2026
    NooTheme
    Jobmonster
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in NooTheme Jobmonster noo-jobmonster allows Blind SQL Injection.This issue affects Jobmonster: from n/a through < 4.8.4.

  • CVE-2026-25035CriMar 25, 2026
    Contest Gallery
    Contest Gallery
    risk 0.64cvss 9.8epss 0.00

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Wasiliy Strecker / ContestGallery developer Contest Gallery contest-gallery allows Authentication Abuse.This issue affects Contest Gallery: from n/a through <= 28.1.2.2.

  • CVE-2026-25032CriMar 25, 2026
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas Ricky ricky allows Object Injection.This issue affects Ricky: from n/a through < 2.31.

  • CVE-2026-25031CriMar 25, 2026
    park_of_ideas
    Tasty Daily
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas Tasty Daily tastydaily allows Object Injection.This issue affects Tasty Daily: from n/a through < 1.27.

  • CVE-2026-25030CriMar 25, 2026
    park_of_ideas
    Goldish
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas Goldish goldish allows Object Injection.This issue affects Goldish: from n/a through < 3.47.

  • CVE-2026-25029CriMar 25, 2026
    park_of_ideas
    KIDZ
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in park_of_ideas KIDZ kidz allows Object Injection.This issue affects KIDZ: from n/a through <= 5.24.

  • CVE-2026-24993CriMar 25, 2026
    Wpfactory
    Advanced WooCommerce Product Sales Reporting
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFactory Advanced WooCommerce Product Sales Reporting webd-woocommerce-advanced-reporting-statistics allows Blind SQL Injection.This issue affects Advanced WooCommerce Product…

  • CVE-2026-24989CriMar 25, 2026
    Fantasticplugins
    SUMO Affiliates Pro
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in FantasticPlugins SUMO Affiliates Pro affs allows Object Injection.This issue affects SUMO Affiliates Pro: from n/a through < 11.4.0.

  • CVE-2026-24971CriMar 25, 2026
    Elated-Themes
    Search & Go
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Elated-Themes Search & Go searchgo allows Privilege Escalation.This issue affects Search & Go: from n/a through <= 2.8.

  • CVE-2026-24968CriMar 25, 2026
    Xagio SEO
    xagio-seo
    risk 0.64cvss 9.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.

  • CVE-2026-24378CriMar 25, 2026
    Metagauss
    Eventprime
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Object Injection.This issue affects EventPrime: from n/a through <= 4.2.8.0.

  • CVE-2026-22507CriMar 25, 2026
    Ancorathemes
    Beelove
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in AncoraThemes Beelove beelove allows Object Injection.This issue affects Beelove: from n/a through <= 1.2.6.

  • CVE-2026-22500CriMar 25, 2026
    Axiomthemes
    m2 | Construction and Tools Store
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.

  • CVE-2026-22484CriMar 25, 2026
    pebas
    Lisfinity Core
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pebas Lisfinity Core lisfinity-core allows SQL Injection.This issue affects Lisfinity Core: from n/a through <= 1.5.0.

  • CVE-2026-26832CriMar 25, 2026
    node-tesseract-ocr
    node-tesseract-ocr
    risk 0.64cvss 9.8epss 0.02

    node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed…