CVE Watch399,240 in full archive

Vulnerabilities exploitable today

14,859in current view

Single score combining CVSS, KEV membership and EPSS. Every CVE with its own record — timeline from publication to active exploitation.

In KEV catalog1,748

New KEV · 24H0

Exploit Today ≥ 701,665

Distribution · last window

Critical
3,347
High
15,203
Medium
14,178
Low
1,360

Filters

Window

Severity

Flags

Vulnerabilities13,761–13,800 · 14,859

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-945006.5 MED

6.1%

——2Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions.27d CVE-2026-944986.5 MED

14.4%

——4Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.27d CVE-2026-944878.1 HIG

2.4%

——1Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions.27d CVE-2026-944616.5 MED

6.1%

——2Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.27d CVE-2026-944574.8 MED

8.4%

——3Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions.27d CVE-2026-943916.5 MED

6.1%

——2Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.27d CVE-2026-941817.4 HIG

16.6%

——5An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification.26d CVE-2026-941797.1 HIG

8.3%

——2Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.27d CVE-2026-941767.1 HIG

8.3%

——2Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.27d CVE-2026-941747.6 HIG

20.4%

——6Administrator SQL Injection in Email Log <= 2.63 versions.27d CVE-2026-941686.5 MED

6.1%

——2Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.27d CVE-2026-941248.5 HIG

11.8%

——4Contributor SQL Injection in WP EasyCart <= 5.9.4 versions.27d CVE-2026-941186.5 MED

6.1%

——2Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.27d CVE-2026-940805.3 MED

12.2%

——4Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.27d CVE-2026-940795.3 MED

12.2%

——4Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.27d CVE-2026-937747.1 HIG

8.3%

——2Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.27d CVE-2026-937738.5 HIG

11.8%

——4Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.27d CVE-2026-937726.5 MED

12.3%

——4Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.27d CVE-2026-936235.3 MED

12.7%

——4Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions.27d CVE-2026-936227.1 HIG

7.1%

——2Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.27d CVE-2026-936206.5 MED

8.5%

——3Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.27d CVE-2026-936186.5 MED

4.8%

——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1.27d CVE-2026-935296.5 MED

10.9%

——3Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.27d CVE-2026-935278.5 HIG

10.7%

——3Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions.27d CVE-2026-935267.1 HIG

7.1%

——2Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.27d CVE-2026-935134.3 MED

7.6%

——2Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions.27d CVE-2026-93421—

33.2%

——10Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.27d CVE-2026-92730—

31.4%

——9LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.27d CVE-2026-92700—

33.9%

——10Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rules on case-insensitive filesystems or when mixed-case paths coexist and expose files intended to be hidden.27d CVE-2026-92692—

25.3%

——8Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.27d CVE-2026-92284—

31.3%

——9Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and process termination.27d CVE-2026-90905—

16.7%

——5Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The endpoint administrator/index.php?option=com_easystore&task=appconfig.updateConfiguration updated core Joomla mail configuration (fromname, mailfrom) in configuration.php without verifying anti-CSRF tokens or checking for administrative permissions (canAdmin). A malicious site could silently modify the site's sender name and email address via forged requests from an admin's browser. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') and adding explicit administrative authorization verification via AccessControl::create()->canAdmin().27d CVE-2026-90904—

22.8%

——7Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 - The allowEdit() method in ApiController.php hardcoded return true;, bypassing Joomla component-level and asset-level ACL permission checks. Any authenticated backend user could edit any EasyStore record, regardless of specific ACL permission grants. Resolved by replacing the hardcoded boolean with proper ACL authorization checks via AccessControl::create()->canEdit()`.27d CVE-2026-90903—

6.2%

——2Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0 - The administrator ApiController only validated CSRF tokens inside the products() action. All other administrative AJAX endpoints (orders, coupons, media, customers, settings, tags, categories, reviews, and collections) accepted state-changing requests without checking anti-CSRF tokens. An attacker could trick a logged-in administrator into triggering unauthorized state modifications across the store backend. Resolved by implementing global CSRF verification in ApiController::execute() for all state-changing HTTP methods (POST, PUT, PATCH, DELETE) via Session::checkToken().27d CVE-2026-90902—

19.3%

——6Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (array_map('intval', ...)) and adopting parameterized ->whereIn() query construction.25d CVE-2026-90901—

19.3%

——6Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.25d CVE-2026-90900—

5.3%

——2Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js.27d CVE-2026-90899—

24.5%

——7Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent.27d CVE-2026-845029.9 CRI

48.6%

——15A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values that begin with a dash and is stored and passed verbatim to the git SCM module. Because the module runs git ls-remote with the URL as a positional argument and without a "--" separator, a git project URL such as "--upload-pack=<command>:x" is interpreted by git as the --upload-pack option and executed via a shell. A user with permission to create or modify a project in a single organization can thereby execute arbitrary commands on the control-plane task pod, with output reflected through the project update stdout endpoint, leading to cross-tenant compromise and in-cluster lateral movement27d CVE-2026-844997.7 HIG

30.4%

——9A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and stored encrypted, displayed only as a placeholder on read. When a schedule or workflow job template node is revalidated against a tightened survey specification, the controller decrypts the stored password and includes its plaintext value in the minimum/maximum length validation error message returned in the HTTP response. A user with the delegated JobTemplate Admin role can tighten the survey length constraint and trigger revalidation of a schedule or node created by another, higher-privileged user, thereby recovering that user's stored password in plaintext.24d