CVE Watch408.635 no arquivo completo

Vulnerabilidades exploráveis hoje

17,407na visualização atual

Score único que combina CVSS, presença no KEV e EPSS. Cada CVE com sua própria ficha — timeline da publicação até a exploração ativa.

No catálogo KEV1,768

Novos KEV · 24H0

Exploit Today ≥ 701,700

Distribuição · última janela

Crítica
5,784
Alta
22,600
Média
22,020
Baixa
2,186

Filtros

Janela

Severidade

Filtros

Vulnerabilidades601–640 · 17,407

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-933898.2 ALT

14.0%

——4The LiteSpeed Cache plugin for WordPress is vulnerable to unauthenticated disclosure of sensitive WooCommerce customer data in all versions up to, and including, 7.9.1 With Cache REST enabled (the shipped default cache-rest=1), LiteSpeed stores WooCommerce Store API GET responses (/wc/store/v1/cart and /wc/store/v1/checkout) as PUBLIC cache objects and does not vary the cache on the Cart-Token or WooCommerce session. A shopper's personalized cart/checkout response is therefore served to any later, cookie-less and token-less client as an LSCache HIT. This makes it possible for unauthenticated attackers to read another shopper's billing and shipping details (name, company, street address, email, phone), cart contents and totals, and the shopper's live Cart-Token session JWT and nonce (enabling cart/checkout-session hijack), plus order_key on the checkout endpoint.11h CVE-2026-123012—

25.7%

——8In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.1d CVE-2026-1230114.2 MÉD

7.3%

——2STMicroelectronics st-mems-android-linux-sensors-hal before 7bdf334 does not check whether the allowed number of channels is exceeded.1d CVE-2026-1230107.2 ALT

12.5%

——4@twilio-labs/netlify-okta-auth through 1.0.2 relies on an unverified iss claim. This affects an outbound HTTP request to retrieve a public signing key. There may be other impacts in a misconfiguration where oktaUrl isn't set.1d CVE-2026-1205536.4 MÉD

16.7%

——5The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slides_to_show' parameter in all versions up to, and including, 5.126.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.11h CVE-2026-1205336.4 MÉD

22.1%

——7The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types 'spinner', 'slider', 'color', and 'date' receive per-type value validation that would block the entity-encoded payload.11h CVE-2026-1181938.8 ALT

34.1%

——10The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.19.1 via the `donor_default_user_role` parameter. This is due to the `sanitize_option_donor_default_user_role()` function applying only a narrow literal check against the string `'administrator'` rather than enforcing the plugin's own `give_get_donor_safe_user_roles()` allowlist on save, and due to the `give_core_settings_import_callback()` AJAX handler writing imported JSON directly into the `give_settings` option via `update_option()` without invoking the sanitize filter at all. This makes it possible for authenticated attackers with the GiveWP Manager role (holding the `manage_give_settings` capability) and above to configure donor registration to assign privileged WordPress roles — up to and including Administrator via the import path — to every new donor account created through the platform. Via the settings save path, the Administrator role is blocked but any other elevated role (Editor, Author, etc.) is accepted; via the Tools › Import JSON path, the sanitize filter is bypassed entirely, allowing the Administrator role itself to be stored and subsequently applied to all newly registered donor accounts.11h CVE-2026-1166178.1 ALT

42.4%

——13The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to File Deletion in all versions up to, and including, 1.4.128 The vulnerability exists because `stm_save_user_extra_fields()`, hooked to `personal_options_update`, writes the attacker-controlled `stm_dealer_logo_path` parameter directly to user meta without an ownership check binding the submitted path to the submitting user — unlike the `stm_payment_status` and `stm_lost_password_hash` fields, this field is not gated by a `manage_options` or `edit_users` capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete image files belonging to other users under `wp-content/uploads` — including other users' avatars, dealer logos, and uploaded media — by storing a crafted path via their own profile and then triggering `unlink()` through the become-dealer form on their author page. Note that the two path guards (`stm_mvl_is_path_within_uploads` and `stm_mvl_is_allowed_image_file`) do restrict the attack surface to files with an image extension that resolve within the uploads basedir; files outside that directory, such as `wp-config.php` or plugin PHP files, cannot be reached.11h CVE-2026-1048126.4 MÉD

15.4%

——5The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'multi_media' Field Array Key in all versions due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post sanitization applied at save time operates only on array leaf values, leaving array keys entirely unsanitized; the injected key is then rendered directly into an id="filelist-<KEY>" HTML attribute without esc_attr() in Redux_Multi_Media::render(), allowing attribute breakout.11h CVE-2026-1222366.3 MÉD

30.1%

——9A vulnerability has been found in OpenHands up to 1.24.0. This impacts an unknown function of the component Landing Page. Such manipulation leads to missing authentication. The attack must be carried out from within the local network. The exploit has been disclosed to the public and may be used. Upgrading to version 1.25.0 will fix this issue. The name of the patch is c5efa3ae415def0a903c82d2b17b748e663b1995. Upgrading the affected component is recommended.11h CVE-2026-1221916.3 MÉD

10.0%

——3A vulnerability was determined in itsourcecode Airline Reservation System 1.0. This affects an unknown function of the file /admin/manage_booked.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.11h CVE-2026-1221902.4 BAI

11.3%

——3A vulnerability was found in SourceCodester Online Food Ordering System 1.0. The impacted element is an unknown function of the file admin/add_category.php of the component Category Management. Performing a manipulation of the argument category_title results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.11h CVE-2026-69068—

3.4%

——1Insufficient length validation in the GNSS firmware loader may lead to corruption of kernel memory.1d CVE-2026-69066—

3.4%

——1Memory corruption in GPU driver due to improper validation of VMID reservation.1d CVE-2026-69050—

3.4%

——1Out-of-bounds memory access in a device driver due to improper resource state tracking.1d CVE-2026-69044—

3.4%

——1In the Samsung GPU driver, improper reference count handling during command submission can lead to memory corruption.1d CVE-2026-69043—

3.4%

——1In the Samsung Exynos GPU driver, improper synchronization during buffer object creation and closing can lead to memory corruption1d CVE-2026-69025—

3.4%

——1In the Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service1d CVE-2026-69006—

3.4%

——1Insufficient validation of length fields in the GNSS firmware loader can result in kernel‑memory corruption.1d CVE-2026-69005—

3.4%

——1Integer overflow in NPU driver parameter processing due to insufficient bounds checking.1d CVE-2026-69002—

2.8%

——1Incorrect authorization in Samsung framework services due to missing permission checks1d CVE-2026-68994—

3.4%

——1A double free vulnerability in NPU driver due to improper pointer management (941)1d CVE-2026-68993—

3.4%

——1A double free vulnerability in NPU driver due to improper pointer management (940)1d CVE-2026-68991—

3.4%

——1In the Samsung Exynos ENN NeuralNetworks HAL, improper input validation during request processing can cause memory corruption and lead to a denial of service condition.1d CVE-2026-68990—

3.4%

——1In the Samsung Exynos H-Arx DRM plugin, improper input validation during buffer operations can cause memory corruption, potentially leading to denial of service or privilege escalation.1d CVE-2026-68985—

3.4%

——1In the Samsung Exynos NPU driver, improper validation of user input in the ioctl handler can lead to an out-of-bounds write, which causes a denial of service.1d CVE-2026-68984—

3.4%

——1In the Samsung Exynos NPU kernel driver, an integer overflow allows an unprivileged application to trigger memory corruption.1d CVE-2026-48186—

3.4%

——1Improper handling of messages before AS security activation can cause unexpected behavior1d CVE-2026-48183—

2.8%

——1Improper permission handling during buffer operations allows untrusted applications to create memory mappings with inappropriate permissions1d CVE-2026-48179—

3.4%

——1In the Exynos modem's IMS stack, improper handling of SDP payload leads to a Denial of Service1d CVE-2026-48178—

1.4%

——0Out of bound access in PPC due to race condition in global variable access1d CVE-2026-48176—

3.4%

——1A memory corruption vulnerability caused by improper validation of messages1d CVE-2026-481755.5 MÉD

3.4%

——1Processing a malformed RRC message leads to an out-of-bounds read, resulting in a denial-of-service condition.17h CVE-2026-48174—

6.4%

——2In the NR RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.1d CVE-2026-48173—

3.4%

——1In the NAS message handler, improper validation of the length field in NAS message causes memory corruption1d CVE-2026-35495—

4.2%

——1In IMS stack, improper handling of SIP packets leads to Incorrect_Access_Control vulnerability1d CVE-2026-35494—

3.4%

——1In the baseband, memory corruption during NAS packet processing can cause a denial of service.1d CVE-2026-33972—

4.2%

——1In the Exynos modem's IMS stack, Out of Bound access occurs due to improper validation.1d CVE-2026-33971—

7.6%

——2In the LTE RRC component, improper handling of messages before authentication triggers a data abort, which leads to a denial‑of‑service condition.1d CVE-2026-33969—

7.0%

——2In the NAS Authentication Request message decoding procedure, a missing lower bound check causes an infinite loop, leading to Denial of Service.1d