Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
CVE-2026-118084
Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.
2026-10-30 归档
今日共收录 1854 条安全情报，包含 1458 个 CVE，156 篇安全通告，以及 125 篇研究论文。
← 返回归档列表Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
CVE-2026-118083
Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
CVE-2026-118082
Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.
Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
CVE-2026-118079
Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
CVE-2026-118078
Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
CVE-2026-118077
Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
CVE-2026-118074
Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
CVE-2026-118073
Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
CVE-2026-116869
Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
CVE-2026-116866
Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions.
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
CVE-2026-116865
Editor PHP Object Injection in Zippy <= 1.7.0 versions.
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
CVE-2026-116864
Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-pl...
CVE-2026-116848
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovatio
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issu...
CVE-2026-109891
Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorr
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-96202
Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
CVE-2026-93903
LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case."
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized attacker to elevate privileges o...
CVE-2026-88094
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Libr
Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of K...
CVE-2026-88941
Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerabil
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows unauthenticated attackers to submit arbitrary values to Ch...
CVE-2026-67187
Ninja Forms plugin for WordPress before 3.15.4 contains an incomplete server-side validation vulnerability that allows u
OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and mod...
CVE-2026-49142
OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that all