CVE watch
Every disclosure pulled from the NVD feed, filterable by severity.
CVE-2026-105788 published: Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and pack...
Details →CVE-2026-82531 published: Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged...
Details →CVE-2026-105919 published: A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is the function mysql_query of the file admin/login.php of the component Administrator Login Endpoint. The manipulation...
Details →CVE-2026-105835 published: PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute force two-factor authentication codes. Attackers who know a user's password can reuse the ten-minute pending token t...
Details →CVE-2026-105918 published: A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the function mysql_error of the file login.php of the component Login Endpoint. The manipulation of the argument username/p...
Details →CVE-2026-105985 published: Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overr...
Details →CVE-2026-84854 published: In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Und...
Details →CVE-2026-104757 published: Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
Details →CVE-2026-104747 published: Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Details →CVE-2026-104672 published: Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Details →CVE-2026-104670 published: Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
Details →CVE-2026-104406 published: Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Details →CVE-2026-104405 published: Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Details →CVE-2026-104395 published: Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
Details →CVE-2026-104394 published: Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
Details →CVE-2026-104387 published: Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
Details →CVE-2026-104385 published: Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
Details →CVE-2026-103346 published: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
Details →CVE-2026-102915 published: Subscriber Broken Access Control in WPO365 <= 44.1 versions.
Details →CVE-2026-102387 published: Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
Details →