Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51667
Total
4097
Critical
15338
High
14987
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-65758 | UNKNOWN | — | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated … | Jul 23, 2026 |
| CVE-2026-65757 | UNKNOWN | — | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data … | Jul 23, 2026 |
| CVE-2026-65756 | MEDIUM | 6.1 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. | Jul 23, 2026 |
| CVE-2026-65755 | UNKNOWN | — | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded … | Jul 23, 2026 |
| CVE-2026-65754 | UNKNOWN | — | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory. | Jul 23, 2026 |
| CVE-2026-65713 | UNKNOWN | — | Joomla Extension - regularlabs.com - Insecure path handling in Modals Pro extension - Modals gallery paths could enumerate unintended directories. | Jul 23, 2026 |
| CVE-2026-65712 | UNKNOWN | — | Joomla Extension - regularlabs.com - Insecure path handling in CDN for Joomla Pro extension - CDN versioning could check file paths outside the site directory, … | Jul 23, 2026 |
| CVE-2026-65431 | UNKNOWN | — | Joomla Extension - regularlabs.com - Zipslip in GeoIP extension - Geo IP database update archives have been broadly extracted without path validation, leading to unsafe … | Jul 23, 2026 |
| CVE-2026-65430 | UNKNOWN | — | Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability. | Jul 23, 2026 |
| CVE-2026-64876 | UNKNOWN | — | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in GeoIP extension - Database-update requests lacked consistent token and Super User checks, … | Jul 23, 2026 |
| CVE-2026-64875 | UNKNOWN | — | Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass. | Jul 23, 2026 |
| CVE-2026-64874 | UNKNOWN | — | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs. | Jul 23, 2026 |
| CVE-2026-64873 | UNKNOWN | — | Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services. | Jul 23, 2026 |
| CVE-2026-64872 | UNKNOWN | — | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory. | Jul 23, 2026 |
| CVE-2026-64871 | UNKNOWN | — | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Cache Cleaner extension - Administrator URL purges did not consistently require a … | Jul 23, 2026 |
| CVE-2026-64799 | UNKNOWN | — | Joomla Extension - regularlabs.com - SSRF via remote image downloads in Articles Anywhere and Users Anywhere extensions - Content-controlled image URLs could request private or … | Jul 23, 2026 |
| CVE-2026-16078 | MEDIUM | 6.5 | The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, … | Jul 23, 2026 |
| CVE-2026-15906 | MEDIUM | 6.5 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up … | Jul 23, 2026 |
| CVE-2026-15827 | MEDIUM | 5.3 | The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST … | Jul 23, 2026 |
| CVE-2026-15794 | MEDIUM | 6.4 | The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, … | Jul 23, 2026 |
| CVE-2026-15786 | MEDIUM | 4.9 | The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to Directory … | Jul 23, 2026 |
| CVE-2026-15761 | MEDIUM | 6.5 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_event_filter' parameter in all versions up … | Jul 23, 2026 |
| CVE-2026-15647 | MEDIUM | 4.4 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'br_brand_tooltip' Term Meta Field in all versions up to, and including, … | Jul 23, 2026 |
| CVE-2026-15646 | MEDIUM | 6.4 | The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 … | Jul 23, 2026 |
| CVE-2026-15448 | MEDIUM | 6.5 | The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 'tc_order_status_filter' parameter in all versions up … | Jul 23, 2026 |