CVE watch
Every disclosure pulled from the NVD feed, filterable by severity.
CVE-2026-75819 published: GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset fields from the file header as byte indices into a heap buffer without validating their bounds. An...
Details →CVE-2026-105985 published: Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overr...
Details →CVE-2026-103831 published: CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use of PHP's native unserialize() function without restrictions on the classes allowed when retrieving data stored in th...
Details →CVE-2026-84854 published: In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Und...
Details →CVE-2026-80327 published: An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0...
Details →CVE-2026-104405 published: Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions.
Details →CVE-2026-104406 published: Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
Details →CVE-2026-104670 published: Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
Details →CVE-2026-104672 published: Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
Details →CVE-2026-104747 published: Unauthenticated PHP Object Injection in Haaken <= 1.5 versions.
Details →CVE-2026-104757 published: Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions.
Details →CVE-2026-104387 published: Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
Details →CVE-2026-104394 published: Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
Details →CVE-2026-104395 published: Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
Details →CVE-2026-104399 published: Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124.
Details →CVE-2026-100518 published: Unauthenticated Broken Authentication in Advanced Google reCAPTCHA <= 5.40 versions.
Details →CVE-2026-102387 published: Unauthenticated Sensitive Data Exposure in Xserver Migrator <= 1.6.6 versions.
Details →CVE-2026-102915 published: Subscriber Broken Access Control in WPO365 <= 44.1 versions.
Details →CVE-2026-103346 published: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
Details →CVE-2026-104385 published: Unauthenticated Sensitive Data Exposure in Groundhogg <= 4.8.3 versions.
Details →