CVE Vulnerability Catalog

Unauthenticated Broken Authentication in SupportCandy versions up to 3.5.1.

Broken Access Control vulnerability in GiveWP versions earlier than 4.16.6. The attack does not require authentication.

SQL Injection vulnerability in License Manager for WooCommerce versions up to 3.0.18. An attacker can inject malicious SQL code through the customer field.

An unauthenticated attacker can remotely execute arbitrary code (RCE) in WP Compress versions prior to 7.20.01.

Unauthenticated Cross Site Scripting (XSS) vulnerability in WP Multilang versions up to 2.4.31. An attacker can inject a malicious script that executes in the victim's browser.

An unauthenticated attacker can perform PHP Object Injection in RegistrationMagic versions up to 6.0.9.7.

An unauthenticated attacker can exploit SQL Injection in Modern Events Calendar versions prior to 7.35.0.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Autopay versions up to 5.0.0. An attacker can inject a malicious script that executes in the victim's browser.

The WPDM – Premium Packages plugin (W3 Eden) is vulnerable to DOM-Based Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects WPDM – Premium Packages from n/a through 7.0.5.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. It is a duplicate of CVE-2026-14858.

An unauthenticated attacker can exploit SQL Injection in Sticky Chat Widget versions up to 1.4.2.

Unauthenticated Arbitrary File Download vulnerability in Extra Product Options & Add-Ons for WooCommerce versions before 7.6. An attacker can download arbitrary files from the server.

In n8n, an open source workflow automation platform, prior to versions 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server.

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both types of keys (filekeys and dirkeys) were manually enabled in the volume flags simultaneously. This issue is fixed in version 1.20.17.

In Hoppscotch, an open source API development ecosystem, prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries.

Pyenv prior to 2.8.0, is_version_safe() accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in several scripts pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version.

Privilege Escalation vulnerability in MasterStudy LMS versions up to 3.7.41. The attack requires subscriber-level privileges.

A Cross-site Scripting (DOM-Based XSS) vulnerability in the WordPress plugin EasyTest – Simplify A/B Testing stems from improper input neutralization during web page generation. Affects versions up to and including 1.0.1.

Cross Site Scripting (XSS) vulnerability in GeoDirectory versions up to 2.8.172. The attack requires contributor-level privileges.

In the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes, a user with permissions to annotate the namespaced ManagedClusterAddOn resource can override the governance-policy container image. This allows an attacker to run a controlled image with cluster-admin privileges on the managed cluster, leading to arbitrary code execution and privilege escalation.