Explore CVE records

UnscoredPublished 16 Apr 2026, 00:20 WIB

CVE-2026-5758

Mafintosh's protocol-buffers-schema is vulnerable to prototype pollution

JavaScript is vulnerable to prototype pollution in Mafintosh's protocol-buffers-schema Version 3.6.0, where an attacker may alter the application logic, bypass security checks, cause a DoS or achieve remote code execution.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated16 Apr 2026, 01:55 WIB

Official record

CritPublished 15 Apr 2026, 23:31 WIB

CVE-2025-15610

The .NET Remoting framework used by OpenText Fax (RightFax) includes known security vulnerabilities that could be exploited if the service is exposed in environments where the remoting ports are accessible.

Excerpt language: en.

CVSS

HighPublished 15 Apr 2026, 23:21 WIB

CVE-2025-63029

WordPress WCFM Marketplace plugin <= 3.7.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows SQL Injection.This issue affects WCFM Marketplace: from n/a through <= 3.7.1.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 15 Apr 2026, 23:16 WIB

CVE-2026-6372

WordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability

Missing Authorization vulnerability in Plisio Accept Cryptocurrencies with Plisio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accept Cryptocurrencies with Plisio: from n/a through 2.0.5.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 21:06 WIB

Official record

MedPublished 15 Apr 2026, 23:11 WIB

CVE-2026-20136

Cisco Identity Services Engine Authenticated Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, local attacker with administrative privileges to perform a command injection attack on the underlying operating system and elevate privileges to root. This vulnerab…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 10:55 WIB

Official record

MedPublished 15 Apr 2026, 23:11 WIB

CVE-2026-20059

Cisco Unity Connection Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:56 WIB

Official record

MedPublished 15 Apr 2026, 23:11 WIB

CVE-2026-20061

Cisco Unity Connection SQL Injection Vulnerability

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to perform an SQL injection attack against an affected device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. This vulnerability is due t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:56 WIB

Official record

MedPublished 15 Apr 2026, 23:11 WIB

CVE-2026-20060

Cisco Unity Connection Open Redirect Vulnerability

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by persuading a u…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:56 WIB

Official record

MedPublished 15 Apr 2026, 23:10 WIB

CVE-2026-20170

A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to conduct cross-site scripting attacks. Cisco has addressed this vulnerability in the Cisco Webex Contact Center service, and no customer action is needed. This vulnerability exist…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:56 WIB

Official record

CritPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20184

Cisco Webex Meetings Certificate Validation Vulnerability

A vulnerability in the integration of single sign-on (SSO) with Control Hub in Cisco Webex Services could have allowed an unauthenticated, remote attacker to impersonate any user within the service. This vulnerability existed because of improper certificate validation. Prior to this vulnerability being addressed, an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated17 Apr 2026, 02:07 WIB

Official record

CritPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20180

Cisco Identity Services Engine Multiple Remote Code Execution Vulnerability

A vulnerability in Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least Read Only Admin credentials. This vulnerability is due to insuff…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 10:55 WIB

Official record

MedPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20152

Cisco Secure Web Appliance Authentication Service Traffic Bypass Vulnerability

A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass authentication policy requirements. This vulnerability is due to improper validation of user-supplied authentication input in HTTP requests. An atta…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated17 Apr 2026, 02:05 WIB

Official record

MedPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20161

Cisco ThousandEyes Enterprise Agent Arbitrary File Overwrite Vulnerability

A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent could allow an authenticated, local attacker with low privileges to overwrite arbitrary files on the local system of an affected device. This vulnerability is due to improper access controls on files that are on the local file system of an affect…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:56 WIB

Official record

CritPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20186

Cisco Identity Services Engine Multiple Authenticated Remote Code Execution Vulnerability

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 10:55 WIB

Official record

MedPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20148

Cisco Identity Services Engine Path Traversal Vulnerability

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perform path traversal attacks on the underlying operating system and read arbitrary files. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to improper val…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 23:56 WIB

Official record

CritPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20147

Cisco Identity Services Engine Remote Code Execution Vulnerability

A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have valid administrative credentials. This vulnerability is due to insufficient valida…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 10:55 WIB

Official record

MedPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20081

Cisco Unity Connection Arbitrary File Download Vulnerability

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.  These vulnerabilities are due to improper sanitization of user in…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 00:06 WIB

Official record

MedPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20078

Cisco Unity Connection Arbitrary File Download Vulnerability

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 00:06 WIB

Official record

MedPublished 15 Apr 2026, 23:03 WIB

CVE-2026-20132

Cisco Identity Services Engine Multiple Cross-Site Scripting Vulnerabilities

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interf…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.8v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 00:06 WIB

Official record

MedPublished 15 Apr 2026, 23:02 WIB

CVE-2026-6370

WordPress Mini Ajax Cart for WooCommerce plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HashThemes Mini Ajax Cart for WooCommerce allows Stored XSS.This issue affects Mini Ajax Cart for WooCommerce: from n/a through 1.3.4.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated16 Apr 2026, 21:09 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage