Explore CVE records

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40786

WordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Long Watch Studio MyRewards woorewards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyRewards: from n/a through <= 5.7.3.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40784

WordPress FluentBoards plugin <= 1.91.2 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through <= 1.91.2.

Excerpt language: en.

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40778

WordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through <= 1.1.2.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40764

WordPress Contact Form by WPForms plugin <= 1.10.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Cross Site Request Forgery.This issue affects Contact Form by WPForms: from n/a through <= 1.10.0.2.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40763

WordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1056.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40745

WordPress Element Pack Elementor Addons plugin <= 8.4.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Blind SQL Injection.This issue affects Element Pack Elementor Addons: from n/a through <= 8.4.2.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

HighPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40744

WordPress Beaver Builder plugin <= 2.10.1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Blind SQL Injection.This issue affects Beaver Builder: from n/a through <= 2.10.1.2.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40742

WordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability

Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio AB Testing: from n/a through <= 8.2.8.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40740

WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tutor LMS: from n/a through <= 3.9.7.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40737

WordPress COMPE plugin <= 1.1.4 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme COMPE compe-woo-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects COMPE: from n/a through <= 1.1.4.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40734

WordPress Categories Images plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zahlan Categories Images categories-images allows DOM-Based XSS.This issue affects Categories Images: from n/a through <= 3.3.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40730

WordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeGrill ThemeGrill Demo Importer themegrill-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeGrill Demo Importer: from n/a through <= 2.0.0.6.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40729

WordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in bPlugins 3D viewer – Embed 3D Models 3d-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 3D viewer – Embed 3D Models: from n/a through <= 1.8.5.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:21 WIB

CVE-2026-40728

WordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in BlockArt Magazine Blocks magazine-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Blocks: from n/a through <= 1.8.3.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:52 WIB

Official record

MedPublished 15 Apr 2026, 17:13 WIB

CVE-2026-28741

CSRF Protection Bypass Allows Updating a User's Authentication Method

Mattermost versions 10.11.x <= 10.11.12, 11.5.x <= 11.5.0, 11.4.x <= 11.4.2, 11.3.x <= 11.3.2 fail to validate CSRF tokens on an authentication endpoint which allows an attacker to update a user's authentication method via a CSRF attack by tricking a user into visiting a malicious page. Mattermost Advisory ID: MMSA-202…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 22:39 WIB

Official record

CritPublished 15 Apr 2026, 17:13 WIB

CVE-2026-33805

@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers

@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9v4.0KEVNot listedEPSSPresentUpdated15 Jul 2026, 08:06 WIB

Official record

LowPublished 15 Apr 2026, 17:11 WIB

CVE-2026-27769

Connected Workspaces: Malicious remote server can manipulate arbitrary user's status

Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote server connected using the Conntexted Workspaces feature to change the displayed status of local users via the Connected Workspaces API.. Mattermost Advisory ID:…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS2.7v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:08 WIB

Official record

CritPublished 15 Apr 2026, 16:52 WIB

CVE-2026-33807

@fastify/express vulnerable to middleware path doubling causing authentication bypass in child plugin scopes

@fastify/express v4.0.4 and earlier contains a path handling bug in the onRegister function that causes middleware paths to be doubled when inherited by child plugins. When a child plugin is registered with a prefix that matches a middleware path, the middleware path is prefixed a second time, causing it to never match…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:09 WIB

Official record

HighPublished 15 Apr 2026, 16:51 WIB

CVE-2024-33618

Uncontrolled Resource Consumption in Bosch VMS Central Server in Bosch VMS 12.0.1 allows attackers to consume excessive amounts of disk space via network interface.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:09 WIB

Official record

CritPublished 15 Apr 2026, 16:29 WIB

CVE-2026-33808

@fastify/express vulnerable to middleware authentication bypass via URL normalization gaps (duplicate slashes and semicolons)

Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalization options are enabled. This allows complete bypass of path-scoped authentication middleware via duplicate slashes when ignoreDuplicateSlashes is enabled, or via semicolon delimiter…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS9.1v4.0KEVNot listedEPSSPresentUpdated15 Apr 2026, 20:10 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage