Find the CVE cohort

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:35.306Z. Updated 2026-10-05T10:45:22.510Z.

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:32.986Z. Updated 2026-08-18T19:48:23.621Z.

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:31.882Z. Updated 2026-08-18T15:27:44.520Z.

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:30.694Z. Updated 2026-08-18T15:12:43.305Z.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:29.548Z. Updated 2026-08-18T19:48:23.801Z.

Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:28.326Z. Updated 2026-08-18T14:21:08.222Z.

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:27.293Z. Updated 2026-08-18T19:48:23.980Z.

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.2 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:26.158Z. Updated 2026-08-18T15:28:35.106Z.

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:25.220Z. Updated 2026-08-18T15:12:49.658Z.

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:24.334Z. Updated 2026-08-18T19:48:24.165Z.

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:23.182Z. Updated 2026-08-18T14:19:13.853Z.

Subscriber Server Side Request Forgery (SSRF) in [Aotuman] Grab WeChat Articles <= 2.0.1 versions.

Excerpt language: en.

Severity medium: primary CNA CVSS 6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:21.835Z. Updated 2026-08-18T19:48:24.345Z.

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:20.788Z. Updated 2026-08-18T21:25:44.835Z.

Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:14.771Z. Updated 2026-08-18T15:12:55.780Z.

Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 8.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:13.815Z. Updated 2026-08-18T19:48:24.526Z.

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:12.665Z. Updated 2026-08-18T14:19:42.781Z.

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:11.395Z. Updated 2026-08-18T21:25:43.571Z.

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2026-08-18T13:59:09.867Z. Updated 2026-08-18T21:25:42.317Z.