Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-02-18
CVE-2026-22234 - eCase Portal Plugin
OPEXUS eCasePortal before version 9.0.45.0 allows an unauthenticated attacker to navigate to the 'Attachments.aspx' endpoint, iterate through predictable values of 'formid', and download or delete all user-uploaded files, or upload new files.
PLUGIN
eCase Portal
CVE-2026-22234
Risk Score
Threat Entry
Updated 2026-02-18
CVE-2026-22235 - eComplaint Plugin
OPEXUS eComplaint before version 9.0.45.0 allows an attacker to visit the the 'DocumentOpen.aspx' endpoint, iterate through predictable values of 'chargeNumber', and download any uploaded files.
PLUGIN
eComplaint
CVE-2026-22235
Risk Score
Threat Entry
Updated 2026-01-13
CVE-2026-22587 - DevonWay Plugin
Ideagen DevonWay contains a stored cross site scripting vulnerability. A remote, authenticated attacker could craft a payload in the 'Reports' page that executes when another user views the report. Fixed in 2.62.4 and 2.62 LTS.
PLUGIN
DevonWay
CVE-2026-22587
Risk Score
Threat Entry
Updated 2026-02-05
CVE-2026-22233 - eCASE Audit Plugin
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment in the "Estimated Staff Hours" field. The JavaScript is executed whenever another user visits the Project Cost tab. Fixed in OPEXUS eCASE Audit 11.14.2.0.
PLUGIN
eCASE Audit
CVE-2026-22233
Risk Score
Threat Entry
Updated 2026-02-05
CVE-2026-22232 - eCASE Audit Plugin
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript in the "A or SIC Number" field within the Project Setup functionality. The JavaScript is executed whenever another user views the project. Fixed in OPEXUS eCASE Audit 11.14.2.0.
PLUGIN
eCASE Audit
CVE-2026-22232
Risk Score
Threat Entry
Updated 2026-01-26
CVE-2026-22230 - eCASE Audit Plugin
OPEXUS eCASE Audit allows an authenticated attacker to modify client-side JavaScript or craft HTTP requests to access functions or buttons that have been disabled or blocked by an administrator. Fixed in eCASE Platform 11.14.1.0.
PLUGIN
eCASE Audit
CVE-2026-22230
Risk Score
Threat Entry
Updated 2026-02-02
CVE-2026-21896 - Kirby Plugin
Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.
PLUGIN
Kirby
CVE-2026-21896
Risk Score
Threat Entry
Updated 2026-02-05
CVE-2026-22231 - eCASE Audit Plugin
OPEXUS eCASE Audit allows an authenticated attacker to save JavaScript as a comment within the Document Check Out functionality. The JavaScript is executed whenever another user views the Action History Log. Fixed in OPEXUS eCASE Platform 11.14.1.0.
PLUGIN
eCASE Audit
CVE-2026-22231
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22521 - Handmade Framework Theme
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in G5Theme Handmade Framework handmade-framework allows PHP Local File Inclusion.This issue affects Handmade Framework: from n/a through
THEME
Handmade Framework
CVE-2026-22521
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22522 - Block Slider Plugin
Missing Authorization vulnerability in Munir Kamal Block Slider block-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Block Slider: from n/a through
PLUGIN
Block Slider
CVE-2026-22522
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22519 - MediaPress Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev MediaPress mediapress allows Stored XSS.This issue affects MediaPress: from n/a through
PLUGIN
MediaPress
CVE-2026-22519
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22518 - X Addons for Elementor Plugin
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows DOM-Based XSS.This issue affects X Addons for Elementor: from n/a through
PLUGIN
X Addons for Elementor
CVE-2026-22518
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22517 - GA4WP: Google Analytics for WordPress Plugin
Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through
PLUGIN
GA4WP: Google Analytics for WordPress
CVE-2026-22517
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22490 - Bulk Landing Page Creator for WordPress LPagery Plugin
Missing Authorization vulnerability in niklaslindemann Bulk Landing Page Creator for WordPress LPagery lpagery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bulk Landing Page Creator for WordPress LPagery: from n/a through
PLUGIN
Bulk Landing Page Creator for WordPress LPagery
CVE-2026-22490
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22488 - Dashboard Welcome for Beaver Builder Plugin
Missing Authorization vulnerability in IdeaBox Creations Dashboard Welcome for Beaver Builder dashboard-welcome-for-beaver-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Welcome for Beaver Builder: from n/a through
PLUGIN
Dashboard Welcome for Beaver Builder
CVE-2026-22488
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22492 - Docket Cache Plugin
Missing Authorization vulnerability in Nawawi Jamili Docket Cache docket-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Docket Cache: from n/a through
PLUGIN
Docket Cache
CVE-2026-22492
Risk Score
Threat Entry
Updated 2026-06-17
CVE-2026-22489 - Image Slider Slideshow Plugin
Authorization Bypass Through User-Controlled Key vulnerability in Wptexture Image Slider Slideshow image-slider-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Slider Slideshow: from n/a through
PLUGIN
Image Slider Slideshow
CVE-2026-22489
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-21638 - UDB-Pro/UDB-Pro-Sector Plugin
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: UBB-XG (Version 1.2.2 and earlier) UDB-Pro/UDB-Pro-Sector (Version 1.4.1 and earlier) UBB (Version 3.1.5 and earlier) Mitigation: Update your UBB-XG to Version 1.2.3 or later. Update your UDB-Pro/UDB-Pro-Sector to Version 1.4.2 or later. Update your UBB to Version 3.1.7 or later.
PLUGIN
UDB-Pro/UDB-Pro-Sector
CVE-2026-21638
Risk Score
Threat Entry
Updated 2026-01-15
CVE-2026-0671 - MediaWiki - UploadWizard extension Plugin
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki - UploadWizard extension allows Cross-Site Scripting (XSS).This issue affects MediaWiki - UploadWizard extension: 1.45, 1.44, 1.43, 1.39.
PLUGIN
MediaWiki - UploadWizard extension
CVE-2026-0671
Risk Score
Threat Entry
Updated 2026-01-14
CVE-2026-21639 - airFiber AF60-XG Plugin
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product. Affected Products: airMAX AC (Version 8.7.20 and earlier) airMAX M (Version 6.3.22 and earlier) airFiber AF60-XG (Version 1.2.2 and earlier) airFiber AF60 (Version 2.6.7 and earlier) Mitigation: Update your airMAX AC to Version 8.7.21 or later. Update your airMAX M to Version 6.3.24 or later. Update your airFiber AF60-XG to Version 1.2.3 or later. Update your airFiber AF60 to Version…
PLUGIN
airFiber AF60-XG
CVE-2026-21639
Risk Score