CVE Vulnerability Catalog

The WP w3all phpBB plugin (axew3.com) in versions up to 3.1.0 contains a Cross-site Scripting (Stored XSS) vulnerability due to improper neutralization of input during web page generation.

The Broadcast Live Video plugin by VideoWhisper.com up to version 7.3.2 contains a Session Fixation vulnerability that allows session hijacking.

The Push Notification for Post and BuddyPress plugin (Muralidharan Ramasamy) in versions up to 3.23 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The SureCart plugin by Brainstorm Force up to version 4.9.3 contains an untrusted data deserialization vulnerability that allows Object Injection.

The SureCart plugin by Brainstorm Force up to version 4.9.3 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

Google Cloud Application Integration prior to version 2026-08-27 contains an incorrect authorization vulnerability in the AuthConfig validation and integration execution runtime that allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution. Technical details were not provided in the description.

A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service. Technical details were not provided in the description.

A security vulnerability in HPE NonStop TSQLFIL may cause address space corruption when a specific API is called.

The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification email sent to the site owner, allowing unauthenticated users to inject arbitrary HTML, such as phishing links, into that email.

The Tickera WordPress plugin before 3.6.0.4 does not correctly verify the integrity of incoming payment notifications, and the validated signature does not cover the order or the amount. This allows unauthenticated attackers to forge a payment confirmation and mark arbitrary orders as paid without paying.

A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption.

The WPForms Lite WordPress plugin before 2.0.2.2 does not verify server-side that a payment was completed before accepting a submission on forms using its PayPal Commerce gateway. This allows unauthenticated visitors to submit paid forms without paying, and the form's confirmation is delivered and notification emails are sent even though no order exists at the payment provider.

A security vulnerability in HPE NonStop TSQLEXE may cause application crash via a crafted SQL query.

A security vulnerability in HPE NonStop TMF Auditread2 can cause Denial of Service.

Vulnerability due to incorrect permissions in TSplus Remote Access shared login scripts. The autostart1.tscr files, located in the shared themes directory, allow users without sufficient privileges to write to them. A local attacker with a valid session on the terminal or remote desktop server could modify these files to execute arbitrary commands within another user’s security context when that user logs in using the same theme or operating mode.

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.

A vulnerability in the TSplus Remote Access web server involves improper access control. An unauthenticated remote attacker can access internal resources by manipulating paths through the /socket.io/JWN/ endpoint, bypassing access restrictions.

This CVE ID was rejected because it is a duplicate of CVE-2026-39749 and was never published. Both IDs refer to the same Broken Access Control vulnerability in the App for Cloudflare WordPress plugin.

A Missing Authorization vulnerability in Crocoblock JetFormBuilder allows exploiting incorrectly configured access control security levels. Affects versions up to 3.6.6.