CVE mới & PoC public

3038 CVE

• CVE-2026-111830 Cao 7.1 CWE-79 22/10 16:17

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP Mailster wp-mailster allows Stored XSS.This issue affects WP Mailster: from n/a through 1.9.1.0.

• CVE-2026-110974 Trung bình 6.3 CWE-674 22/10 16:17

  The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue() calls readArray() and readObject(), which call nextValue() again. A deeply nested JSON document, around 20 KB of nested arrays with the default thread stack, makes the JSONArray and JSONObject constructors throw a raw java.lang.StackOverflowError instead of a JSONException. Any application that parses untrusted JSON with this library can be made to fail the thread doing the parsing. The artifact is a 2013 repackage of third-party org.json classes, published once and never maintained, and no fixed version will be released. Users of the affected version should apply the following mitigation. Product version com.vaadin.external.google:android-json 0.0.20131108.vaadin1 Mitigation No fixed version will be released. Replace the artifact with an org.json implementation that limits the nesting depth, such as org.json:json 20231013 or later. Artifacts Maven coordinates / Vulnerable versions / Fixed version com.vaadin.external.google:android-json / 0.0.20131108.vaadin1 / none

• CVE-2026-110894 Trung bình 5.3 CWE-862 22/10 16:17

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

• CVE-2026-110893 Trung bình 5.3 CWE-862 22/10 16:17

  Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2.

• CVE-2026-114460 Trung bình 5.3 CWE-193 22/10 14:16

  A flaw was found in mod_qos. An off-by-one pointer calculation error occurs when merging request body parameters with an existing URL query, which truncates the query string during security evaluation while leaving the actual request unchanged. An unauthenticated remote attacker could exploit this vulnerability by submitting a crafted request that conceals prohibited values from inspection, resulting in a bypass of configured security rules.

• CVE-2026-114459 Thấp 3.7 CWE-125 22/10 14:16

  A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside allocated buffer boundaries. An unauthenticated remote attacker can exploit this vulnerability by triggering specifically crafted server responses, causing an Apache worker process to crash and resulting in a Denial of Service (DoS).

• CVE-2026-114458 Trung bình 5.9 CWE-787 22/10 14:16

  A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-rate connections to a target server. When connection rate monitoring is active, the module fails to verify array boundaries when recording client IP addresses, allowing more connection records to be added than the allocated buffer can hold. This issue leads to heap memory corruption, which can crash the web server process.

• CVE-2026-114457 Thấp 3.7 CWE-170 22/10 14:16

  A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON request when JSON body filtering is enabled. Due to improper string termination during the processing of percent-encoded input, the module reads past allocated memory boundaries, which can cause an Apache worker process to crash.

• CVE-2026-114184 Trung bình 6.5 CWE-79 22/10 14:16

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.14.4.

• CVE-2026-114182 Trung bình 4.3 CWE-862 22/10 14:16

  Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0.

• CVE-2026-114180 Trung bình 5.3 CWE-862 22/10 14:16

  Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Metform: from n/a through 4.3.2.

• CVE-2026-114177 Cao 8.8 CWE-352 22/10 14:16

  Cross-Site Request Forgery (CSRF) vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Cross Site Request Forgery.This issue affects Xpro Elementor Addons: from n/a through 1.7.10.

• CVE-2026-114175 Trung bình 5.4 CWE-862 22/10 14:16

  Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom: from n/a through 1.7.1.

• CVE-2026-112867 Trung bình 6.5 CWE-79 22/10 14:16

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in H5P H5P h5p allows Stored XSS.This issue affects H5P: from n/a through 1.17.9.

• CVE-2026-112843 Trung bình 4.3 CWE-862 22/10 14:16

  Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.14.