Threat database

CVE-2026-71575 is a critical vulnerability in Apache CXF affecting the OidcClientCodeRequestFilter component. Due to a milliseconds/seconds unit mismatch and inverted comparison polarity, the max_age authentication freshness check was ineffective. This flaw allows relying parties using setMaxAgeOffset to enforce re-authentication to bypass step-up authentication policies, accepting sessions of any age. The issue is fixed in Apache CXF versions 4.2.4, 4.1.9, and 3.6.13.

Microsoft announced that devices running unsupported versions of Windows will stop receiving security updates following a Windows Update certificate rotation scheduled for next year. This change affects outdated Windows devices that no longer receive official support.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through 3.2.9.

CVE-2026-94158 is a high-severity reflected cross-site scripting (XSS) vulnerability in the bkninja Gloria Admin Panel affecting versions up to 1.3. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. The vulnerability requires user interaction and can impact confidentiality, integrity, and availability of the affected system.

CVE-2026-94503 is a critical vulnerability in PX-lab Zombify versions up to and including 1.7.7 that allows unrestricted upload of files with dangerous types. This flaw enables attackers to upload web shells to the web server, potentially leading to full system compromise. The vulnerability has a CVSS 3.1 base score of 10.0, indicating maximum severity with network attack vector, no privileges or user interaction required, and complete confidentiality, integrity, and availability impact.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

CVE-2026-94159 is a stored cross-site scripting (XSS) vulnerability in KlbTheme's Total Donations plugin affecting versions up to and including 2.0.5. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. It has a high severity with a CVSS score of 7.1. No patch or remediation information is currently provided.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

CVE-2026-96334 is a missing authorization vulnerability in the ThemeGrill User Registration plugin affecting versions prior to 5.2.8. It allows unauthorized users to exploit incorrectly configured access control, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability has a medium severity with a CVSS score of 5.6.

CVE-2026-94170 is a reflected cross-site scripting (XSS) vulnerability in Heateor Support's Sassy Social Share plugin affecting versions up to and including 3.3.79. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 7.1, indicating potential impacts on confidentiality, integrity, and availability. No patch or official remediation details are provided in the available data.

CVE-2026-94664 is a high-severity path traversal vulnerability in the PDF for Contact Form 7 plugin from add-ons.org. It allows an attacker to access files outside the intended directory by exploiting improper pathname restrictions. This affects versions from the initial release up to 7.1.0. The vulnerability has a CVSS score of 7.5, indicating a network exploitable flaw with high confidentiality impact but no integrity or availability impact.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.

CVE-2026-94666 is a path traversal vulnerability in the ZealousWeb Generate PDF using Contact Form 7 plugin, affecting versions from initial release up to 4.2.1. This flaw allows an attacker to access files outside the intended directory by manipulating file path inputs. The vulnerability has a high severity score of 7.5 and impacts confidentiality but does not affect integrity or availability.

CVE-2026-96332 is a reflected cross-site scripting (XSS) vulnerability in yalla ya! Simple Payment software. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. It affects versions from initial releases up to 2.5.4. The CVSS score is 7.1, indicating a high severity level with potential impacts on confidentiality, integrity, and availability. No patch or remediation details are provided in the source data.

CVE-2026-95589 is a missing authorization vulnerability in Magepeople inc.'s Deposits and Partial Payments for WooCommerce plugin. It affects versions from initial release up to but not including 4.0.12. The flaw allows attackers with limited privileges to exploit incorrectly configured access control, potentially leading to unauthorized actions. The vulnerability has a medium severity with a CVSS score of 6.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.

CVE-2026-94667 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetReviews, affecting versions from initial release up to 3.1.2. This vulnerability arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in the context of users viewing the affected pages. The CVSS score is 6.5, indicating a medium severity level with potential impacts on confidentiality, integrity, and availability. No official patch or vendor advisory is provided in the input data, and no known exploits are reported in the wild.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2.

CVE-2026-94661 is a high severity reflected cross-site scripting (XSS) vulnerability in Crocoblock JetBlog plugin versions before 2.4.10.1. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability affects all JetBlog versions from initial releases up to 2.4.10. No official patch or remediation details are provided in the available data.