CVE Database
Search and filter vulnerabilities by ID, vendor, product, severity, or description.
Search and filter vulnerabilities by ID, vendor, product, severity, or description.
| CVE ID | Severity | Score | Description | Published | |
|---|---|---|---|---|---|
| CVE-2026-91860 | UNKNOWN | — | A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 23.0.0 - 23.6.13 Vaadin 24.0.0 - 24.9.20 Vaadin 24.10.0 - 24.10.9 Vaadin 25.0.0 - 25.1.11 Vaadin 25.2.0 - 25.2.6 Mitigation Upgrade to 23.6.14 Upgrade to 24.9.21 Upgrade to 24.10.10 Upgrade to 25.1.12 Upgrade to 25.2.7 or newer Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 23, 24, 25 version. Artifacts Maven coordinates Vulnerable versions Fixed version com.vaadin:vaadin 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-core 24.7.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-core 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-core 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-core 25.2.0 - 25.2.6 >=25.2.7 com.vaadin:vaadin-charts-flow 23.0.0 - 23.6.13 >=23.6.14 com.vaadin:vaadin-charts-flow 24.0.0 - 24.9.20 >=24.9.21 com.vaadin:vaadin-charts-flow 24.10.0 - 24.10.9 >=24.10.10 com.vaadin:vaadin-charts-flow 25.0.0 - 25.1.11 >=25.1.12 com.vaadin:vaadin-charts-flow 25.2.0 - 25.2.6 >=25.2.7 npm packages npm package Vulnerable versions Fixed version @vaadin/charts 23.0.0 - 23.6.4 >=23.6.5 @vaadin/charts 24.0.0 - 24.9.17 >=24.9.18 @vaadin/charts 24.10.0 - 24.10.4 >=24.10.5 @vaadin/charts 25.0.0 - 25.1.11 >=25.1.12 @vaadin/charts 25.2.0 - 25.2.8 >=25.2.9 @vaadin/component-base 24.7.0 - 24.9.17 >=24.9.18 @vaadin/component-base 24.10.0 - 24.10.4 >=24.10.5 @vaadin/component-base 25.0.0 - 25.1.11 >=25.1.12 @vaadin/component-base 25.2.0 - 25.2.8 >=25.2.9 | Sep 30, 2026 | |
| CVE-2026-82307 | CRITICAL | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1. | Sep 30, 2026 | |
| CVE-2026-103118 | MEDIUM | 4.3 | A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file coders/wpg.c of the component WPG File Handler. Performing a manipulation results in uncontrolled recursion. The attack may be initiated remotely. The patch is named 627b5b1b2fc2. It is suggested to install a patch to address this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | Sep 30, 2026 | |
| CVE-2026-97302 | MEDIUM | 5.3 | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. | Sep 30, 2026 | |
| CVE-2026-97301 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | Sep 30, 2026 | |
| CVE-2026-97299 | MEDIUM | 5.4 | Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. | Sep 30, 2026 | |
| CVE-2026-97298 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. | Sep 30, 2026 | |
| CVE-2026-97293 | HIGH | 8.5 | Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. | Sep 30, 2026 | |
| CVE-2026-97292 | MEDIUM | 6.5 | Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. | Sep 30, 2026 | |
| CVE-2026-97289 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.2.6 versions. | Sep 30, 2026 | |
| CVE-2026-97288 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. | Sep 30, 2026 | |
| CVE-2026-97287 | HIGH | 8.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5. | Sep 30, 2026 | |
| CVE-2026-97286 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in Strong Testimonials <= 3.3.11 versions. | Sep 30, 2026 | |
| CVE-2026-97285 | MEDIUM | 5.4 | Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions. | Sep 30, 2026 | |
| CVE-2026-97282 | MEDIUM | 5.3 | Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions. | Sep 30, 2026 | |
| CVE-2026-97279 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions. | Sep 30, 2026 | |
| CVE-2026-97274 | CRITICAL | 9.8 | Unauthenticated Bypass Vulnerability in OAuth Single Sign On – SSO (OAuth Client) <= 7.1.2 versions. | Sep 30, 2026 | |
| CVE-2026-97272 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. | Sep 30, 2026 | |
| CVE-2026-97271 | HIGH | 7.1 | Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | Sep 30, 2026 | |
| CVE-2026-97270 | MEDIUM | 6.5 | Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. | Sep 30, 2026 | |
| CVE-2026-97267 | MEDIUM | 4.3 | Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. | Sep 30, 2026 | |
| CVE-2026-97266 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. | Sep 30, 2026 | |
| CVE-2026-97262 | MEDIUM | 6.5 | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. | Sep 30, 2026 | |
| CVE-2026-97261 | MEDIUM | 5.3 | Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. | Sep 30, 2026 | |
| CVE-2026-97253 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0. | Sep 30, 2026 |