NVD Vulnerability Information Top
Show Search Menu
Vendor Name
プロダクト・サービス名
Title
CVE
CRITICAL
HIGH
MEDIUM
LOW
CWE
In descending order of publication date
In descending order of update date
Number of items displayed

You can search the list of vulnerabilities managed by the NVD (National Vulnerability Database).
Since vulnerability information is often updated before JVN (Japan Vulnerability Note), vulnerabilities that are not listed in JVN may be updated.

If there is a vulnerability related to JVN (Japan Vulnerability Note), the information will be displayed on the detail page.

To search by CWE, please refer to the CWE Overview and check the CWE number.

  • CRITICAL
  • HIGH
  • MEDIUM
  • LOW

Update Date:May 1, 2026, 4:54 a.m.

No CVSS Level
Attach Vector		 Vendor Name Project Name Title CWE CVE Update Date Publication Date Show Affected Exploit
PoC
Search
2351 8.8 HIGH
Network 		- - Deserialization of Untrusted Data vulnerability in sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll allows Object Injection.This issue affects WooCommerce Infinite Scroll: from n/a… CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27045 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2352 8.8 HIGH
Network 		- - Vulnerabilidad de deserialización de datos no confiables en sbthemes WooCommerce Infinite Scroll sb-woocommerce-infinite-scroll permite la inyección de objetos. Este problema afecta a WooCommerce Inf… CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27045 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2353 6.5 MEDIUM
Network 		- - Missing Authorization vulnerability in Kaira StoreCustomizer woocustomizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects StoreCustomizer: from n/a through… CWE-862
 Missing Authorization 		CVE-2026-27046 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2354 6.5 MEDIUM
Network 		- - Vulnerabilidad de Autorización Faltante en Kaira StoreCustomizer woocustomizer permite Explotar Niveles de Seguridad de Control de Acceso Incorrectamente Configurados. Este problema afecta a StoreCus… CWE-862
 Missing Authorization 		CVE-2026-27046 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2355 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly Core curly-core allows PHP Local File Inclusion.This issue… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27047 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2356 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración include/require en un programa PHP ('inclusión remota de ficheros PHP') vulnerabilidad en Mikado-Themes Curly Core curly-core permite la i… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27047 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2357 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes The Aisle Core theaisle-core allows PHP Local File Inclusion.Thi… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27048 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2358 8.1 HIGH
Network 		- - La vulnerabilidad de control inadecuado del nombre de fichero para la declaración Include/Require en el programa PHP ('Inclusión remota de ficheros PHP') en Elated-Themes The Aisle Core theaisle-core… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27048 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2359 9.8 CRITICAL
Network 		- - Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobica Core jobica-core allows Authentication Abuse.This issue affects Jobica Core: from n/a through <= 1.4.2. CWE-288
Authentication Bypass Using an Alternate Path or Channel 		CVE-2026-27049 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2360 9.8 CRITICAL
Network 		- - Vulnerabilidad de omisión de autenticación mediante una ruta o canal alternativo en NooTheme Jobica Core jobica-core permite el abuso de autenticación. Este problema afecta a Jobica Core: desde n/a h… CWE-288
Authentication Bypass Using an Alternate Path or Channel 		CVE-2026-27049 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2361 9.8 CRITICAL
Network 		- - Incorrect Privilege Assignment vulnerability in uxper Golo golo allows Privilege Escalation.This issue affects Golo: from n/a through <= 1.7.0. CWE-266
 Incorrect Privilege Assignment 		CVE-2026-27051 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2362 9.8 CRITICAL
Network 		- - Vulnerabilidad de Asignación Incorrecta de Privilegios en uxper Golo golo permite la escalada de privilegios. Este problema afecta a Golo: desde n/d hasta &lt;= 1.7.0. CWE-266
 Incorrect Privilege Assignment 		CVE-2026-27051 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2363 7.1 HIGH
Network 		- - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PenciDesign Penci Soledad Data Migrator penci-data-migrator allows Reflected XSS.This issue affec… CWE-79
Cross-site Scripting 		CVE-2026-27054 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2364 7.1 HIGH
Network 		- - Vulnerabilidad de Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') en PenciDesign Penci Soledad Data Migrator penci-data-migrator permite XSS Refl… CWE-79
Cross-site Scripting 		CVE-2026-27054 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2365 9.1 CRITICAL
Network 		- - Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7. CWE-862
 Missing Authorization 		CVE-2026-27071 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2366 9.1 CRITICAL
Network 		- - Vulnerabilidad de autorización faltante en Arraytics WPCafe wp-cafe permite la explotación de niveles de seguridad de control de acceso configurados incorrectamente. Este problema afecta a WPCafe: de… CWE-862
 Missing Authorization 		CVE-2026-27071 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2367 7.5 HIGH
Network 		- - Use of Hard-coded Credentials vulnerability in Addi Addi &#8211; Cuotas que se adaptan a ti buy-now-pay-later-addi allows Password Recovery Exploitation.This issue affects Addi &#8211; Cuotas que se … CWE-798
 Use of Hard-coded Credentials 		CVE-2026-27073 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2368 7.5 HIGH
Network 		- - Vulnerabilidad de uso de credenciales codificadas de forma rígida en Addi Addi – Cuotas que se adaptan a ti buy-now-pay-later-addi permite la explotación de la recuperación de contraseña. Este proble… CWE-798
 Use of Hard-coded Credentials 		CVE-2026-27073 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2369 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Belfort belfort allows PHP Local File Inclusion.This issue affec… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27075 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2370 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración Include/Require en un programa PHP ('Inclusión remota de ficheros PHP') vulnerabilidad en Mikado-Themes Belfort belfort permite la inclusi… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27075 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2371 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes LuxeDrive luxedrive allows PHP Local File Inclusion.This issue a… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27076 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2372 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración Include/Require en un programa PHP, vulnerabilidad ('Inclusión Remota de Ficheros PHP') en Mikado-Themes LuxeDrive luxedrive permite la In… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27076 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2373 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes MultiOffice multioffice allows PHP Local File Inclusion.This iss… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27077 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2374 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración include/require en un programa PHP ('inclusión remota de ficheros PHP') vulnerabilidad en Mikado-Themes MultiOffice multioffice permite la… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27077 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2375 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Emaurri emaurri allows PHP Local File Inclusion.This issue affec… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27078 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2376 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración Include/Require en programa PHP, vulnerabilidad de 'inclusión remota de ficheros PHP' en Mikado-Themes Emaurri emaurri permite la inclusió… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27078 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2377 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Amfissa amfissa allows PHP Local File Inclusion.This issue affec… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27079 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2378 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración include/require en un programa PHP (vulnerabilidad de 'inclusión remota de ficheros PHP') en Mikado-Themes Amfissa amfissa permite la incl… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27079 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2379 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Deston deston allows PHP Local File Inclusion.This issue affects… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27080 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2380 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración Include/Require en un programa PHP ('Inclusión Remota de Ficheros PHP') vulnerabilidad en Mikado-Themes Deston deston permite la inclusión… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27080 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2381 8.1 HIGH
Network 		- - Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Rosebud rosebud allows PHP Local File Inclusion.This issue affec… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27081 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2382 8.1 HIGH
Network 		- - Control inadecuado del nombre de fichero para la declaración Include/Require en el programa PHP ('PHP inclusión remota de ficheros') vulnerabilidad en Mikado-Themes Rosebud rosebud permite PHP inclus… CWE-98
 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') 		CVE-2026-27081 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2383 9.8 CRITICAL
Network 		- - Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12. CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27082 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2384 9.8 CRITICAL
Network 		- - Vulnerabilidad de deserialización de datos no confiables en ThemeREX Love Story lovestory permite la inyección de objetos. Este problema afecta a Love Story: desde n/a hasta &lt;= 1.3.12. CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27082 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2385 9.8 CRITICAL
Network 		- - Deserialization of Untrusted Data vulnerability in ThemeREX Work & Travel Company work-travel-company allows Object Injection.This issue affects Work & Travel Company: from n/a through <= 1.2. CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27083 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2386 9.8 CRITICAL
Network 		- - Vulnerabilidad de deserialización de datos no confiables en ThemeREX Work &amp; Travel Company work-travel-company permite la inyección de objetos. Este problema afecta a Work &amp; Travel Company: d… CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27083 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2387 9.8 CRITICAL
Network 		- - Deserialization of Untrusted Data vulnerability in ThemeREX Buisson buisson allows Object Injection.This issue affects Buisson: from n/a through <= 1.1.11. CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27084 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2388 9.8 CRITICAL
Network 		- - Vulnerabilidad de deserialización de datos no confiables en ThemeREX Buisson buisson permite la inyección de objetos. Este problema afecta a Buisson: desde n/a hasta &lt;= 1.1.11. CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27084 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2389 7.1 HIGH
Network 		- - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Wolverine Framework wolverine-framework allows Reflected XSS.This issue affects Wolverine… CWE-79
Cross-site Scripting 		CVE-2026-27087 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2390 7.1 HIGH
Network 		- - Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en G5Theme Wolverine Framework wolverine-framework permite XSS Reflejado. Este pro… CWE-79
Cross-site Scripting 		CVE-2026-27087 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2391 7.1 HIGH
Network 		- - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in G5Theme Darna Framework darna-framework allows Reflected XSS.This issue affects Darna Framework: … CWE-79
Cross-site Scripting 		CVE-2026-27088 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2392 7.1 HIGH
Network 		- - Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en G5Theme Darna Framework darna-framework permite XSS Reflejado. Este problema af… CWE-79
Cross-site Scripting 		CVE-2026-27088 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2393 9.8 CRITICAL
Network 		- - Deserialization of Untrusted Data vulnerability in magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Object Injection.This issue affects Bus Tick… CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27095 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2394 9.8 CRITICAL
Network 		- - Vulnerabilidad de deserialización de datos no confiables en magepeopleteam Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation permite la inyección de objetos. Este prob… CWE-502
 Deserialization of Untrusted Data 		CVE-2026-27095 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2395 8.6 HIGH
Network 		- - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Whitebox-Studio Scape scape allows Path Traversal.This issue affects Scape: from n/a through < 1.5.16. CWE-22
Path Traversal 		CVE-2026-31913 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2396 8.6 HIGH
Network 		- - Vulnerabilidad de Limitación Inadecuada de un Nombre de Ruta a un Directorio Restringido ('Salto de Ruta') en Whitebox-Studio Scape scape permite el Salto de Ruta. Este problema afecta a Scape: desde… CWE-22
Path Traversal 		CVE-2026-31913 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2397 6.5 MEDIUM
Network 		- - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hookandhook WP Courses LMS wp-courses allows DOM-Based XSS.This issue affects WP Courses LMS: fro… CWE-79
Cross-site Scripting 		CVE-2026-31914 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2398 6.5 MEDIUM
Network 		- - Neutralización Incorrecta de la Entrada Durante la Generación de Páginas Web ('cross-site scripting') vulnerabilidad en hookandhook WP Courses LMS wp-courses permite XSS basado en DOM. Este problema … CWE-79
Cross-site Scripting 		CVE-2026-31914 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2399 9.3 CRITICAL
Network 		- - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce allows Blind… CWE-89
SQL Injection 		CVE-2026-31920 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm
2400 9.3 CRITICAL
Network 		- - Neutralización incorrecta de elementos especiales utilizados en un comando SQL ('inyección SQL') vulnerabilidad en Devteam HaywoodTech Product Rearrange for WooCommerce products-rearrange-woocommerce… CWE-89
SQL Injection 		CVE-2026-31920 2026-04-25 01:35 2026-03-26 Show GitHub Exploit DB Packet Storm