CVE index

Wasmtime is a runtime for WebAssembly. In versions prior to 24.0.9, 36.0.10, and 44.0.2, when a filesystem preopen is given DirPerms::all() and FilePerms::READ without FilePerms::WRITE, this access control mechanism can be bypassed via the wasip2 descriptor.open-at or wasip1 path_open interfaces by opening a file with only the OpenFlags::TRUNCATE oflag. The root cause is that the clause handling OpenFlags::TRUNCATE in crates/wasi/src/filesystem.rs (Dir::open_at, lines 967–969) did not set open_mode |= OpenMode::WRITE;, which is later used for the access control check against FilePerms to de...

CVE-2026-45441 affects Magepeople inc. WpEvently. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2026-45439 affects Realtyna Realtyna Organic IDX plugin. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

CVE-2026-42775 affects Ruben Garcia AutomatorWP. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2026-42687 affects EventPrime. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2026-42686 affects EventPrime. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

Unauthenticated Broken Authentication in Email Marketing for WooCommerce by Omnisend <= 1.18.0 versions.

CVE-2026-42667 affects Bookly. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2026-42666 affects Dimitri Grassi Salon booking system. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2026-42665 affects Passionate Programmer Peter WP Data Access. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

Unauthenticated Broken Access Control in AI Product Search for WooCommerce &#8211; Motive Commerce Search <= 1.38.2 versions.

CVE-2026-42661 affects aguilatechnologies WP Customer Area. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2026-42658 affects Mamunur Rashid Classified Listing. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.

CVE-2026-42650 affects Ruben Garcia AutomatorWP. Review the CVSS score, exploitation signals, affected versions, remediation status, and linked source material before making a change.