VE
Vendor
verbb
16
CVEs
0
On KEV
0
New 30D
Products
FO9.8
formie
verbb
9 CVEs0 on KEV0 new
CO6.5
Comments
Verbb
3 CVEs0 on KEV0 new
IR8.8
Image Resizer
Verbb
2 CVEs0 on KEV0 new
KK9.1
Knock Knock
Verbb
2 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-76087 | FO formie verbb | 8.2 | Sep 23 | Formie: Unauthenticated users can overwrite incomplete submissions via submit action |
| CVE-2026-76086 | FO formie verbb | 8.5 | Sep 23 | Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials |
| CVE-2026-76089 | FO formie verbb | 7.7 | Sep 23 | Formie: Missing authorization on sent notification resend modal exposes submission PII |
| CVE-2026-52889 | FO formie verbb | 9.8 | Aug 19 | Formie: Server-Side Template Injection in Formie Hidden field defaults |
| CVE-2026-47266 | FO formie verbb | 8.7 | May 29 | Formie: Unauthenticated front-end submission editing can overwrite existing submissions |
| CVE-2026-45697 | FO formie verbb | 9.8 | May 29 | Formie: Pre-authenticated server-side template injection in Hidden fields |
| CVE-2025-32426 | FO formie verbb | 5.4 | Apr 11 | Formie has a XSS vulnerability for email notification content for preview |
| CVE-2025-32427 | FO formie verbb | 5.4 | Apr 11 | Formie has a XSS vulnerability for importing forms |
| CVE-2024-35191 | FO formie verbb | 4.4 | May 20 | verbb/formie Server-Side Template Injection for variable-enabled settings |
| CVE-2020-13870 | CO Comments Verbb | 5.4 | Jun 5 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS |
| CVE-2020-13869 | CO Comments Verbb | 5.4 | Jun 5 | An issue was discovered in the Comments plugin before 1.5.6 for Craft CMS |
| CVE-2020-13868 | CO Comments Verbb | 6.5 | Jun 5 | An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS |
| CVE-2020-13486 | KK Knock Knock Verbb | 6.1 | May 25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection |
| CVE-2020-13485 | KK Knock Knock Verbb | 9.1 | May 25 | The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header |
| CVE-2020-13459 | IR Image Resizer Verbb | 5.4 | May 25 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS |
| CVE-2020-13458 | IR Image Resizer Verbb | 8.8 | May 25 | An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS |