Export limit exceeded: 425070 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47434 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103696 | 2026-10-16 | 6.8 Medium | ||
| The Mobile builder WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks on sites that also run the WCFM Delivery add-on. | ||||
| CVE-2026-103518 | 2026-10-16 | 4.9 Medium | ||
| The FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin for WordPress is vulnerable to generic SQL Injection via the 'products[*].variants[*].<attacker-chosen key>' parameter in all versions up to, and including, 1.7.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. On FluentCart Pro installs, non-administrator users assigned the Manager shop role also hold the products/edit permission and are therefore able to exploit this vulnerability without administrator-level access. | ||||
| CVE-2025-46773 | 1 Fortinet | 3 Fortianalyzer, Fortianalyzer Cloud, Fortianalyzercloud | 2026-10-16 | 7.9 High |
| An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, FortiAnalyzer Cloud 7.4.1 through 7.4.7, FortiAnalyzer Cloud 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests. | ||||
| CVE-2026-106561 | 2 Backstage, Linuxfoundation | 4 Backstage, Plugin-kubernetes-backend, Backstage and 1 more | 2026-10-16 | 5 Medium |
| Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could retrieve sensitive values that the Kubernetes plugin is designed to mask, potentially exposing credentials and other confidential material held in the connected clusters. Exposure is limited to resources that the Backstage service account is permitted to read and that match the targeted catalog entity's namespace and label selector. Deployments whose cluster credentials do not grant read access to these resources are unaffected. This issue is fixed in version 0.21.9. | ||||
| CVE-2026-106562 | 2 Backstage, Linuxfoundation | 6 Backstage, Plugin-search-backend, Plugin-search-backend-module-elasticsearch and 3 more | 2026-10-16 | 4.3 Medium |
| Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject to a DENY policy for search document types could receive unauthorized results in deployments with permission.enabled set to true and an Elasticsearch or OpenSearch backend. This issue is fixed in @backstage/plugin-search-backend 2.1.6 and @backstage/plugin-search-backend-module-elasticsearch 1.8.7. | ||||
| CVE-2026-106563 | 2 Backstage, Linuxfoundation | 4 Backstage, Plugin-kubernetes-backend, Backstage and 1 more | 2026-10-16 | 5.3 Medium |
| Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes workload data beyond their intended scope by supplying crafted entity data to the deprecated services endpoint. The exposure is limited to read-only access to Kubernetes object metadata across configured clusters. This issue is fixed in version 0.21.8. | ||||
| CVE-2026-76438 | 1 Cisco | 1 Broadworks | 2026-10-16 | 6.5 Medium |
| A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remote attacker with low privileges to alter configurations on an affected device. This vulnerability is due to missing authorization checks. An attacker could exploit this vulnerability by sending a crafted HTTP request. A successful exploit could allow the attacker to alter configurations on select pages. | ||||
| CVE-2026-102865 | 1 Microsoft | 1 Sharepoint Server | 2026-10-16 | 6.5 Medium |
| Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-102232 | 1 Microsoft | 1 Visual Studio Code | 2026-10-16 | 7 High |
| Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-108794 | 1 Zkteco | 1 Biotime | 2026-10-16 | 6.3 Medium |
| A security vulnerability has been detected in ZKTeco BioTime 9.5.6 Build 20260130.3206. Affected by this vulnerability is an unknown functionality of the file /base/api/v1.0/systemSettings/db_migrate_setting/ of the component Database Migration Functionality. Such manipulation leads to sql injection. It is possible to launch the attack remotely. Upgrading to version 9.5.6 Build 3623 addresses this issue. Upgrading the affected component is advised. | ||||
| CVE-2026-111472 | 1 Tsg | 1 Profleet | 2026-10-16 | N/A |
| An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint. | ||||
| CVE-2026-27433 | 2026-10-16 | 6.5 Medium | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85. | ||||
| CVE-2026-70167 | 1 Microsoft | 3 Windows Server 2022, Windows Server 2025, Windows Server 2025 (server Core Installation) | 2026-10-16 | 8.8 High |
| Access of resource using incompatible type ('type confusion') in DNS Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-103423 | 2026-10-16 | 7.5 High | ||
| The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve personally identifiable information for every booked customer stored in the booking_package_booked_customers table, including names, email addresses, phone numbers, physical addresses, and cancellation tokens. The nonce nominally protecting the endpoint is a public CSRF token emitted in the localized booking_package JavaScript object on any page rendering the [booking_package] shortcode or widget, making it trivially harvestable by unauthenticated visitors and providing no effective authentication barrier. | ||||
| CVE-2026-17092 | 2026-10-16 | 8.1 High | ||
| The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary business directory listings, including those owned by other users and posts in publish, draft, or private status. The nonces guarding the endpoint do not constitute an authorization barrier because both directorist_nonce and atbdp_nonce_js are exposed to all logged-in users via wp_localize_script. | ||||
| CVE-2026-96661 | 2026-10-16 | 7.5 High | ||
| The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to, and including, 1.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The unauthenticated mobile app endpoint dispatches the library action without validating the Mobile App feature flag, a nonce, or any WordPress authentication, meaning no account or session of any kind is required to exploit this vulnerability. | ||||
| CVE-2026-103307 | 2026-10-16 | 8.6 High | ||
| The Walletdoc Payment Gateway for WooCommerce WordPress plugin before 1.8.5 does not properly sanitize and escape user input before using it in a SQL statement, and verifies its payment webhook with a signing secret that is empty by default, allowing unauthenticated attackers to perform SQL injection attacks and to mark arbitrary orders as paid. | ||||
| CVE-2026-104751 | 2026-10-16 | 5.3 Medium | ||
| The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it. | ||||
| CVE-2026-106646 | 2026-10-16 | 5.9 Medium | ||
| The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-level account to modify, corrupt or delete media-library attachments owned by other users, including administrators. | ||||
| CVE-2026-108064 | 2026-10-16 | 6.5 Medium | ||
| The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPress plugin before 7.8.8.2 overwrite the site's certificate private key and replace its pending Let's Encrypt order and challenge material with a single request. Repeated requests keep regenerating the material, preventing the administrator from completing certificate issuance. | ||||