Export limit exceeded: 95206 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95206 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-97272 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions. | ||||
| CVE-2026-92103 | 1 Elixir-mint | 1 Mint | 2026-09-30 | N/A |
| Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decode_next/2 in lib/mint/http2/frame.ex compares a frame with the client's max_frame_size (16,384 bytes by default) only once the whole declared payload has arrived. Until then it returns :more, and Mint.HTTP2 keeps every received byte in the connection buffer. A server can declare a frame length of up to 16,777,215 bytes and withhold the last byte, keeping roughly 1,024 times the advertised limit buffered for as long as the connection stays open. The server has to send every byte the client buffers, so there is no amplification, and the buffer stops at the 24-bit frame length limit. This issue affects mint: from 0.1.0 before 1.10.2. | ||||
| CVE-2026-97288 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions. | ||||
| CVE-2026-100508 | 2026-09-30 | 5.3 Medium | ||
| Unauthenticated Denial of Service Attack in Two Factor <= 0.16.0 versions. | ||||
| CVE-2026-102384 | 2026-09-30 | 5.9 Medium | ||
| Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. | ||||
| CVE-2026-95329 | 1 Google | 2 Android, Chrome | 2026-09-30 | 9.6 Critical |
| Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-95322 | 1 Google | 2 Android, Chrome | 2026-09-30 | 8.3 High |
| Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-97301 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | ||||
| CVE-2026-97292 | 2026-09-30 | 6.5 Medium | ||
| Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. | ||||
| CVE-2026-97270 | 2026-09-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. | ||||
| CVE-2026-97266 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. | ||||
| CVE-2026-97262 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. | ||||
| CVE-2026-97253 | 2026-09-30 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0. | ||||
| CVE-2026-97238 | 2026-09-30 | 5.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. | ||||
| CVE-2026-97236 | 2026-09-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | ||||
| CVE-2026-97235 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | ||||
| CVE-2026-97077 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. | ||||
| CVE-2026-97067 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions. | ||||
| CVE-2026-97065 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. | ||||
| CVE-2026-96836 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions. | ||||