Export limit exceeded: 397474 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 397474 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (397474 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93529 | 2 Bilal Naseer, Wordpress | 2 Wsp Mcp – Ai Agents Connector, Wordpress | 2026-09-24 | 6.5 Medium |
| Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. | ||||
| CVE-2026-93622 | 2 Nicolaskulka, Wordpress | 2 Wps Limit Login, Wordpress | 2026-09-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. | ||||
| CVE-2026-94118 | 2 Leap13, Wordpress | 2 Premium Blocks – Gutenberg Blocks For Wordpress, Wordpress | 2026-09-24 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | ||||
| CVE-2026-94174 | 2 Webfactory, Wordpress | 2 Email Log, Wordpress | 2026-09-24 | 7.6 High |
| Administrator SQL Injection in Email Log <= 2.63 versions. | ||||
| CVE-2026-94457 | 2 Webfactory, Wordpress | 2 Captcha Code, Wordpress | 2026-09-24 | 4.8 Medium |
| Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | ||||
| CVE-2026-94500 | 2 Roxnor, Wordpress | 2 Elementskit Elementor Addons Lite, Wordpress | 2026-09-24 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | ||||
| CVE-2026-95593 | 2 Ben Roberts, Wordpress | 2 Ultimeter, Wordpress | 2026-09-24 | 7.6 High |
| Editor SQL Injection in Ultimeter <= 3.0.8 versions. | ||||
| CVE-2026-95603 | 2 Victor Rodriguez, Wordpress | 2 Reycob Product Import Export, Wordpress | 2026-09-24 | 7.2 High |
| Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. | ||||
| CVE-2026-77423 | 1 Jline | 1 Jline | 2026-09-24 | 7.5 High |
| JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in less viewer passes user-controlled search and display-filter patterns from getPattern(boolean doDisplayPattern) in builtins/src/main/java/org/jline/builtins/Less.java directly to Java's backtracking regular expression engine and repeatedly applies them to file content. A nested-quantifier expression evaluated against non-matching lines can consume excessive CPU and indefinitely block the session thread, and repeated sessions in Telnet or SSH deployments can exhaust a bounded worker pool. This issue is fixed in versions 3.30.15 and 4.3.1. | ||||
| CVE-2026-96545 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-09-24 | 4.4 Medium |
| An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in. | ||||
| CVE-2026-96546 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-09-24 | 2.5 Low |
| A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated. | ||||
| CVE-2026-61814 | 2 Org.typelevel, Typelevel | 4 Jawn-parser 2.12, Jawn-parser 2.13, Jawn-parser 3 and 1 more | 2026-09-24 | 7.5 High |
| Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0. | ||||
| CVE-2026-96872 | 1 Wikimedia | 1 Mediawiki-wikilambda Extension | 2026-09-24 | N/A |
| Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0. | ||||
| CVE-2026-94181 | 1 The Browser Company Of New York | 1 Arc | 2026-09-24 | 7.4 High |
| An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification. | ||||
| CVE-2026-96770 | 1 Temporal Technologies, Inc. | 1 S2s-proxy | 2026-09-24 | N/A |
| All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required. | ||||
| CVE-2026-87900 | 1 Webpros | 1 Wp Toolkit For Cpanel | 2026-09-24 | N/A |
| Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. | ||||
| CVE-2026-18467 | 2 Paytiumsupport, Wordpress | 2 Paytium: Mollie Payment Forms & Donations, Wordpress | 2026-09-24 | 9.8 Critical |
| The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address. | ||||
| CVE-2026-96898 | 2 Shopxo, Yhx070424 | 2 Shopxo, Shopxo | 2026-09-24 | 7.3 High |
| A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-97155 | 1 Fabasoft | 1 Folio Client | 2026-09-24 | 6.5 Medium |
| Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite. | ||||
| CVE-2026-87898 | 1 Webpros | 1 Plesk Site Import | 2026-09-24 | N/A |
| OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | ||||