Export limit exceeded: 107764 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417482 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62004 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | ||||
| CVE-2026-62003 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | ||||
| CVE-2026-61998 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | ||||
| CVE-2026-61997 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | ||||
| CVE-2026-61996 | 2026-10-30 | 8.5 High | ||
| Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | ||||
| CVE-2026-61992 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | ||||
| CVE-2026-61991 | 2026-10-30 | 10 Critical | ||
| Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | ||||
| CVE-2026-61989 | 2 Merv Barrett, Wordpress-extensions | 2 Easy Property Listings, Easy Property Listings | 2026-10-30 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | ||||
| CVE-2026-5461 | 2 Wordpress-extensions, Wpmudev | 2 Forminator Forms, Forminator Forms | 2026-10-30 | 6.5 Medium |
| The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory. | ||||
| CVE-2026-57207 | 1 Netboxlabs | 1 Netbox-mcp-server | 2026-10-30 | 5.9 Medium |
| NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1. | ||||
| CVE-2026-54865 | 2026-10-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | ||||
| CVE-2026-54864 | 2026-10-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | ||||
| CVE-2026-54860 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | ||||
| CVE-2026-54857 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | ||||
| CVE-2026-54856 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | ||||
| CVE-2026-50000 | 2026-10-30 | 5 Medium | ||
| SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the `Journalist Interface` can accept an `API session` token against the `web UI` because its `SessionInterface` keeps a mutable session key prefix that changes with each request and persists across requests. API and web sessions were separated in `Redis` starting in version 2.5.0, but prefix corruption confuses those session namespaces. An attacker who already has access to the secret `Journalist Interface` onion address, the required authentication access and a recent nonexpired `API session` token can reuse that token against the `web UI` until its natural expiry, at most eight hours. The corrupted prefix can also prevent logout from deleting the correct `Redis` session, although normal expiry still applies. A compromised journalist can access encrypted submissions and perform broad actions on source submissions, but this issue does not expose plaintext submissions or affect the running system's availability. This issue is fixed in version 2.16.0. | ||||
| CVE-2026-42701 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | ||||
| CVE-2026-42694 | 2 Themeum, Wordpress-extensions | 2 Kirki, Kirki | 2026-10-30 | 4.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | ||||
| CVE-2026-39375 | 1 Frappe | 1 Lms | 2026-10-30 | N/A |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0. | ||||
| CVE-2026-27394 | 2026-10-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | ||||