Export limit exceeded: 424331 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424331 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78153 | 1 Wordpress-extensions | 1 Restrict User Access | 2026-11-11 | 5.3 Medium |
| The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its content protection covers, allowing unauthenticated users to bypass that protection and read restricted content and enumerate users. | ||||
| CVE-2026-83533 | 1 Wordpress-extensions | 1 Wp Express Checkout | 2026-11-11 | 5.3 Medium |
| The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying. | ||||
| CVE-2026-83547 | 1 Wordpress-extensions | 1 Xpro Elementor Addons | 2026-11-11 | 6.8 Medium |
| The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2023-3360 | 1 Wordpress-extensions | 1 Weaver Show Posts | 2026-11-11 | 3.3 Low |
| The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog. | ||||
| CVE-2024-3773 | 1 Wordpress-extensions | 1 Livejournal Shortcode | 2026-11-11 | 5.9 Medium |
| The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | ||||
| CVE-2025-15481 | 1 Wordpress-extensions | 1 Notification Bar For Wordpress | 2026-11-11 | 5.3 Medium |
| The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails. | ||||
| CVE-2025-15485 | 1 Wordpress-extensions | 1 Auto X Line | 2026-11-11 | 8.2 High |
| The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc | ||||
| CVE-2025-8945 | 1 Wordpress-extensions | 1 Wp Edit Password Protected | 2026-11-11 | 5.3 Medium |
| The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API. | ||||
| CVE-2025-9314 | 1 Wordpress-extensions | 1 Developer Tools | 2026-11-11 | 9.8 Critical |
| The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component | ||||
| CVE-2026-125958 | 2026-11-11 | N/A | ||
| Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1. | ||||
| CVE-2026-125883 | 2026-11-11 | N/A | ||
| Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1. | ||||
| CVE-2026-110289 | 2026-11-11 | 5.5 Medium | ||
| A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery). | ||||
| CVE-2026-124746 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 5.5 Medium |
| A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices. | ||||
| CVE-2026-102589 | 2026-11-11 | 7.1 High | ||
| When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0. | ||||
| CVE-2026-126325 | 2026-11-11 | 9 Critical | ||
| A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | ||||
| CVE-2026-111024 | 2026-11-11 | 7.1 High | ||
| A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization). | ||||
| CVE-2026-18666 | 1 Wordpress-extensions | 1 Library Management System | 2026-11-11 | 4.3 Medium |
| The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes. | ||||
| CVE-2026-17012 | 1 Wordpress-extensions | 1 Restore Paypal Standard For Woocommerce | 2026-11-11 | 5.3 Medium |
| The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's. | ||||
| CVE-2026-123710 | 1 Redhat | 1 Quay | 2026-11-11 | 9.8 Critical |
| A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags. | ||||
| CVE-2026-17016 | 1 Wordpress-extensions | 1 Restore Paypal Standard For Woocommerce | 2026-11-11 | 3.7 Low |
| The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled. | ||||