Search
Search Results (424109 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-13809 | 1 Orionsec | 2 Orion-ops, Orion Ops | 2026-09-30 | 6.3 Medium |
| A vulnerability has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this issue is some unknown functionality of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineInfoController.java of the component SSH Connection Handler. Such manipulation of the argument host/sshPort/username/password/authType leads to server-side request forgery. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. A patch should be applied to remediate this issue. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-62540 | 1 Oracle | 2 Cost Management, E-business Suite | 2026-09-30 | 7.2 High |
| Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-97301 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | ||||
| CVE-2026-97299 | 2026-09-30 | 5.4 Medium | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. | ||||
| CVE-2026-97293 | 2026-09-30 | 8.5 High | ||
| Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. | ||||
| CVE-2026-97292 | 2026-09-30 | 6.5 Medium | ||
| Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. | ||||
| CVE-2026-97270 | 2026-09-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. | ||||
| CVE-2026-97267 | 2026-09-30 | 4.3 Medium | ||
| Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. | ||||
| CVE-2026-97266 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. | ||||
| CVE-2026-97262 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. | ||||
| CVE-2026-97261 | 2026-09-30 | 5.3 Medium | ||
| Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. | ||||
| CVE-2026-97253 | 2026-09-30 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0. | ||||
| CVE-2026-97249 | 2026-09-30 | 5.3 Medium | ||
| Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions. | ||||
| CVE-2026-97248 | 2026-09-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. | ||||
| CVE-2026-97247 | 2026-09-30 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. | ||||
| CVE-2026-97245 | 2026-09-30 | 7.2 High | ||
| Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. | ||||
| CVE-2026-97244 | 2026-09-30 | 7.5 High | ||
| Contributor Path Traversal in Creator LMS <= 1.2.19 versions. | ||||
| CVE-2026-97243 | 2026-09-30 | 5.4 Medium | ||
| Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions. | ||||
| CVE-2026-97242 | 2026-09-30 | 6.8 Medium | ||
| Author Arbitrary File Deletion in WEBO MCP <= 3.0.18 versions. | ||||
| CVE-2026-97241 | 2026-09-30 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. | ||||