Export limit exceeded: 396954 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396954 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-95603 | 2026-09-23 | 7.2 High | ||
| Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. | ||||
| CVE-2026-95600 | 2026-09-23 | 5.3 Medium | ||
| Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. | ||||
| CVE-2026-95592 | 2026-09-23 | 5.3 Medium | ||
| Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. | ||||
| CVE-2026-95530 | 2026-09-23 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. | ||||
| CVE-2026-95528 | 2026-09-23 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. | ||||
| CVE-2026-94457 | 2026-09-23 | 4.8 Medium | ||
| Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | ||||
| CVE-2026-94181 | 2026-09-23 | 7.4 High | ||
| An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification. | ||||
| CVE-2026-94168 | 2 Leap13, Wordpress | 2 Premium Addons For Elementor, Wordpress | 2026-09-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | ||||
| CVE-2026-94118 | 2026-09-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | ||||
| CVE-2026-93709 | 2026-09-23 | 5.3 Medium | ||
| Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts. | ||||
| CVE-2026-93620 | 2026-09-23 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. | ||||
| CVE-2026-93529 | 2026-09-23 | 6.5 Medium | ||
| Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. | ||||
| CVE-2026-92730 | 1 Limesurvey | 1 Limesurvey | 2026-09-23 | N/A |
| LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page. | ||||
| CVE-2026-92708 | 1 Svelte | 1 Devalue | 2026-09-23 | 7.5 High |
| Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3. | ||||
| CVE-2026-92692 | 1 Sulu | 1 Sulu | 2026-09-23 | N/A |
| Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8. | ||||
| CVE-2026-90900 | 1 Joomshaper.com | 1 Easy Store Extension For Joomla | 2026-09-23 | N/A |
| Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint (index.php?option=com_easystore&task=product.addReview) accepted submissions without verifying an anti-CSRF token (the check had been commented out in code). An attacker could trick a logged-in user into posting unauthorized reviews or submitting review spam via cross-site requests. Resolved by enforcing Session::checkToken('request') / Session::checkToken('post') in ProductController, injecting HTMLHelper::_('form.token') into the review form template, and appending the session token to the submission payload in review-form.js. | ||||
| CVE-2026-88839 | 1 Redhat | 1 Hummingbird | 2026-09-23 | 6.7 Medium |
| BusyBox passwd/group tokenize() references a stale endpoint pointer after trimming, causing an out-of-bounds write of heap pointers. | ||||
| CVE-2026-88830 | 2 Busybox, Redhat | 2 Busybox, Hummingbird | 2026-09-23 | 7.5 High |
| A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a crafted ClientKeyExchange message. | ||||
| CVE-2026-85055 | 1 Twenty | 1 Twenty | 2026-09-23 | N/A |
| Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on selected output fields but not on GraphQL or REST filter predicates. A workspace member or API key with permission to read an object but not a particular field can reference that denied field in direct filters, relation filters, or persisted view filters. The resulting totalCount and row presence reveal whether guesses match the real column, forming a boolean/count oracle that can reconstruct denied field values for records exposed by the principal's row-level policy. This issue is fixed in version 2.22.0. | ||||
| CVE-2026-82356 | 2026-09-23 | N/A | ||
| Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key pair indefinitely for certificate generation is against best practices. | ||||