Export limit exceeded: 396875 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396875 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396875 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93618 | 2026-09-23 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1. | ||||
| CVE-2026-96656 | 1 Plex | 1 Media Server | 2026-09-23 | 7.2 High |
| Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks. | ||||
| CVE-2026-95593 | 2026-09-23 | 7.6 High | ||
| Editor SQL Injection in Ultimeter <= 3.0.8 versions. | ||||
| CVE-2026-94684 | 2026-09-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Ocean Extra <= 2.6.1 versions. | ||||
| CVE-2026-94680 | 2026-09-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | ||||
| CVE-2026-94500 | 2026-09-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | ||||
| CVE-2026-94487 | 2026-09-23 | 8.1 High | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. | ||||
| CVE-2026-94461 | 2026-09-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. | ||||
| CVE-2026-94391 | 2026-09-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. | ||||
| CVE-2026-94176 | 2026-09-23 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. | ||||
| CVE-2026-94174 | 2026-09-23 | 7.6 High | ||
| Administrator SQL Injection in Email Log <= 2.63 versions. | ||||
| CVE-2026-94079 | 2026-09-23 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. | ||||
| CVE-2026-93773 | 2026-09-23 | 8.5 High | ||
| Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. | ||||
| CVE-2026-93623 | 2026-09-23 | 5.3 Medium | ||
| Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. | ||||
| CVE-2026-93622 | 2026-09-23 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. | ||||
| CVE-2026-93527 | 2026-09-23 | 8.5 High | ||
| Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. | ||||
| CVE-2026-78574 | 1 Okta | 2 Hyperdrive, Okta Hyperdrive Integration Plugin | 2026-09-23 | 7.5 High |
| The Okta Hyperdrive Integration plugin resolves a required assembly using a registry path within the current user's hive without integrity verification. The referenced path is loaded via Assembly.LoadFrom without signature validation, resulting in an unverified assembly executing within the context of the host process or elevated installer. | ||||
| CVE-2026-77420 | 2026-09-23 | 5.5 Medium | ||
| JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String line) in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java converts the HISTORY_IGNORE configuration value into a Java regular expression while escaping only part of its syntax, allowing other regex metacharacters to reach the backtracking engine. An attacker who can control application or user configuration can supply a nested-quantifier expression that is reevaluated whenever a command is added to history, consuming excessive CPU and indefinitely blocking the reader thread. This issue is fixed in versions 3.30.15 and 4.3.1. | ||||
| CVE-2026-69443 | 1 Microsoft | 6 Windows 10 1809, Windows Server 2019, Windows Server 2019 (server Core Installation) and 3 more | 2026-09-23 | 7.5 High |
| Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-77422 | 2026-09-23 | 7.5 High | ||
| JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1. | ||||