Export limit exceeded: 105073 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (105073 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75482 | 1 Swe-agent | 1 Swe-agent | 2026-08-21 | 7.5 High |
| SWE-agent's trajectory inspector (sweagent inspector), confirmed in v1.1.0, is an HTTP server that joins request paths to the trajectory directory in its /trajectory/ handler without rejecting parent-directory ('..') references, bypassing the built-in path sanitization. The server binds all interfaces (0.0.0.0), applies wildcard CORS, and requires no authentication. An unauthenticated network client (or a malicious web page via CORS) can use path traversal sequences to read files outside the intended directory. Because the read sink parses targets as trajectory JSON, disclosure is constrained to JSON files shaped like a trajectory, which can contain repository contents, command output, and secrets/API keys. | ||||
| CVE-2026-11801 | 2 Gwin, Wordpress | 2 Wpadverts – Classifieds Plugin, Wordpress | 2026-08-21 | 7.5 High |
| The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve internal site configuration data exposed by the classifieds-types REST endpoint, including registered post types, labels, associated taxonomies, form scheme metadata, contact options, and custom field meta keys. | ||||
| CVE-2026-75091 | 2 Mdmag, Wordpress | 2 Quill Forms | Conversational Multi Step Forms, Surveys & Quizzes, Wordpress | 2026-08-21 | 7.2 High |
| The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-15585 | 1 Akin | 1 Akinsoft Wolvox9 Erp / Kontrolpanel.exe | 2026-08-21 | 7.5 High |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd. AKINSOFT Wolvox9 ERP / KontrolPanel.exe allows Path Traversal. This issue affects AKINSOFT Wolvox9 ERP / KontrolPanel.exe: from s26.02.17 before 26.02.22. | ||||
| CVE-2026-50575 | 1 Unitronix | 1 Betterdesk | 2026-08-21 | 7.7 High |
| BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available. | ||||
| CVE-2026-28567 | 2 Fahad Mahmood, Wordpress | 2 Wp Sort Order, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | ||||
| CVE-2026-28570 | 2 Spabrice, Wordpress | 2 Vavo Core, Wordpress | 2026-08-21 | 8.1 High |
| Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions. | ||||
| CVE-2026-32464 | 2 Vladimir Prelovac, Wordpress | 2 Theme Test Drive, Wordpress | 2026-08-21 | 8.1 High |
| Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions. | ||||
| CVE-2026-32466 | 2 Wordpress, Wpexperts | 2 Wordpress, Gravity Forms Bookings Premium | 2026-08-21 | 8.5 High |
| Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions. | ||||
| CVE-2026-32472 | 2 Wbolt.com, Wordpress | 2 Online Contact Widget, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions. | ||||
| CVE-2026-32473 | 2 Deknows, Wordpress | 2 Pdf Smart Viewer For Elementor, Wordpress | 2026-08-21 | 7.2 High |
| Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions. | ||||
| CVE-2026-66620 | 2 Derek Herman, Wordpress | 2 Optiontree, Wordpress | 2026-08-21 | 7.2 High |
| Editor PHP Object Injection in OptionTree <= 2.7.3 versions. | ||||
| CVE-2026-66633 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Forms Pro Add On Pack | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions. | ||||
| CVE-2026-68567 | 2 Wordpress, Wp Grids | 2 Wordpress, Convert Pro | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions. | ||||
| CVE-2026-73181 | 2 Themecomplete, Wordpress | 2 Extra Product Options & Add-ons For Woocommerce, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions. | ||||
| CVE-2026-73338 | 2 Autopay, Wordpress | 2 Autopay, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions. | ||||
| CVE-2026-73342 | 2 Magazine3, Wordpress | 2 Wp Multilang, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions. | ||||
| CVE-2026-73375 | 2 Supsystic, Wordpress | 2 Ultimate Maps By Supsystic, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. | ||||
| CVE-2026-73377 | 2 Supsystic, Wordpress | 2 Ultimate Maps By Supsystic, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | ||||
| CVE-2026-73994 | 2 Syed Balkhi, Wordpress | 2 Charitable, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | ||||