Export limit exceeded: 417691 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417691 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417691 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417691 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107308 | 1 Drupal | 1 Country | 2026-10-30 | 3.1 Low |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scripting (XSS). This issue affects Country versions: from 0.0.0 to 2.1.3, from 2.2.0 to 2.2.1. | ||||
| CVE-2026-107306 | 1 Drupal | 1 Menu Link Attributes | 2026-10-30 | 3.8 Low |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0. | ||||
| CVE-2026-3322 | 1 Lobster Gmbh | 1 Lobster Pro | 2026-10-30 | N/A |
| Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other versions prior to 25.1.3. | ||||
| CVE-2026-112345 | 2 Sciener, Ttlock | 2 Ttlock App, Ttlock | 2026-10-30 | 8.1 High |
| TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded static AES key vulnerability that allows an attacker within Bluetooth range to decrypt the per-pairing session key transmitted during BLE pairing. Attackers can observe the pairing exchange, recover the persistent session key using the embedded defaultKey, and forge authenticated BLE requests to unlock the device, add fingerprints or access codes, and perform administrative actions without authentication or user interaction. | ||||
| CVE-2026-62047 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2. | ||||
| CVE-2026-62991 | 1 Shopperlabs | 1 Shopper | 2026-10-30 | 6.5 Medium |
| Shopper is a Headless e-commerce Admin Panel. Prior to 2.10.1, the customer detail route `/cpanel/customers/{user}/show` in `packages/admin/src/Livewire/Pages/Customers/Show.php` checks `read_customers` but looks up an arbitrary user ID without applying the `customers` role scope used by the listing. Authenticated staff holding `access_dashboard` and `read_customers` can change the user ID to retrieve administrator or staff profiles despite lacking `view_users`, which protects the separate team-management interface. The flaw exposes account profile data and permits user-ID enumeration through differing success, denial, and not-found responses. If the same role also holds `delete_customers`, `anonymizeAction()` operates on the unrestricted loaded user model and can enable destructive follow-up against non-customer accounts. This issue is fixed in version 2.10.1. | ||||
| CVE-2026-118573 | 1 Drupal | 1 Oauth2 Token Manager | 2026-10-30 | N/A |
| Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0. | ||||
| CVE-2026-118584 | 1 Drupal | 1 Field Permissions | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118583 | 1 Drupal | 1 Field Permissions | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118554 | 1 Drupal | 1 Openid Connect Client | 2026-10-30 | N/A |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OpenID Connect Client allows Authentication Bypass. This issue affects OpenID Connect Client versions: from 0.0.0 to 2.3.1. | ||||
| CVE-2026-118576 | 1 Drupal | 1 Stage File Proxy | 2026-10-30 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File Proxy allows Cross-Site Scripting (XSS). This issue affects Stage File Proxy versions: from 0.0.0 to 3.1.7, from 4.0.0 to 4.0.1. | ||||
| CVE-2026-118575 | 1 Drupal | 1 Signature Pad Widget | 2026-10-30 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0. | ||||
| CVE-2026-118572 | 1 Drupal | 1 Oauth Login - Oauth Oidc Sso | 2026-10-30 | N/A |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal OAuth Login - OAuth OIDC SSO allows Authentication Bypass. This issue affects OAuth Login - OAuth OIDC SSO versions: from 0.0.0 to 3.1.1. | ||||
| CVE-2026-118567 | 1 Drupal | 1 Bulk Update User Roles | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5. | ||||
| CVE-2026-118574 | 1 Drupal | 1 S3 File System | 2026-10-30 | N/A |
| Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0. | ||||
| CVE-2026-118570 | 1 Drupal | 1 Fasttoggle | 2026-10-30 | N/A |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | ||||
| CVE-2026-118569 | 1 Drupal | 1 Fasttoggle | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | ||||
| CVE-2026-118565 | 1 Drupal | 1 Groupex Pro ( Daxko ) Integration | 2026-10-30 | N/A |
| Vulnerability in Drupal GroupEx PRO ( Daxko ) integration. This issue affects GroupEx PRO ( Daxko ) integration versions: *.*. | ||||
| CVE-2026-118564 | 1 Drupal | 1 Payumoney For Drupal Commerce | 2026-10-30 | N/A |
| Vulnerability in Drupal PayUmoney for Drupal Commerce. This issue affects PayUmoney for Drupal Commerce versions: *.*. | ||||
| CVE-2026-118563 | 1 Drupal | 1 Cacheflush | 2026-10-30 | N/A |
| Vulnerability in Drupal CacheFlush. This issue affects CacheFlush versions: *.*. | ||||