Export limit exceeded: 424401 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424401 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424401 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 30155 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424401 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-15485 | 1 Wordpress-extensions | 1 Auto X Line | 2026-11-11 | 8.2 High |
| The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc | ||||
| CVE-2025-8945 | 1 Wordpress-extensions | 1 Wp Edit Password Protected | 2026-11-11 | 5.3 Medium |
| The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using the REST API. | ||||
| CVE-2025-9314 | 1 Wordpress-extensions | 1 Developer Tools | 2026-11-11 | 9.8 Critical |
| The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload component | ||||
| CVE-2026-125958 | 2026-11-11 | N/A | ||
| Download of code without integrity check vulnerability in N-able N-central allows Remote Code Inclusion. This issue affects N-central: through 24.6.1. | ||||
| CVE-2026-125883 | 2026-11-11 | N/A | ||
| Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1. | ||||
| CVE-2026-110289 | 2026-11-11 | 5.5 Medium | ||
| A user with the Organization Admin role could point the server or token URL of a Git Sync connection at a loopback or internal address, and Grafana would then send the connection's OAuth client secret and tokens, or requests signed with the GitHub App private key, to that address (server-side request forgery). | ||||
| CVE-2026-124746 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 5.5 Medium |
| A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices. | ||||
| CVE-2026-102589 | 2026-11-11 | 7.1 High | ||
| When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0. | ||||
| CVE-2026-126325 | 2026-11-11 | 9 Critical | ||
| A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | ||||
| CVE-2026-111024 | 2026-11-11 | 7.1 High | ||
| A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization). | ||||
| CVE-2026-18666 | 1 Wordpress-extensions | 1 Library Management System | 2026-11-11 | 4.3 Medium |
| The Library Management System WordPress plugin before 3.6.7 does not sanitize and escape a user-supplied parameter before using it in a SQL statement, allowing users with a role as low as Subscriber to perform SQL injection and extract arbitrary data from the database, including user password hashes. | ||||
| CVE-2026-17012 | 1 Wordpress-extensions | 1 Restore Paypal Standard For Woocommerce | 2026-11-11 | 5.3 Medium |
| The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not verify that the PayPal account which received a payment matches the merchant's configured account before marking the order as paid, allowing unauthenticated buyers to complete a WooCommerce order by paying the full amount to their own PayPal account instead of the merchant's. | ||||
| CVE-2026-123710 | 1 Redhat | 1 Quay | 2026-11-11 | 9.8 Critical |
| A flaw was found in Red Hat Quay. An unauthenticated client can obtain an anonymous registry token with an audience it controls, present that token to the service key rotation endpoint, and install its own approved signing key with no expiry. Registry tokens signed with that key are accepted for any repository, allowing read and write access to private images and replacement of repository tags. | ||||
| CVE-2026-17016 | 1 Wordpress-extensions | 1 Restore Paypal Standard For Woocommerce | 2026-11-11 | 3.7 Low |
| The Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin through 3.1.0 does not validate the amount actually paid against the order total in its PayPal Data Transfer return handler, allowing a customer to pay less than the order total and still have the order marked as fully paid when the PayPal Data Transfer feature is enabled. | ||||
| CVE-2026-17010 | 1 Wordpress-extensions | 1 Saitama Addon Pack | 2026-11-11 | 5.4 Medium |
| The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who reviews the content. | ||||
| CVE-2026-111000 | 2026-11-11 | 7.1 High | ||
| A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they administer, and so gain Admin on the moved folder and its contents, including the right to change their permissions. The legacy folder move API refuses the same move (improper privilege management). | ||||
| CVE-2026-17018 | 1 Wordpress-extensions | 1 Cubewp Framework | 2026-11-11 | 4.9 Medium |
| The CubeWP Framework WordPress plugin through 1.1.30 does not perform a per-object read authorization check, nor restrict which metadata keys may be requested, on one of its REST API endpoints, allowing users with the Contributor role and above to read arbitrary post metadata (including that of other users' draft, pending, private, and password-protected posts) and arbitrary user metadata of any user, including administrators. | ||||
| CVE-2026-13600 | 1 Wordpress-extensions | 1 Autonettv Relay | 2026-11-11 | 8.1 High |
| The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials. | ||||
| CVE-2026-13701 | 1 Wordpress-extensions | 1 Advanced Excerpt | 2026-11-11 | 4.8 Medium |
| The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages. | ||||
| CVE-2026-14206 | 1 Wordpress-extensions | 1 Ht Contact Form | 2026-11-11 | 7.5 High |
| The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts. | ||||