Export limit exceeded: 385330 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 36263 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385330 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385330 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-80488 | 2 Wordpress, Wp Ultimate Csv Importer Project | 2 Wordpress, Wp Ultimate Csv Importer | 2026-09-01 | 4.1 Medium |
| The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks. | ||||
| CVE-2026-81346 | 2 Dynamiapps, Wordpress | 2 Frontend Admin By Dynamiapps, Wordpress | 2026-09-01 | 4.3 Medium |
| The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans. | ||||
| CVE-2026-14835 | 2 Sogo, Wordpress | 2 Sogo Add Script To Individual Pages Header Footer, Wordpress | 2026-09-01 | 6.8 Medium |
| The SOGO Add Script to Individual Pages Header Footer WordPress plugin through 3.9 does not sanitise or escape the custom header/footer script values saved from its post metabox, and does not restrict them to users with the unfiltered_html capability, allowing users with contributor-level access and above to store JavaScript that executes in the browser of any administrator who reviews the post and of any visitor once the post is published. | ||||
| CVE-2026-14307 | 2 Geotargetingwp Project, Wordpress | 2 Geotargetingwp, Wordpress | 2026-09-01 | 7.1 High |
| The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request. | ||||
| CVE-2026-51153 | 1 Qd | 1 Qd | 2026-09-01 | N/A |
| Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from new_env.variables.__log__, which is attacker-controlled via the template extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context. | ||||
| CVE-2025-63607 | 1 Nooncarlett | 1 Techstore | 2026-09-01 | N/A |
| TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser. | ||||
| CVE-2026-79407 | 1 Metagpt | 1 Metagpt | 2026-09-01 | 7.5 High |
| A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE_NAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory. | ||||
| CVE-2026-79408 | 1 Metagpt | 1 Metagpt | 2026-09-01 | N/A |
| An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py. | ||||
| CVE-2026-75458 | 1 Xuezhisi | 1 Open Source Exam System | 2026-09-01 | N/A |
| The teacher-end interface POST /api/teacher/user/delete/{id} in XueZhiSi Open Source Exam System <= 3.9.0 contains a vertical privilege escalatio vulnerability. This interface accepts a user ID and then executes getUserById(id), setDeleted(true), updateByIdFilter() in sequence, without any validation of whether the current user has the authority to delete the target user. An authenticated teacher user (role=2) can delete an administrator account (role=3), constituting a vertical privilege escalation where a lower-privileged user performs a high-privileged operation. | ||||
| CVE-2026-75460 | 1 Xuezhisi | 1 Open Source Exam System | 2026-09-01 | N/A |
| XueZhiSi Open Source Exam System <= 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester. | ||||
| CVE-2026-81887 | 1 Livewire | 1 Livewire | 2026-09-01 | N/A |
| Livewire is a full-stack framework for Laravel. From 3.0.0-beta.1 until 3.8.3 and 4.3.4, the dot-notated query-string parser in js/plugins/history/index.js, including fromQueryString() and insertDotNotatedValueIntoData(), accepts the __proto__, constructor, and prototype path segments and creates inherited objects. Client-side state handlers then access effects.html, effects.js, effects.xjs, and effects.scripts without Object.prototype.hasOwnProperty.call(), allowing inherited attacker-controlled state to be treated as trusted effects. An unauthenticated attacker can craft a URL that, when opened by a user, executes arbitrary JavaScript in the affected application's origin. Exploitation requires user interaction and does not bypass server-side authorization or grant privileges beyond the affected user. This issue is fixed in versions 3.8.3 and 4.3.4. | ||||
| CVE-2026-81888 | 1 Honojs | 1 @hono/oauth-providers | 2026-09-01 | 5.4 Medium |
| @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch. | ||||
| CVE-2026-81280 | 2 Ukr Solution, Wordpress | 2 Print Barcode Labels For Your Woocommerce Products/orders, Wordpress | 2026-09-01 | 6.5 Medium |
| Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. | ||||
| CVE-2026-81758 | 2 Ownerrez, Wordpress | 2 Ownerrez Api, Wordpress | 2026-09-01 | 6.3 Medium |
| Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. | ||||
| CVE-2026-81763 | 2 Wordpress, ウェブ屋のさとーさん | 2 Wordpress, Throws Spam Away | 2026-09-01 | 9.3 Critical |
| Unauthenticated SQL Injection in Throws SPAM Away <= 3.8.2 versions. | ||||
| CVE-2026-81765 | 2 Tailored Media, Wordpress | 2 Tailored Tools, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. | ||||
| CVE-2026-82346 | 1 Hp Inc | 1 Hp Imagediags | 2026-09-01 | N/A |
| A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls. | ||||
| CVE-2026-84125 | 1 Mozilla | 1 Firefox | 2026-09-01 | N/A |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. | ||||
| CVE-2026-72642 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | 8.8 High |
| The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process. | ||||
| CVE-2026-19796 | 2 Webilia, Wordpress | 2 Listdom: Ai-powered Business Directory With Classifieds Ads Listings, Wordpress | 2026-09-01 | 7.2 High |
| The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations. | ||||