Export limit exceeded: 46005 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46005 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112353 | 1 Gfi | 1 Kerio Connect | 2026-10-30 | 8.2 High |
| GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer. | ||||
| CVE-2026-118668 | 1 Langchain-ai | 1 Langgraph-api | 2026-10-30 | N/A |
| langgraph-api implements the LangGraph API for rapid development and testing. From 0.1.2 until 0.15.0, JavaScript or TypeScript custom authentication Store authorization handlers can return a rewritten namespace that is not carried across the runtime boundary and applied before the Store operation. An authenticated user can therefore access another user's Store namespace when a deployment relies on namespace rewriting for isolation, allowing unauthorized reads, overwrites, searches, or deletions. Python custom authentication and handlers that reject unauthorized namespaces instead of rewriting them are not affected. This issue is fixed in version 0.15.0. | ||||
| CVE-2026-118669 | 1 Oauthlib | 1 Oauthlib | 2026-10-30 | 8.1 High |
| OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. Prior to 4.0.0, the client_credentials and Resource Owner Password Credentials token grant handlers can authenticate request.client as one confidential client while retaining an attacker-supplied request.client_id for validate_grant_type and validate_scopes. A lower-privilege authenticated client can therefore cause grant and scope authorization to use another client's identity when an application validator relies on the documented client_id argument, potentially issuing tokens with unauthorized grants or scopes. Validators that authorize exclusively from request.client may not be affected. This issue is fixed in version 4.0.0. | ||||
| CVE-2026-118804 | 2 Bricks, Wordpress-extensions | 2 Bricks Builder, Bricks Builder | 2026-10-30 | 7.5 High |
| Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes. | ||||
| CVE-2026-115302 | 1 Wordpress-extensions | 1 Contact Form By Supsystic | 2026-10-30 | 5.3 Medium |
| The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics records, allowing unauthenticated attackers to delete arbitrary statistics entries. | ||||
| CVE-2026-89216 | 1 Wordpress-extensions | 1 Vtables | 2026-10-30 | 8.6 High |
| The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows unauthenticated attackers to perform SQL injection attacks and extract data from the database. | ||||
| CVE-2026-110030 | 1 Wordpress-extensions | 1 Hide Price Until Login | 2026-10-30 | 5.3 Medium |
| The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not honour the site's user-registration setting, allowing anyone to create a WordPress account and obtain a logged-in session even when registration is disabled. | ||||
| CVE-2026-114488 | 2 Redhat, Wildfly | 8 Fuse 7, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 5 more | 2026-10-30 | 7.4 High |
| A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB. | ||||
| CVE-2026-115965 | 2 Buddypress, Wordpress-extensions | 2 Buddypress, Buddypress | 2026-10-30 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2. | ||||
| CVE-2026-114193 | 2 Eyal Fitoussi, Wordpress-extensions | 2 Geo My Wordpress, Geo My Wordpress | 2026-10-30 | 7.5 High |
| Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5. | ||||
| CVE-2026-93010 | 3 Dnsmasq, Red Hat, Redhat | 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more | 2026-10-30 | 4.3 Medium |
| A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostnames, and related lease metadata. The feature is off unless an administrator turns it on. | ||||
| CVE-2026-119200 | 1 Nuxt | 2 Nuxt, Nuxt/nitro-server | 2026-10-30 | 6.5 Medium |
| Nuxt is an open-source web development framework for Vue.js. From 4.6.0 until 4.6.3, Nuxt resolves literal or percent-encoded dot segments before rendering a page while Nitro routing, server/middleware checks, and server route rules evaluate the unresolved path. A request such as /%2e/admin can therefore render app/pages/admin.vue and its server-rendered data while checks keyed to /admin, redirects, or per-route security headers do not apply. API handlers, appMiddleware, Nuxt 3, and Nuxt 4.0.0 through 4.5.x are not affected, and exploitation requires a client that sends dot segments without browser normalization. This issue is fixed in version 4.6.3. | ||||
| CVE-2026-119282 | 1 Nrwl | 3 Gradle, Maven, Nx | 2026-10-30 | N/A |
| Nx is a monorepo solution for TypeScript and polyglot codebases. From 22.0.2 until 22.7.9 and 23.1.2 for @nx/maven, and from 21.0.0 until 22.7.9 and 23.1.2 for @nx/gradle, the plugins' project-graph analyzers launch through a shell and interpolate plugin options from nx.json into command arguments. The @nx/maven targetNamePrefix value and arbitrary @nx/gradle option names or values can therefore be interpreted as shell syntax whenever an nx command constructs the project graph. A user who runs Nx in an attacker-controlled repository or pull request can execute injected commands with the user's privileges, while workspaces that register neither affected plugin are not exposed to this path. Remediation requires upgrading both nx and each affected plugin to matching releases because the plugin fix depends on code in the nx package. This issue is fixed in versions 22.7.9 and 23.1.2. | ||||
| CVE-2026-63115 | 1 Tryghost | 1 Activitypub | 2026-10-30 | 5.3 Medium |
| ActivityPub is a multi-tenant ActivityPub server for Ghost, built with Fedify. From 1.0.0 until 1.2.6, the `Undo` handler allows a remote federated server to cause the service to act on a `follow` or `repost` as though the activity came from a different account. This permits removal of an existing `follow` relationship or `repost` belonging to another account without that account's involvement. No private data is exposed and content is not modified; the affected relationships can be re-established. Services proxying to Ghost's hosted ActivityPub server have already been updated, while self-hosted services require an updated image and redeployment. This issue is fixed in version 1.2.6. | ||||
| CVE-2026-62047 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-10-30 | 4.3 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.2. | ||||
| CVE-2026-118573 | 1 Drupal | 1 Oauth2 Token Manager | 2026-10-30 | N/A |
| Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0. | ||||
| CVE-2026-118584 | 1 Drupal | 1 Field Permissions | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118583 | 1 Drupal | 1 Field Permissions | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118567 | 1 Drupal | 1 Bulk Update User Roles | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Bulk Update User Roles allows Forceful Browsing. This issue affects Bulk Update User Roles versions: from 0.0.0 to 1.0.5. | ||||
| CVE-2026-118569 | 1 Drupal | 1 Fasttoggle | 2026-10-30 | N/A |
| Incorrect Authorization vulnerability in Drupal Fasttoggle allows Forceful Browsing. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | ||||