Export limit exceeded: 385677 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385677 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77792 | 2 Registrationmagic, Wordpress | 2 Registrationmagic, Wordpress | 2026-09-02 | N/A |
| The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin. | ||||
| CVE-2026-23591 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23590 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23589 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23588 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23587 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23586 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23585 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23584 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23583 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-75411 | 1 Jeecgboot | 1 Jeecgboot | 2026-09-02 | 9.8 Critical |
| JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection. | ||||
| CVE-2026-77783 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | N/A |
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts. | ||||
| CVE-2026-77785 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | N/A |
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenced in a request before returning its content and SEO metadata, allowing users with the Author role and above to read the title, body and metadata of other users' non-public posts. | ||||
| CVE-2026-77787 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | N/A |
| The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplied object identifier across object types, allowing users with the Author role and above to modify the SEO metadata of terms they cannot edit and to overwrite the titles of posts belonging to other users. | ||||
| CVE-2026-77788 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | N/A |
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users. | ||||
| CVE-2026-80467 | 2026-09-02 | N/A | ||
| The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not restrict the role submitted through its front-end user forms to the roles the form actually offers, and its safeguard against privileged roles is incomplete, allowing unauthenticated visitors to register an account with elevated capabilities and then escalate it to administrator. | ||||
| CVE-2026-81194 | 2026-09-02 | N/A | ||
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify authorization when retrieving order line-item data, allowing any authenticated user including Subscribers to read other instructors' course sales records by supplying another user's identifier. | ||||
| CVE-2026-81195 | 2026-09-02 | N/A | ||
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning per-student course enrollment and progress data, allowing unauthenticated attackers to disclose the enrolled courses and learning progress of any registered user. | ||||
| CVE-2026-81196 | 2026-09-02 | N/A | ||
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not properly verify ownership of quiz question identifiers, allowing users with instructor access to read other instructors' quiz questions, including the correct answers and explanations. | ||||
| CVE-2026-81199 | 2026-09-02 | N/A | ||
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.46 does not perform an authorization check before returning a student's learning statistics, allowing unauthenticated attackers to disclose the course counts, points, certificates, quiz and assignment totals of any registered user. | ||||