Export limit exceeded: 386212 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 386212 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 386212 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386212 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19453 | 2 Jetbackup, Wordpress | 2 Jetbackup, Wordpress | 2026-09-02 | 7.1 High |
| The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migration before granting it administrator privileges, allowing a subscriber-level user to gain administrator access after the site owner restores or migrates the site. | ||||
| CVE-2026-77783 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | 3.7 Low |
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewable, allowing unauthenticated visitors to disclose the schema and associated content of draft, pending, private, scheduled and password-protected posts. | ||||
| CVE-2026-77784 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | 2.7 Low |
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating its SEO indexing metadata, allowing users with the Author role and above to alter that metadata on content, taxonomy terms and user profiles they do not own, and to remove other users' content from the site's sitemap and search engine index. | ||||
| CVE-2026-77788 | 2 Rank Math Seo, Wordpress | 2 Rank Math Seo, Wordpress | 2026-09-02 | 4.9 Medium |
| The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was authorised against, allowing users with the Author role and above to overwrite arbitrary post and user metadata, including that belonging to higher-privileged users. | ||||
| CVE-2026-79621 | 2026-09-02 | 4.3 Medium | ||
| The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which is delivered when an unrelated visitor later submits a product enquiry. | ||||
| CVE-2026-81427 | 2026-09-02 | 4.3 Medium | ||
| The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email. | ||||
| CVE-2026-69248 | 1 Pyca | 1 Cryptography | 2026-09-02 | N/A |
| cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0. | ||||
| CVE-2026-81717 | 1 Jahlives | 1 Openssl Encrypt | 2026-09-02 | 3.5 Low |
| openssl_encrypt (pip package openssl-encrypt) before 1.4.9 contains two weaknesses in the portable USB drive feature, whose threat model treats the removable drive as untrusted (attacker with physical write access). USBDriveCreator._verify_integrity_file only validates files listed in the manifest, so files added to the drive — including a root-level autorun payload — are not detected and integrity verification still passes. Additionally, a globally constant, source-embedded KDF salt (_LEGACY_FIXED_SALT) is used to derive the drive encryption key for any drive lacking a per-drive salt file, defeating precomputation resistance and enabling an offline rainbow-table attack. | ||||
| CVE-2026-9277 | 1 Ljharb | 1 Shell-quote | 2026-09-02 | 8.1 High |
| shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`. | ||||
| CVE-2026-84807 | 1 Kimai | 1 Kimai | 2026-09-02 | 5.4 Medium |
| Kimai (kimai/kimai) through 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity whose name matches an existing team; because the endpoints POST /api/customers/{id}/team, POST /api/projects/{id}/team, and POST /api/activities/{id}/team reuse an existing team of the same name and add the current user as teamlead without verifying that the user is authorized to manage that team, the attacker gains unauthorized team-lead (administration) rights over the existing team. Fixed in 2.65.0. | ||||
| CVE-2026-84802 | 1 Craftcms | 1 Craft Cms | 2026-09-02 | 4.3 Medium |
| Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the assets/move-info endpoint with arbitrary folderIds to retrieve asset count and total storage size for volumes they cannot access. | ||||
| CVE-2026-84797 | 1 Craftcms | 1 Craft Cms | 2026-09-02 | 6.3 Medium |
| Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit the deleteProvisionalDraft parameter to delete another user's unsaved draft without proper authorization checks, gaining access to the victim's in-progress content. | ||||
| CVE-2026-84792 | 1 Craftcms | 1 Craft Cms | 2026-09-02 | 4.3 Medium |
| Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users to move entries into sections they cannot edit. Attackers with limited section permissions can relocate or publish entries to unauthorized sections by overwriting the sectionId attribute after initial authorization checks, bypassing the destination section permission validation. | ||||
| CVE-2026-84775 | 2 Really-simple-plugins, Wordpress | 2 Really Simple Ssl, Wordpress | 2026-09-02 | 5.3 Medium |
| Unauthenticated Denial of Service Attack in Really Simple SSL <= 9.8.0 versions. | ||||
| CVE-2026-84760 | 2 Wordpress, Wpswings | 2 Wordpress, Ultimate Gift Cards For Woocommerce | 2026-09-02 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions. | ||||
| CVE-2026-84442 | 1 Mapquest | 1 Get Directions App | 2026-09-02 | 4.4 Medium |
| A vulnerability was identified in MapQuest Get Directions App 10.16.1 on Android. This vulnerability affects the function getDataColumn of the file ExpoShareIntentModule.kt of the component com.mapquest.android.ace. The manipulation leads to path traversal. An attack has to be approached locally. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84368 | 1 Hapijs | 1 Joi | 2026-09-02 | 3.7 Low |
| joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available. | ||||
| CVE-2026-81283 | 2 Wedevs, Wordpress | 2 Wp User Frontend, Wordpress | 2026-09-02 | 8.8 High |
| Subscriber PHP Object Injection in WP User Frontend <= 4.3.10 versions. | ||||
| CVE-2026-76851 | 1 Github | 1 Enterprise Server | 2026-09-02 | N/A |
| A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed remote code execution on the instance. Insufficient network isolation allowed malicious pre-receive hook code to impersonate an internal service and redirect trusted internal requests to a privileged service, leading to elevated code execution. Exploitation required pre-receive hook networking to be enabled and either site administrator privileges or write access to a repository containing a configured pre-receive hook. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.22 and was fixed in versions 3.17.20, 3.18.14, 3.19.11, 3.20.7, and 3.21.5. This vulnerability was reported via the GitHub Bug Bounty program. | ||||
| CVE-2026-75528 | 2 Wordpress, Wpmudev | 2 Wordpress, Broken Link Checker | 2026-09-02 | 7.2 High |
| The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log. | ||||