Export limit exceeded: 374374 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 27052 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (27052 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16067 | 2 Event Booking Manager For Woocommerce, Wordpress | 2 Event Booking Manager For Woocommerce (pro), Wordpress | 2026-08-07 | 5.3 Medium |
| The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost. | ||||
| CVE-2026-15152 | 2 Wordpress, Wp Hotel Booking | 2 Wordpress, Wp Hotel Booking | 2026-08-07 | 5.3 Medium |
| The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner. | ||||
| CVE-2026-14225 | 2 Easy-appointments, Wordpress | 2 Easy Appointments, Wordpress | 2026-08-07 | 2.7 Low |
| The Easy Appointments WordPress plugin through 3.12.26 does not correctly validate shortcode input in one of its block-rendering actions, checking only the first tag of the supplied string against an allowlist while rendering the entire string, allowing users with contributor-level access to execute arbitrary registered shortcodes. | ||||
| CVE-2026-50633 | 1 Apache | 1 Cxf | 2026-08-07 | 8.1 High |
| A JNDI Injection vulnerability has been discovered in Apache CXF's JCA integration module, which can allow for code execution, if an attacker is able to manipulate the JCA deployment descriptor (ra.xml) or runtime activation parameters. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue. | ||||
| CVE-2026-50632 | 1 Apache | 1 Cxf | 2026-08-07 | 8.1 High |
| A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue. | ||||
| CVE-2026-50628 | 1 Apache | 1 Cxf | 2026-08-07 | 9.8 Critical |
| A logic error in OAuthRequestFilter rejects legitimate requests originating from the bound IP address, while blindly allowing requests from any other IP address. Enabling this security feature inadvertently creates an inverse security check. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue. | ||||
| CVE-2026-54217 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-08-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application is vulnerable to a stored XSS vulnerability. An attacker can send an email containing malicious JavaScript code. When a user accesses the email, the stored cross-site scripting is triggered. This issue affects TeamDavid through Rollout 524. | ||||
| CVE-2026-56184 | 1 Microsoft | 13 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 10 more | 2026-08-07 | 5.5 Medium |
| Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-52102 | 1 Openmediavault | 1 Openmediavault | 2026-08-07 | N/A |
| An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commands as root via injecting shell metacharacters. | ||||
| CVE-2026-15230 | 2 Wordpress, Yaycommerce | 2 Wordpress, Yaypricing | 2026-08-07 | 8.1 High |
| The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes. | ||||
| CVE-2026-57095 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 6.2 Medium |
| Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-60023 | 1 Apache | 1 Answer | 2026-08-07 | 7.5 High |
| Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||
| CVE-2026-20303 | 1 Cisco | 2 Catalyst Sd-wan Manager, Cisco Catalyst Sd-wan Controller | 2026-08-07 | 9.9 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20303 are related to improper input validation issues that are grouped under the Common Weakness Enumeration (CWE) CWE-20. | ||||
| CVE-2026-70437 | 1 Jenkins Project | 1 Jenkins Webhook Secret Credentials Provider Plugin | 2026-08-07 | 3.7 Low |
| Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token. | ||||
| CVE-2024-10302 | 1 Wso2 | 8 Wso2 Api Control Plane, Wso2 Api Manager, Wso2 Carbon Identity Recovery Management and 5 more | 2026-08-07 | 4 Medium |
| The user self-signup flow in multiple WSO2 products fails to adequately validate user-supplied input. This weakness allows arbitrary unvalidated data to be included within user claims, which are then used by downstream processes. Allowing unvalidated input into user claims can lead to various security risks. Malicious or malformed data injected during signup could be processed by other parts of the application, potentially enabling attacks such as content manipulation, redirection, user interface inconsistencies, unauthorized actions, and data exposure. The actual impact depends on how the compromised data is consumed and the privileges associated with the affected users. | ||||
| CVE-2026-16316 | 2 Omicron Electronics, Omicron Electronics Gmbh | 2 Omicron Stationguard, Omicron Stationguard | 2026-08-07 | 4.3 Medium |
| OMICRON StationGuard 4.00 contains an improper input validation vulnerability in its IEC 61850 Sampled Values (SV) frame processing. A specially crafted SV frame can cause the affected process to terminate, disrupting alert processing for Sampled Values traffic. The vulnerability does not affect overall system availability or the processing of other traffic types, and the process is automatically restarted, and the failure is immediately reported to the user. | ||||
| CVE-2026-16731 | 2 Omicron Electronics, Omicron Electronics Gmbh | 2 Omicron Stationscout, Omicron Stationscout | 2026-08-07 | N/A |
| OMICRON StationScout before version 3.05 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate clients. An attacker can gain full access to the system configuration, allowing modification, reset, or unauthorized alteration of system parameters or injecting network traffic into the connected network. | ||||
| CVE-2026-54489 | 1 Dell | 1 Virtual Storage Integrator For Vmware Vsphere Client | 2026-08-07 | 9.1 Critical |
| Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session credentials and fully impersonate authenticated users, including administrators. Dell recommends customers to upgrade at the earliest opportunity. | ||||
| CVE-2026-65543 | 2 Vimeodev, Wordpress | 2 Vimeo, Wordpress | 2026-08-07 | 7.5 High |
| Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | ||||
| CVE-2026-66683 | 2 Wordpress, Wp Zone | 2 Wordpress, Custom Css And Javascript | 2026-08-07 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. | ||||