Export limit exceeded: 377224 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377224 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28181 | 2 Acymailing Newsletter Team, Wordpress | 2 Acymailing Smtp Newsletter, Wordpress | 2026-08-13 | 6.5 Medium |
| Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions. | ||||
| CVE-2026-28184 | 2 10web, Wordpress | 2 Form Maker By 10web, Wordpress | 2026-08-13 | 8.5 High |
| Subscriber SQL Injection in Form Maker by 10Web <= 1.15.44 versions. | ||||
| CVE-2026-58507 | 2026-08-13 | N/A | ||
| Private Repository Existence Disclosure via go-get Meta Endpoint | ||||
| CVE-2026-57886 | 2026-08-13 | N/A | ||
| Cross-repository issue/comment attachment re-linking can expose private attachment content | ||||
| CVE-2026-55987 | 2026-08-13 | N/A | ||
| OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009) | ||||
| CVE-2026-55984 | 2026-08-13 | N/A | ||
| Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | ||||
| CVE-2026-55982 | 2026-08-13 | N/A | ||
| OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | ||||
| CVE-2026-59109 | 2026-08-13 | 8.8 High | ||
| SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, Dazadi.sql_txt(), is not invoked on these code paths, so a party that sends an invoice can break out of the string literal and alter the query logic. This issue affects Zalktis: before 2026.1.586 and before 2026.2.592. | ||||
| CVE-2026-17110 | 1 Ibm | 1 I | 2026-08-13 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary commands and obtain sensitive information due to improper privilege management. | ||||
| CVE-2026-17218 | 1 Ibm | 1 I | 2026-08-13 | 9.8 Critical |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. | ||||
| CVE-2026-17222 | 1 Ibm | 1 I | 2026-08-13 | 4.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-17248 | 1 Ibm | 1 I | 2026-08-13 | 7.1 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command. | ||||
| CVE-2026-73570 | 1 Zimbra | 1 Collaboration | 2026-08-13 | 8.9 High |
| A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands as the Zimbra user. | ||||
| CVE-2026-73572 | 1 Zimbra | 1 Collaboration | 2026-08-13 | 6.1 Medium |
| In Zimbra Collaboration (ZCS) before 10.1.17, a stored cross-site scripting (XSS) vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that, when previewed by a user, executes arbitrary JavaScript within the victim's browser session. Successful exploitation may allow an attacker to perform unauthorized actions on behalf of the victim user, potentially leading to data exfiltration or unauthorized access to sensitive information. | ||||
| CVE-2026-73573 | 1 Zimbra | 1 Collaboration | 2026-08-13 | 3.1 Low |
| In Zimbra Collaboration (ZCS) before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence, potentially allowing unauthorized disclosure of sensitive files within the web application directory. | ||||
| CVE-2026-61960 | 2 Themeisle, Wordpress | 2 Wp Full Stripe Free, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions. | ||||
| CVE-2026-61966 | 2 Denishua, Wordpress | 2 Wpjam Basic, Wordpress | 2026-08-13 | 9.3 Critical |
| Subscriber SQL Injection in WPJAM Basic <= 7.0.1 versions. | ||||
| CVE-2026-61974 | 2 Kitae-park, Wordpress | 2 Mang Board Wp, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. | ||||
| CVE-2026-61980 | 2 Daan.dev, Wordpress | 2 Omgf Pro, Wordpress | 2026-08-13 | 7.5 High |
| Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. | ||||
| CVE-2026-61984 | 2 Amauri, Wordpress | 2 Wpmobile.app, Wordpress | 2026-08-13 | 7.5 High |
| Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions. | ||||