Export limit exceeded: 377269 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377269 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66463 | 2 Hassan Fakih, Wordpress | 2 Icarry, Wordpress | 2026-08-14 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. | ||||
| CVE-2026-66464 | 2 Toast Plugins, Wordpress | 2 Internal Link Optimiser, Wordpress | 2026-08-14 | 6.5 Medium |
| Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. | ||||
| CVE-2026-66465 | 2 Agnihd, Wordpress | 2 Cartify, Wordpress | 2026-08-14 | 9.8 Critical |
| Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | ||||
| CVE-2026-66466 | 2 Wedevs, Wordpress | 2 Storegrowth: Smart Sales Booster For Woocommerce | Bogo, Upsells, Direct Checkout, Quick View, Side Cart, Wordpress | 2026-08-14 | 7.5 High |
| Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions. | ||||
| CVE-2026-66468 | 2 Powerfulwp, Wordpress | 2 Local Delivery Drivers For Woocommerce, Wordpress | 2026-08-14 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions. | ||||
| CVE-2026-66469 | 2 Afonso Matos, Wordpress | 2 Arvow Ai Seo Writer, Wordpress | 2026-08-14 | 7.5 High |
| Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | ||||
| CVE-2026-66654 | 2 Tangiblewp, Wordpress | 2 Vehica Core, Wordpress | 2026-08-14 | 6 Medium |
| Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions. | ||||
| CVE-2026-66661 | 2 Onokazu, Wordpress | 2 Directories Pro, Wordpress | 2026-08-14 | 7.7 High |
| Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. | ||||
| CVE-2026-66691 | 2 Scriptsbundle, Wordpress | 2 Nokri, Wordpress | 2026-08-14 | 9.8 Critical |
| Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | ||||
| CVE-2026-16101 | 1 Silabs.com | 1 Wiseconnect | 2026-08-14 | 8.8 High |
| Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below | ||||
| CVE-2026-19291 | 1 Silabs.com | 1 Wiseconnect | 2026-08-14 | 8.8 High |
| Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below. | ||||
| CVE-2026-19292 | 1 Silabs.com | 1 Wiseconnect | 2026-08-14 | 8.8 High |
| Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below. | ||||
| CVE-2026-19293 | 1 Silabs.com | 1 Wiseconnect | 2026-08-14 | 8.8 High |
| SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below. | ||||
| CVE-2026-65932 | 1 Silabs.com | 1 Bt122 | 2026-08-14 | N/A |
| The BT122 module stops advertising after receiving a plaintext 'pause enceryption response' message resulting in a denial of service. See vulnerability B-E2 in the related paper below. | ||||
| CVE-2026-73505 | 1 Jandedobbeleer | 1 Oh-my-posh | 2026-08-14 | 7.8 High |
| Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, the setStyle() function in src/segments/path.go passed pt.Path, which includes raw folder names, to template.Render, whose function map exposes cmd, so an attacker-controlled directory name containing a Go template expression could execute arbitrary operating system commands as the current user whenever the prompt rendered inside that directory or a descendant. This issue is fixed in version 29.35.1. | ||||
| CVE-2026-65933 | 1 Silabs.com | 1 Bt122 | 2026-08-14 | N/A |
| A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below. | ||||
| CVE-2026-65934 | 1 Silabs.com | 1 Bt122 | 2026-08-14 | N/A |
| An unencrypted 'pause encryption request' message causes a denial of service in the BT122 module. See vulnerability B-E10 in the related paper below. | ||||
| CVE-2026-73506 | 1 Jandedobbeleer | 1 Oh-my-posh | 2026-08-14 | 6.1 Medium |
| Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit.Subject, Commit.Author.Name, Commit.Author.Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1. | ||||
| CVE-2026-65935 | 1 Silabs.com | 1 Wiseconnect | 2026-08-14 | N/A |
| Passkey entry Bluetooth LE legacy pairing can be bypassed in the RS9116W and SiWx917 by manipulating the temporary key value. See vulnerability B-E3 in the related paper below. | ||||
| CVE-2026-28154 | 2 Snstheme, Wordpress | 3 M.anh - Fashion Woocoommerce Wordpress Theme, Samex - Clean, Minimal Shop Woocommerce Wordpress Theme, Wordpress | 2026-08-14 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7. | ||||