Export limit exceeded: 396714 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396714 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66075 | 1 Rabbitmq | 1 Rabbitmq-server | 2026-09-23 | N/A |
| RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_methods permits DELETE and delete_resource/2 triggers rabbit_federation_link_sup:restart. There is no per-method elevation check and no comment marking it intentional. A read-only monitoring user can restart any federation link , a state-changing operation that disrupts message flow. Preconditions include rabbitmq_federation + rabbitmq_federation_management plugins enabled Attacker has credentials with the monitoring tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1. | ||||
| CVE-2026-67229 | 1 Rabbitmq | 1 Rabbitmq-server | 2026-09-23 | N/A |
| RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, add_vhost/2 calls rabbit_data_coercion:atomize_keys/1 (the unsafe variant using binary_to_atom) on the vhost metadata map. The 20 MB management body limit fits ~1M+ short keys. Admin-only. An administrator importing a crafted definitions file can crash the node in a single request: a vhosts entry with ~1M unique metadata keys exhausts the atom table during import. Preconditions include administrator tag. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. | ||||
| CVE-2026-66068 | 1 Rabbitmq | 1 Rabbitmq-server | 2026-09-23 | N/A |
| RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. | ||||
| CVE-2026-67405 | 1 Rabbitmq | 1 Rabbitmq-server | 2026-09-23 | N/A |
| RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, Neither the Web-MQTT handler (deps/rabbitmq_web_mqtt/src/rabbit_web_mqtt_handler.erl:104) nor the Web-STOMP handler (deps/rabbitmq_web_stomp/src/rabbit_web_stomp_handler.erl:102) validates the Origin header on the WebSocket upgrade. Under ssl_cert_login=true, the browser presents the client certificate automatically, so an attacker's JavaScript running in the victim's browser can authenticate as the victim. Preconditions include The non-default configuration use_http_auth=true (Web-STOMP) or ssl_cert_login=true (both plugins) must be enabled. The issue is harmless under the default in-band CONNECT credential configuration.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. | ||||
| CVE-2026-79310 | 2026-09-23 | 8.5 High | ||
| webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to and later renders them through the precompiled template loader, the sandbox is bypassed and the attacker's code runs, resulting in arbitrary Python code execution and OS command execution on the server. | ||||
| CVE-2026-95529 | 2 Codepeople, Wordpress | 2 Calculated Fields Form, Wordpress | 2026-09-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions. | ||||
| CVE-2026-95515 | 2 Ninjaforms, Wordpress | 2 Ninja Forms, Wordpress | 2026-09-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | ||||
| CVE-2026-95522 | 2 Syed Balkhi, Wordpress | 2 Easy Digital Downloads, Wordpress | 2026-09-23 | 7.6 High |
| Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. | ||||
| CVE-2026-95523 | 2 Wedevs, Wordpress | 2 Wp User Frontend, Wordpress | 2026-09-23 | 6.5 Medium |
| Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | ||||
| CVE-2026-95524 | 2 Wedevs, Wordpress | 2 Wp User Frontend, Wordpress | 2026-09-23 | 5.3 Medium |
| Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | ||||
| CVE-2026-95527 | 2 Conekta Group, Wordpress | 2 Conekta Payment Gateway, Wordpress | 2026-09-23 | 6.5 Medium |
| Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. | ||||
| CVE-2026-95590 | 2 Tainacan, Wordpress | 2 Tainacan, Wordpress | 2026-09-23 | 7.1 High |
| Subscriber SQL Injection in Tainacan <= 1.2.0 versions. | ||||
| CVE-2026-95604 | 2 Tangible, Wordpress | 2 Loops & Logic, Wordpress | 2026-09-23 | 7.5 High |
| Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. | ||||
| CVE-2026-96602 | 1 Abdurrab5 | 1 Online-makeup-store | 2026-09-23 | 7.3 High |
| A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-57854 | 2026-09-23 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-87719 | 1 Gitlab | 1 Gitlab | 2026-09-23 | 9.9 Critical |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could allow an authenticated user with Duo Chat access to obtain Advanced Search instance configurations and sensitive credentials using a specially crafted GraphQL subscription argument to bypass serialization and perform server object lookup. | ||||
| CVE-2026-85706 | 1 Gitlab | 1 Gitlab | 2026-09-23 | 10 Critical |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API. | ||||
| CVE-2026-90902 | 1 Joomshaper.com | 1 Easy Store Extension For Joomla | 2026-09-23 | N/A |
| Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (array_map('intval', ...)) and adopting parameterized ->whereIn() query construction. | ||||
| CVE-2026-90901 | 1 Joomshaper.com | 1 Easy Store Extension For Joomla | 2026-09-23 | N/A |
| Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The checkout.searchGuestUser endpoint allowed querying guest checkout records solely by supplying an email address. The server returned complete shipping details (full name, phone number, street address, city, postal code, and country) directly from the #__easystore_guests table with no authentication, session validation, or ownership checks. An unauthenticated attacker could iterate through email lists to enumerate guest customers and harvest sensitive Personally Identifiable Information (PII). Resolved by removing the unauthenticated server-side guest lookup endpoint entirely and migrating autofill functionality to client-side localStorage protected by explicit user consent. | ||||
| CVE-2026-77394 | 1 Openc3 | 1 Cosmos | 2026-09-23 | 7.6 High |
| OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0. | ||||