Export limit exceeded: 373303 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373303 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15651 | 2 Jgwhite33, Wordpress | 2 Wp Tripadvisor Review Slider, Wordpress | 2026-08-05 | 4.9 Medium |
| The WP TripAdvisor Review Slider plugin for WordPress is vulnerable to generic SQL Injection via the 'filtersource' parameter in all versions up to, and including, 14.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-5674 | 2 Pipewire, Redhat | 2 Pipewire, Enterprise Linux | 2026-08-05 | 8.8 High |
| A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system. | ||||
| CVE-2026-63089 | 1 Wg-easy | 1 Wg-easy | 2026-08-05 | 9.3 Critical |
| WireGuard Easy through 15.3.0, fixed in commit 66b292b, contains a cryptographically weak one-time link token generation vulnerability that allows unauthenticated network attackers to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidate tokens per client ID, as the token is computed using CRC32 over a random value constrained to 0-999. Attackers can enumerate candidate tokens against the unauthenticated /cnf/:oneTimeLink route, which lacks rate limiting and does not validate token expiration, to obtain a peer's PrivateKey and PresharedKey and impersonate that peer on the VPN network. | ||||
| CVE-2025-60357 | 1 Ahnlab | 1 Epp Management | 2026-08-05 | 8.1 High |
| AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint. | ||||
| CVE-2026-15160 | 2 Saturdaydrive, Wordpress | 2 Ninja Forms - Excel Export, Wordpress | 2026-08-05 | 4.3 Medium |
| The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_tmp_name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to write .xls/.xlsx files to arbitrary locations on the server, which can be used to stage further attacks. | ||||
| CVE-2026-15159 | 2 Saturdaydrive, Wordpress | 2 Ninja Forms - Excel Export, Wordpress | 2026-08-05 | 4.3 Medium |
| The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.6 via the 'spreadsheet_export_form_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to enumerate any Ninja Forms form ID and download all stored submission data — including names, email addresses, phone numbers, physical addresses, and any other PII collected by site forms — as a downloadable XLSX file. | ||||
| CVE-2026-15161 | 2 Saturdaydrive, Wordpress | 2 Ninja Forms - Excel Export, Wordpress | 2026-08-05 | 6.4 Medium |
| The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.6. This is due to the save_filter() AJAX handler storing the raw $_POST['filter'] array into a WordPress option via update_option() without any capability check, nonce verification, or input sanitization, combined with the get_filter_row() method on the admin Excel Export screen concatenating the stored filter values (field_key, condition, value) directly into HTML attributes without esc_attr(). This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-16266 | 1 Longshotlabs | 1 Mongo-object | 2026-08-05 | 4 Medium |
| Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__. | ||||
| CVE-2026-15812 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-08-05 | 4.8 Medium |
| A vulnerability was found in the internal Access Control List (ACL) subsystem of kronosnet (Version affected: <= 1.34). When the framework is explicitly configured to manage dynamic links (accepting network traffic from any IP address) without network payload encryption, the validation architecture implicitly trusts the link ID provided within incoming data packets. A remote, unauthenticated attacker can exploit this lack of validation by spoofing a legitimate link ID inside crafted network frames. This allows the attacker to fully bypass the ACL framework and inject arbitrary data packets into the application layer, potentially leading to data corruption or service instabilities. | ||||
| CVE-2026-16313 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-08-05 | 7.6 High |
| A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected. | ||||
| CVE-2026-18107 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-08-05 | 7.8 High |
| A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The practical impact on Red Hat products is limited by several factors: checkpoint/restore requires root privileges (podman) or cluster-admin RBAC (OpenShift) to trigger and cannot be initiated from within the container itself; on OpenShift prior to 4.17 the feature required explicit opt-in, and on 4.17+ the kubelet checkpoint API RBAC is not configured by default; OpenShift enforces user namespaces by default for regular workloads (hostUsers is gated behind admin-only SCCs), which makes the spoofed capabilities namespace-scoped and ineffective for privilege escalation; SELinux type enforcement (container_t) blocks privilege transitions independently of capabilities; seccomp filters persist through checkpoint/restore and cannot be corrupted via the parasite; and kernel mount namespace ownership checks on RHEL 9/10 kernels prevent mount-based container escape even with spoofed capabilities. | ||||
| CVE-2025-60931 | 1 Infor | 1 Global Human Resources | 2026-08-05 | 7.5 High |
| An Insecure Direct Object Reference (IDOR) in the Employee Compensation View function of Infor Global HR v11.24.10.01.33 allows unauthorized attackers to arbitrarily view the compensation information of other employees via a crafted GET request. | ||||
| CVE-2026-18197 | 2 Wordpress, Yannick Lefebvre | 2 Wordpress, Link Library | 2026-08-05 | N/A |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4. | ||||
| CVE-2026-16655 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder | 2026-08-05 | 7.2 High |
| The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested `password` Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-38709 | 1 Cudy | 9 Tr1200, Tr3000, Wr1200 and 6 more | 2026-08-05 | 9.8 Critical |
| TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the net.set_wan interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input. | ||||
| CVE-2026-35847 | 1 Netcccyun | 1 Dnsmgr | 2026-08-05 | 9.8 Critical |
| An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file | ||||
| CVE-2026-68562 | 1 Redhat | 2 Ansible Collection, Enterprise Linux | 2026-08-05 | 6.2 Medium |
| A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials. | ||||
| CVE-2026-68563 | 1 Redhat | 2 Ansible Collection, Enterprise Linux | 2026-08-05 | 5.5 Medium |
| A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure. | ||||
| CVE-2026-60011 | 2 Sharp Corporation, Toshiba Tec Corporation | 2 Sharp Mfps, Toshiba Tec Mfps | 2026-08-05 | 5.3 Medium |
| Sharp and Toshiba Tec MFPs (multifunction printers) fail to properly authorize requests to directly access certain image data stored to the affected product. | ||||
| CVE-2026-63545 | 2 Sharp Corporation, Toshiba Tec Corporation | 2 Sharp Mfps, Toshiba Tec Mfps | 2026-08-05 | 2.4 Low |
| Sharp and Toshiba Tec MFPs (multifunction printers) caches data internally when printing, and leave them uncleared. They may be accessed later by other users. | ||||