Export limit exceeded: 371431 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371431 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-24537 | 2026-07-23 | 4.3 Medium | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions. | ||||
| CVE-2026-27392 | 2026-07-23 | 4.3 Medium | ||
| Contributor Broken Access Control in uListing <= 2.2.0 versions. | ||||
| CVE-2026-25466 | 2 Wordpress, Wpgmaps | 2 Wordpress, Wp Go Maps | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. | ||||
| CVE-2026-27391 | 2026-07-23 | 5.4 Medium | ||
| Subscriber Broken Access Control in uListing <= 2.2.0 versions. | ||||
| CVE-2026-27423 | 2026-07-23 | 4.3 Medium | ||
| Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. | ||||
| CVE-2026-57767 | 2026-07-23 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions. | ||||
| CVE-2026-59512 | 2 Piwebsolution, Wordpress | 2 Product Enquiry For Woocommerce, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Product Enquiry for WooCommerce <= 2.2.34.43 versions. | ||||
| CVE-2026-59525 | 2026-07-23 | 9.3 Critical | ||
| Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | ||||
| CVE-2026-59544 | 2026-07-23 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Thrive Quiz Builder <= 10.9.3.0 versions. | ||||
| CVE-2026-61944 | 2 Bookly, Wordpress | 2 Bookly, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Bookly <= 27.7 versions. | ||||
| CVE-2026-65463 | 2026-07-23 | 5.4 Medium | ||
| Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions. | ||||
| CVE-2026-65469 | 2026-07-23 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. | ||||
| CVE-2026-65482 | 2026-07-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions. | ||||
| CVE-2026-65488 | 2026-07-23 | 7.1 High | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions. | ||||
| CVE-2026-65494 | 2026-07-23 | 7.1 High | ||
| Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. | ||||
| CVE-2025-10911 | 1 Redhat | 11 Discovery, Enterprise Linux, Enterprise Linux Eus and 8 more | 2026-07-23 | 5.5 Medium |
| A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. | ||||
| CVE-2026-65895 | 1 Getgrav | 1 Grav | 2026-07-23 | 8.5 High |
| Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. | ||||
| CVE-2026-65896 | 1 Getgrav | 1 Grav | 2026-07-23 | 7.1 High |
| Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with the api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation. | ||||
| CVE-2026-46579 | 1 Redhat | 3 Openshift, Openshift Container Platform, Openshift Router | 2026-07-23 | 7.4 High |
| A flaw was found in the OpenShift Router. When a Route has `insecureEdgeTerminationPolicy` set to Allow, the HTTP frontend does not remove `X-SSL-Client-*` headers from incoming requests. This allows an unauthenticated attacker to send plain HTTP requests with crafted `X-SSL-Client-*` headers. As a result, backends relying on these headers for mutual TLS (Transport Layer Security) authentication can be bypassed, enabling the attacker to impersonate client certificate identities. | ||||
| CVE-2026-9058 | 1 Krajowa Izba Rozliczeniowa | 1 Szafir Sdk | 2026-07-23 | N/A |
| For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified". For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined". This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation: (1) in use-cases other than qualified certificate authentication, or (2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application. This issue was fixed in version 1.8.463.2. | ||||