Export limit exceeded: 381684 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381684 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66672 | 2 Monkeysan, Wordpress | 2 Flatastic, Wordpress | 2026-08-21 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. | ||||
| CVE-2026-66673 | 2 Monkeysan, Wordpress | 2 Flatastic, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions. | ||||
| CVE-2026-66677 | 2 Vaultdweller, Wordpress | 2 Leyka, Wordpress | 2026-08-21 | 7.6 High |
| Subscriber Broken Authentication in Leyka <= 3.32.3 versions. | ||||
| CVE-2026-68564 | 2 Notificationx, Wordpress | 2 Notificationx Pro, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions. | ||||
| CVE-2026-73998 | 2 Axew3, Wordpress | 2 Wp W3all Phpbb, Wordpress | 2026-08-21 | 8.5 High |
| Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. | ||||
| CVE-2026-74013 | 2 Wordpress, Wordpress.com | 2 Wordpress, Eshipper Commerce | 2026-08-21 | 8.5 High |
| Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. | ||||
| CVE-2026-74014 | 2 Indithemes, Wordpress | 2 It Residence, Wordpress | 2026-08-21 | 9.9 Critical |
| Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. | ||||
| CVE-2026-74016 | 2 Themagnifico52, Wordpress | 2 Smart Cleaning, Wordpress | 2026-08-21 | 9.9 Critical |
| Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. | ||||
| CVE-2026-74018 | 2 Themagnifico52, Wordpress | 2 Warehouse Cargo, Wordpress | 2026-08-21 | 9.9 Critical |
| Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. | ||||
| CVE-2026-74019 | 2 Paulepro2019, Wordpress | 2 Eprolo Dropshipping, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. | ||||
| CVE-2026-74020 | 2 Anders Norén, Wordpress | 2 Koji, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. | ||||
| CVE-2025-62307 | 1 Hcl Software | 1 Iem | 2026-08-21 | 5.4 Medium |
| HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing. | ||||
| CVE-2025-62306 | 1 Hcl Software | 1 Iem | 2026-08-21 | 5 Medium |
| HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response. | ||||
| CVE-2025-62300 | 1 Hcl Software | 1 Iem | 2026-08-21 | 5.9 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior. | ||||
| CVE-2025-62299 | 1 Hcl Software | 1 Iem | 2026-08-21 | 6.6 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges. | ||||
| CVE-2026-21784 | 1 Hcl Software | 1 Iem | 2026-08-21 | 4.8 Medium |
| HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation. | ||||
| CVE-2026-28163 | 2 Mycred, Wordpress | 2 New User Approve, Wordpress | 2026-08-21 | 5.3 Medium |
| Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8. | ||||
| CVE-2026-18482 | 1 Klarso Gmbh | 1 Neo-mjs | 2026-08-21 | N/A |
| Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities. | ||||
| CVE-2026-77118 | 4 Debian, Fedora Project, Fedoraproject and 1 more | 5 Debian Linux, Graphicsmagick, Graphicsmagick and 2 more | 2026-08-21 | N/A |
| A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated luma/chroma plane buffers. The pointer is repositioned only when a sync marker introduces a new plane/row; between sync markers the run length is bounded solely by the input. A crafted PCD file that positions the pointer near the end of a plane and then supplies a long run of deltas with no intervening sync therefore walks the pointer past the end of the allocation and writes through it. Processing an untrusted PCD file — for example with gm convert or gm identify, or through any application linked against libGraphicsMagick — can corrupt heap memory beyond the buffers. | ||||
| CVE-2026-15706 | 1 Baylan Measuring Instruments Industry And Trade Inc. | 1 Baylan Smart Meter Management Application (bms) | 2026-08-21 | 9.8 Critical |
| Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142. | ||||