Export limit exceeded: 361387 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (361389 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-37454 | 1 Msi | 1 Nbfoundation Service | 2026-06-26 | 7.5 High |
| Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryption | ||||
| CVE-2026-10835 | 2026-06-26 | 7.7 High | ||
| The SALESmanago & Leadoo WordPress plugin before 3.11.3 does not properly sanitise and escape a parameter passed to one of its AJAX actions before using it in a SQL statement, and fails to enforce authorisation on that action, allowing authenticated users with minimal permissions, such as subscribers, to perform SQL injection attacks. | ||||
| CVE-2025-11919 | 2026-06-26 | 9.6 Critical | ||
| The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTemporaryFiles/`). The `-init` file for the the JVM initialization exists in the vulnerable directory during the startup of the JVM. An attacker with access to the shared `/tmp/` space can preemptively create or replace `.jar` files or directories (via the `-init` file) that the victim JVM will resolve first in its classpath. By strategically placing a malicious version of a commonly used library (e.g., `commons-io`) in a location that is included in the classpath before the legitimate version, an attacker can cause the JVM to load the malicious class during startup, thereby executing the attacker's code. | ||||
| CVE-2026-0828 | 2026-06-26 | 7.5 High | ||
| Kernel driver ProcessMonitorDriver.sys in Safetica's endpoint client x64 , versions 10.5.75.0 and 11.11.4.0, allows unprivileged user to abuse IOCTL path and terminate protected system processes. | ||||
| CVE-2025-68052 | 2 Eagle-themes, Wordpress | 2 Eagle Booking, Wordpress | 2026-06-26 | 8.8 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions. | ||||
| CVE-2026-32833 | 2026-06-26 | 8.8 High | ||
| Cudy LT300 3.0 running firmware prior to version 2.5.12 contains an OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands by injecting shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface. Attackers can submit malicious payloads through the NTP settings endpoint to achieve remote code execution on the underlying system. | ||||
| CVE-2026-56032 | 2 Buddyboss, Wordpress | 2 Buddyboss Platform, Wordpress | 2026-06-26 | 9.8 Critical |
| Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. | ||||
| CVE-2026-56043 | 2 Cusrev, Wordpress | 2 Customer Reviews For Woocommerce, Wordpress | 2026-06-26 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Customer Reviews for WooCommerce <= 5.110.1 versions. | ||||
| CVE-2026-56044 | 2 Adenion, Wordpress | 2 Blog2social, Wordpress | 2026-06-26 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Blog2Social <= 8.9.2 versions. | ||||
| CVE-2026-56045 | 2 Valvepress, Wordpress | 2 Automatic, Wordpress | 2026-06-26 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Automatic < 3.135.1 versions. | ||||
| CVE-2026-29509 | 2026-06-26 | 5.4 Medium | ||
| Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patoolib/programs/py_tarfile.py when running on Python before 3.12, where the is_within_directory() helper uses os.path.commonprefix() for character-level string comparison instead of path-level comparison, allowing a crafted archive member path to bypass the containment check. Attackers can supply a malicious archive with specially crafted member paths to write arbitrary files. | ||||
| CVE-2026-46602 | 1 Golang | 1 Image | 2026-06-26 | 7.5 High |
| The TIFF decoder does not set a limit on the size of tiles in tiled images, permitting a malicious or corrupt image containing a very large tile to cause unbounded memory consumption. | ||||
| CVE-2026-57915 | 1 Apache | 1 Kerby | 2026-06-26 | 7.3 High |
| It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue. | ||||
| CVE-2026-56055 | 2 Inspirythemes, Wordpress | 2 Realhomes, Wordpress | 2026-06-26 | 8.8 High |
| Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions. | ||||
| CVE-2026-56060 | 2 Tychesoftwares, Wordpress | 2 Print Invoice & Delivery Notes For Woocommerce, Wordpress | 2026-06-26 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in Print Invoice & Delivery Notes for WooCommerce <= 7.1.1 versions. | ||||
| CVE-2026-54847 | 2 Design, Wordpress | 2 Stylish Cost Calculator, Wordpress | 2026-06-26 | 7.5 High |
| Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions. | ||||
| CVE-2026-56008 | 2 Themefusion, Wordpress | 2 Fusion Builder, Wordpress | 2026-06-26 | 8.8 High |
| Contributor Privilege Escalation in Fusion Builder <= 3.15.4 versions. | ||||
| CVE-2026-56010 | 2 Tychesoftwares, Wordpress | 2 Abandoned Cart Pro For Woocommerce, Wordpress | 2026-06-26 | 8.8 High |
| Subscriber Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. | ||||
| CVE-2026-56011 | 2 Chrisrichardson, Wordpress | 2 Mappress Maps For Wordpress, Wordpress | 2026-06-26 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in MapPress Maps for WordPress <= 2.97.3 versions. | ||||
| CVE-2026-56027 | 2 Pluggabl, Wordpress | 2 Booster For Woocommerce, Wordpress | 2026-06-26 | 9.9 Critical |
| Customer Arbitrary File Upload in Booster for WooCommerce <= 8.0.1 versions. | ||||