Export limit exceeded: 370925 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370925 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13714 | 2026-07-27 | 9.8 Critical | ||
| The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. | ||||
| CVE-2026-13152 | 2026-07-27 | 8.1 High | ||
| The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta key on sites that use a non-default database table prefix, so an unauthenticated user who registers an account can be granted the administrator role when a correspondingly named field has been configured. | ||||
| CVE-2026-59534 | 2 Aurovrata Venet, Wordpress | 2 Post My Cf7 Form, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | ||||
| CVE-2026-59546 | 2 John Darrel, Wordpress | 2 Hide My Wp Ghost, Wordpress | 2026-07-27 | 7.4 High |
| Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. | ||||
| CVE-2026-59553 | 2 Rextheme, Wordpress | 2 Product Feed Manager, Wordpress | 2026-07-27 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions. | ||||
| CVE-2026-66427 | 2 Jgwhite33, Wordpress | 2 Wp Google Review Slider, Wordpress | 2026-07-27 | 7.6 High |
| Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | ||||
| CVE-2026-66477 | 2026-07-27 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in Gillion <= 4.13 versions. | ||||
| CVE-2026-48037 | 1 Kerberosmansour | 1 Hulumi | 2026-07-27 | N/A |
| Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, AccountFoundation reuse paths silently downgrade GuardDuty / Security Hub posture. This issue has been patched in version 1.4.0. | ||||
| CVE-2026-16280 | 1 Imaginationtech | 1 Graphics Ddk | 2026-07-27 | 9.8 Critical |
| An integer overflow when calculating physical offsets for sparse PMRs may result in 32-bit truncation of address computations for PMRs larger than 4 GB. This can lead to incorrect GPU MMU mappings and may allow a non-privileged user to trigger access to unintended physical memory, resulting in memory corruption or information disclosure. | ||||
| CVE-2026-66337 | 2 Libsoup, Redhat | 2 Libsoup, Enterprise Linux | 2026-07-27 | 6.5 Medium |
| A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory. | ||||
| CVE-2026-60605 | 1 Oracle | 1 Peoplesoft Enterprise Cs Student Records | 2026-07-27 | 7.5 High |
| Vulnerability in the PeopleSoft Enterprise CS Student Records product of Oracle PeopleSoft (component: Higher Ed Statistics Agency - UK HESA). The supported version that is affected is 9.2.38. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise CS Student Records. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all PeopleSoft Enterprise CS Student Records accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-65434 | 2 Wordpress, Yoomoney | 2 Wordpress, Юkassa Для Woocommerce | 2026-07-27 | 6.5 Medium |
| Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. | ||||
| CVE-2026-66433 | 2 Shapedplugin, Wordpress | 2 Location Weather, Wordpress | 2026-07-27 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions. | ||||
| CVE-2026-10600 | 1 Mattermost | 1 Mattermost | 2026-07-27 | 4.3 Medium |
| Mattermost versions 11.8.x <= 11.8.0, 11.7.x <= 11.7.3, 11.6.x <= 11.6.5, 10.11.x <= 10.11.20 fail to bound the time and resource consumption of server-side document content extraction which allows an authenticated user with file-upload permission to degrade file uploads for all users on the server via repeatedly uploading small documents that are cheap to upload but expensive to extract, saturating the shared extraction worker pool.. Mattermost Advisory ID: MMSA-2026-00694 | ||||
| CVE-2026-16766 | 1 Rrwo | 1 Catalyst::view::wkhtmltopdf | 2026-07-27 | 9.8 Critical |
| Catalyst::View::Wkhtmltopdf versions before 0.6.1 for Perl allow shell command injection (RCE) via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization. Any web application that passes user-controlled options such as the page_size, orientation or margins without validation allows shell command injection. Version 0.6.0 was released with an incomplete fix for this issue. Note that the wkhtmltopdf project is no longer being developed, and users of this package should migrate to alternative solutions. | ||||
| CVE-2026-66013 | 1 Openremote | 1 Openremote | 2026-07-27 | N/A |
| OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles. | ||||
| CVE-2025-15662 | 2026-07-27 | 8.6 High | ||
| The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources. | ||||
| CVE-2026-12255 | 2026-07-27 | 8.1 High | ||
| The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request. | ||||
| CVE-2026-12394 | 2026-07-27 | 9.8 Critical | ||
| The MemberGlut WordPress plugin before 1.1.5 does not validate the role chosen during front-end registration, allowing unauthenticated users to register an account with an arbitrary role, including administrator, leading to full site compromise. | ||||
| CVE-2026-12989 | 1 Ghost Robotics | 1 Vision 60 | 2026-07-27 | N/A |
| A lack of authentication in the mobile app (APK v5.5.0) for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization mechanisms, the attacker can view real-time camera feeds, control the robot’s movements, manage sensors (GPS, RTK, SAM, LIDAR), and execute critical operational commands (Play, Pause, Stop, E-Stop). Successful exploitation completely compromises the confidentiality, integrity, and physical security of the system. | ||||