Export limit exceeded: 369970 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 369970 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369970 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65512 | 2 Melapress, Wordpress | 2 Wp Activity Log, Wordpress | 2026-07-23 | 5.4 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions. | ||||
| CVE-2026-65466 | 2026-07-23 | 4.9 Medium | ||
| Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. | ||||
| CVE-2026-47005 | 1 Oracle | 1 Enterprise Manager Base Platform | 2026-07-23 | 7.2 High |
| Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Self Update Framework). Supported versions that are affected are 13.5 and 24.1. Easily exploitable vulnerability allows high privileged attacker with network access via HTTPS to compromise Oracle Enterprise Manager Base Platform. Successful attacks of this vulnerability can result in takeover of Oracle Enterprise Manager Base Platform. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-60366 | 1 Oracle | 1 Platform Security For Java | 2026-07-23 | 10 Critical |
| Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Platform Security for Java. While the vulnerability is in Oracle Platform Security for Java, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). | ||||
| CVE-2026-65460 | 2 Wordpress, Zarinpal | 2 Wordpress, Zarinpal Gateway | 2026-07-23 | 4.3 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions. | ||||
| CVE-2026-60368 | 1 Oracle | 1 Platform Security For Java | 2026-07-23 | 8.8 High |
| Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via SOAP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-65453 | 2 Motovnet, Wordpress | 2 Ebook Store, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | ||||
| CVE-2026-64625 | 1 Wwbn | 1 Avideo | 2026-07-23 | 9.8 Critical |
| AVideo before 29.0 contains an incomplete fix for CVE-2026-45578 where execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection. | ||||
| CVE-2026-55831 | 1 Netty | 1 Netty | 2026-07-23 | 7.5 High |
| Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, Netty's SPDY SETTINGS decoder accepts a peer-declared SETTINGS entry count up to the 24-bit frame-length limit and materializes every unique setting ID in `DefaultSpdySettingsFrame`, allowing a remote SPDY/3.1 peer to send a syntactically valid roughly 2 MiB SETTINGS frame that creates 262144 map entries and amplifies network input into heap growth and ordered-map insertion work. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. | ||||
| CVE-2026-43820 | 2026-07-23 | N/A | ||
| NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2. | ||||
| CVE-2026-16332 | 1 D-link | 1 Dns-320 | 2026-07-23 | 7.3 High |
| A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. | ||||
| CVE-2026-65478 | 2026-07-23 | 5.4 Medium | ||
| Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. | ||||
| CVE-2026-15811 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-07-23 | 5.8 Medium |
| A vulnerability was found in kronosnet's (version <=1.34) cryptographic configuration management. The framework does not correctly zero-out or wipe sensitive memory segments after executing changes to its cryptographic configuration. This omission leaves raw encryption keys resident in memory after the associated structures are freed. A local attacker capable of leveraging memory disclosure techniques could exploit this flaw to retrieve the active encryption key, allowing them to decrypt cluster network communications or inject malicious packets to cause severe high-availability cluster instability. | ||||
| CVE-2026-60439 | 1 Oracle | 1 Platform Security For Java | 2026-07-23 | 8.8 High |
| Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware (component: Centralized Thirdparty Jars). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Platform Security for Java. Successful attacks of this vulnerability can result in takeover of Oracle Platform Security for Java. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-15145 | 2 Wordpress, Wpdevteam | 2 Wordpress, Essential Addons For Elementor – Popular Elementor Templates & Widgets | 2026-07-23 | 6.4 Medium |
| The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-27355 | 2 Metaphorcreations, Wordpress | 2 Ditty, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | ||||
| CVE-2026-65528 | 2 Bannersky, Wordpress | 2 Bsk Pdf Manager, Wordpress | 2026-07-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. | ||||
| CVE-2026-65530 | 2 Templatespare, Wordpress | 2 Templatespare, Wordpress | 2026-07-23 | 4.3 Medium |
| Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions. | ||||
| CVE-2026-59845 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-07-23 | 5.3 Medium |
| A flaw was found in libssh. When ProxyCommand is used, an unchecked fork() failure can be stored as process ID -1; during cleanup, signals may then be sent across the caller's accessible process tree, leading to local denial of service. | ||||
| CVE-2026-65007 | 1 Getgrav | 1 Grav | 2026-07-23 | 9.6 Critical |
| The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover. | ||||