Export limit exceeded: 381364 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381364 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66609 | 2 Codexthemes, Wordpress | 2 Thegem (elementor), Wordpress | 2026-08-21 | 9.3 Critical |
| Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. | ||||
| CVE-2026-66647 | 2 Radiustheme, Wordpress | 2 Homlisti, Wordpress | 2026-08-21 | 6.5 Medium |
| Subscriber Broken Access Control in Homlisti <= 3.1.2 versions. | ||||
| CVE-2026-66672 | 2 Monkeysan, Wordpress | 2 Flatastic, Wordpress | 2026-08-21 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. | ||||
| CVE-2026-66673 | 2 Monkeysan, Wordpress | 2 Flatastic, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Flatastic <= 2.0 versions. | ||||
| CVE-2026-66677 | 2 Vaultdweller, Wordpress | 2 Leyka, Wordpress | 2026-08-21 | 7.6 High |
| Subscriber Broken Authentication in Leyka <= 3.32.3 versions. | ||||
| CVE-2026-68564 | 2 Notificationx, Wordpress | 2 Notificationx Pro, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions. | ||||
| CVE-2026-73998 | 2 Axew3, Wordpress | 2 Wp W3all Phpbb, Wordpress | 2026-08-21 | 8.5 High |
| Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. | ||||
| CVE-2026-74013 | 2 Wordpress, Wordpress.com | 2 Wordpress, Eshipper Commerce | 2026-08-21 | 8.5 High |
| Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. | ||||
| CVE-2026-74014 | 2 Indithemes, Wordpress | 2 It Residence, Wordpress | 2026-08-21 | 9.9 Critical |
| Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. | ||||
| CVE-2026-74016 | 2 Themagnifico52, Wordpress | 2 Smart Cleaning, Wordpress | 2026-08-21 | 9.9 Critical |
| Subscriber Arbitrary File Upload in Smart Cleaning <= 4.8.6 versions. | ||||
| CVE-2026-74018 | 2 Themagnifico52, Wordpress | 2 Warehouse Cargo, Wordpress | 2026-08-21 | 9.9 Critical |
| Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. | ||||
| CVE-2026-74019 | 2 Paulepro2019, Wordpress | 2 Eprolo Dropshipping, Wordpress | 2026-08-21 | 7.1 High |
| Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. | ||||
| CVE-2026-74020 | 2 Anders Norén, Wordpress | 2 Koji, Wordpress | 2026-08-21 | 7.5 High |
| Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. | ||||
| CVE-2025-62307 | 1 Hcl Software | 1 Iem | 2026-08-21 | 5.4 Medium |
| HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing. | ||||
| CVE-2025-62306 | 1 Hcl Software | 1 Iem | 2026-08-21 | 5 Medium |
| HCL IntelliOps Event Management (IEM) is affected by information omission. The lack of information breaks auditability and observability of a workflow. if an attacker were to gain access to the application, the insufficient logging could hinder incident response. | ||||
| CVE-2025-62300 | 1 Hcl Software | 1 Iem | 2026-08-21 | 5.9 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior. | ||||
| CVE-2025-62299 | 1 Hcl Software | 1 Iem | 2026-08-21 | 6.6 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges. | ||||
| CVE-2026-21784 | 1 Hcl Software | 1 Iem | 2026-08-21 | 4.8 Medium |
| HCL IntelliOps Event Management (IEM) is affected by missing or insecure Cross-Origin Security headers. This issue makes the application's environment and resources susceptible to unauthorized external interaction and potential exploitation. | ||||
| CVE-2026-28163 | 2 Mycred, Wordpress | 2 New User Approve, Wordpress | 2026-08-21 | 5.3 Medium |
| Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New User Approve: from n/a through 3.2.8. | ||||
| CVE-2026-18482 | 1 Klarso Gmbh | 1 Neo-mjs | 2026-08-21 | N/A |
| Neo.mjs contains a command injection vulnerability within the FileSystemService.mjs component of the ai/mcp/server/file-system MCP server, where the checkSyntax() and runPlaywrightTest() functions unsafely interpolate caller-controlled absolutePath values into shell commands, enabling arbitrary OS command execution when an AI agent is induced to invoke these tools. Commit 88c77fc fixes these vulnerabilities. | ||||