Export limit exceeded: 412889 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 412889 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412889 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-47786 | 1 Qnap Systems | 1 Hybriddesk Station | 2026-10-21 | N/A |
| An OS command injection vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. We have already fixed the vulnerability in the following version: HybridDesk Station 4.2.23 and later HybridDesk Station 4.3.4 and later | ||||
| CVE-2026-79827 | 1 Hpe | 1 Nonstop Inspect Subsystem | 2026-10-21 | 7.1 High |
| A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt resume-execution address and may potentially redirect execution flow. | ||||
| CVE-2026-79828 | 1 Hpe | 1 Nonstop Debug Utilities | 2026-10-21 | 7.1 High |
| A heap buffer overflow in HPE NonStop Debug Utilities could corrupt resume-execution address and may potentially redirect execution flow. | ||||
| CVE-2026-79829 | 1 Hpe | 1 Nonstop Http Webserver | 2026-10-21 | 8.2 High |
| A security vulnerability in HPE NonStop HTTP WEBSERVER can cause memory corruption which may result in a system halt. | ||||
| CVE-2026-110726 | 1 Eclipse | 1 Connected Services Platform | 2026-10-21 | 6.5 Medium |
| In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration. | ||||
| CVE-2026-110724 | 1 Eclipse | 1 Connected Services Platform | 2026-10-21 | 7.5 High |
| In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration. | ||||
| CVE-2026-110723 | 1 Eclipse | 1 Connected Services Platform | 2026-10-21 | 7.5 High |
| In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration. | ||||
| CVE-2026-105065 | 2 8theme, Wordpress-extensions | 2 Xstore, Xstore | 2026-10-21 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9. | ||||
| CVE-2026-103936 | 1 Libp2p | 2 Libp2p, Webrtc | 2026-10-21 | 7.5 High |
| libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 6.0.28, the @libp2p/webrtc webRTCDirect() Node.js listener processes unauthenticated STUN Binding Requests before PeerId authentication, Noise, muxing, protocol negotiation, connection creation, or connection-manager admission. The listener in packages/transport-webrtc/src/private-to-public/utils/stun-listener.ts forwards the packet-controlled request.ufrag into DirectRTCPeerConnection.setLocalDescription, where the value is reused as an ICE password without validating its required length and character set. A short credential causes node-datachannel or libdatachannel to raise an uncaught native invalid_argument and abort the process with SIGABRT, allowing a single remote UDP packet to deny service. The confirmed impact is process termination only, with no demonstrated memory corruption, code execution, browser impact, confidentiality impact, integrity impact, or connection-limit bypass. This issue is fixed in version 6.0.28. | ||||
| CVE-2026-103083 | 2 Elextensions, Wordpress-extensions | 2 Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes, Elex Woocommerce Advanced Bulk Edit Products, Prices & Attributes | 2026-10-21 | 5.4 Medium |
| Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes elex-bulk-edit-products-prices-attributes-for-woocommerce-basic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes: from n/a through 1.5.3. | ||||
| CVE-2026-96449 | 2 Wordpress-extensions, Wpexperts | 2 Wp Easypay, Wp Easypay | 2026-10-21 | 5.3 Medium |
| Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4. | ||||
| CVE-2026-109689 | 2 Sunshinephotocart, Wordpress-extensions | 2 Sunshine Photo Cart, Sunshine Photo Cart | 2026-10-21 | 5.3 Medium |
| Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4. | ||||
| CVE-2026-111125 | 2 Heasarc, Nasa | 2 Cfitsio, Cfitsio | 2026-10-21 | 6.1 Medium |
| CFITSIO through 4.7.0 contains a heap-based out-of-bounds read vulnerability in the HCOMPRESS tile decoder that allows attackers to read past the compressed tile buffer via input_nnybble in fits_hdecompress.c. Attackers can supply a crafted FITS file with ZCMPTYPE HCOMPRESS_1 declaring oversized tile geometry to crash applications calling fits_read_pix or disclose limited heap memory. | ||||
| CVE-2026-111365 | 1 Cool-team-official | 1 Cool-admin-midway | 2026-10-21 | 6 Medium |
| cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete other admins' roles by supplying arbitrary role ids. Attackers holding ordinary sys:role permissions can call /admin/sys/role/info, update, or delete with another admin's role id to rewrite menu and department grants, changing other users' effective access. | ||||
| CVE-2026-111366 | 1 Cool-team-official | 1 Cool-admin-midway | 2026-10-21 | 7.2 High |
| cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside their departments by supplying arbitrary user ids. Attackers holding sys:user:* permissions can call /admin/sys/user/info, update, or delete to read records, reset passwords and roles, or delete accounts. | ||||
| CVE-2026-100108 | 2 Maxfoundry, Wordpress-extensions | 2 Social Share Buttons, Social Share Buttons | 2026-10-21 | 6.4 Medium |
| The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up to, and including, 1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the 7-day review-nag timer has elapsed since the attacker's first wp-admin visit, as the nonce needed to reach the save-network handler is only rendered in the DOM once that timer has passed. | ||||
| CVE-2026-96870 | 3 Brainstorm Force, Brainstormforce, Wordpress-extensions | 3 Suredash, Suredash, Suredash | 2026-10-21 | 6.4 Medium |
| The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is triggered when any user hovers over a comment's like counter on a community page, as the plugin's tooltip handler assigns the attacker-controlled data-tooltip-description attribute value directly to innerHTML, re-parsing the browser-decoded entity payload as live HTML. | ||||
| CVE-2026-92766 | 2 Appsbd, Wordpress-extensions | 2 Vitepos, Vitepos | 2026-10-21 | 7.5 High |
| The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'src_by' parameter in all versions up to, and including, 3.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This makes it possible for unauthenticated attackers, or authenticated attackers holding any POS role (such as vtpos-cashier), to exploit the vulnerability, as the /vitepos/v1/vendor/list REST route's permission callback requires only a POS role assignment rather than any elevated WordPress capability. | ||||
| CVE-2026-96768 | 2 Softaculous, Wordpress-extensions | 2 Gosmtp Pro, Gosmtp Pro | 2026-10-21 | 7.2 High |
| The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is made possible because WordPress comment kses does not strip entity-encoded tag delimiters, allowing the payload to pass moderation as safe text before being decoded into live HTML by core email notification functions and written verbatim into the plugin's email log database table. | ||||
| CVE-2026-110029 | 1 Wordpress-extensions | 1 Squeeze | 2026-10-21 | 5.4 Medium |
| The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership. | ||||