Export limit exceeded: 373574 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373574 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65572 | 2 Axiomthemes, Wordpress | 2 A.williams, Wordpress | 2026-08-07 | 9.8 Critical |
| Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | ||||
| CVE-2026-66665 | 2 Brandexponents, Wordpress | 2 Type Hub, Wordpress | 2026-08-07 | 10 Critical |
| Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | ||||
| CVE-2026-66681 | 2 Jeff Farthing, Wordpress | 2 Theme My Login, Wordpress | 2026-08-07 | 4.3 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions. | ||||
| CVE-2026-66683 | 2 Wordpress, Wp Zone | 2 Wordpress, Custom Css And Javascript | 2026-08-07 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. | ||||
| CVE-2026-66685 | 2 Alex, Wordpress | 2 Featured Video Plus, Wordpress | 2026-08-07 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. | ||||
| CVE-2026-66686 | 2 Vladimir Garagulya, Wordpress | 2 Plugins Garbage Collector (database Cleanup), Wordpress | 2026-08-07 | 6.5 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions. | ||||
| CVE-2026-66696 | 2 Nexcess, Wordpress | 2 Gutenberg Blocks By Kadence Blocks, Wordpress | 2026-08-07 | 4.3 Medium |
| Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. | ||||
| CVE-2026-53977 | 1 Bohdan Triapitsyn | 1 Openchamber | 2026-08-07 | 7.5 High |
| OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured. | ||||
| CVE-2026-18276 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 4.3 Medium |
| Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check | ||||
| CVE-2026-18275 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 6.5 Medium |
| Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect | ||||
| CVE-2026-18359 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 8.5 High |
| Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied | ||||
| CVE-2026-18277 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 7.1 High |
| Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model access via a POST request, because the ownership check is placed in get_context_data() and therefore runs only on the GET rendering path | ||||
| CVE-2026-18258 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 8.8 High |
| Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supplied in the request body, which are queried against the global model manager instead of the request-scoped queryset | ||||
| CVE-2026-53985 | 1 Efstratios Goudelis | 1 Ground Station | 2026-08-07 | 7.5 High |
| Ground Station prior to 0.6.0 contains an unauthenticated denial-of-service vulnerability in the Socket.IO server's service_control event handler that allows any unauthenticated network peer to forcibly terminate the ground-station process by sending a single restart_service command. Attackers can connect to the Socket.IO server on port 7000 without credentials due to disabled authentication enforcement and a wildcard CORS policy, then emit the service_control event to terminate all active satellite-tracking sessions, SDR recording pipelines, demodulators, decoders, and rotator controllers, with repeated triggering possible in Docker deployments to create a persistent denial-of-service condition. | ||||
| CVE-2026-16067 | 2 Event Booking Manager For Woocommerce, Wordpress | 2 Event Booking Manager For Woocommerce (pro), Wordpress | 2026-08-07 | 5.3 Medium |
| The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost. | ||||
| CVE-2026-71433 | 2 Langchain, Langchain-ai | 3 Langgraph-checkpoint-sqlite, Langgraph, Langgraph-checkpoint-postgres | 2026-08-07 | 5.3 Medium |
| LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarchical namespaces as a dot joined string and scoped reads by matching that string as a simple prefix pattern, so a read scoped to one namespace could also match a sibling namespace whose flattened form shares the same leading characters, or a namespace label containing unescaped pattern metacharacters, allowing an authenticated caller to retrieve stored items belonging to another tenant or user through an ordinary scoped search or list namespaces call, with no crafted input required. This issue is fixed in versions 3.1.1 of langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite. | ||||
| CVE-2026-48074 | 1 Open-reception | 1 Appointment-booking-software | 2026-08-07 | 2.7 Low |
| OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.6, when a TENANT_ADMIN deletes an existing staff user, the underlying `StaffService.deleteStaffMember()` runs an additional invite cleanup that deletes from the central `user_invite` table by email. The `email` clause has no `tenantId` predicate. Any pending invite in any tenant that shares the deleted staff's email is removed. A TENANT_ADMIN of tenant A who deletes a staff record with email `victim[@]example[.]com` also deletes the pending invite for `victim[@]example[.]com` in tenant B, even though they have no relationship to tenant B. The user-side delete is correctly scoped (`eq(user.id, staffId), eq(user.tenantId, tenantId)`), and the pending-invite-only delete path (when `staffId` is itself an invite ID) is also tenant-scoped. The bug is specifically in the invite cleanup that runs as a side effect of deleting an existing staff user. Version 1.0.6 patches the issue. | ||||
| CVE-2026-48076 | 1 Open-reception | 1 Appointment-booking-software | 2026-08-07 | 6.5 Medium |
| OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. The new-client booking flow in versions 1.0.1 and prior consists of three calls: `bootstrap-challenge` (returns a 16-bit PoW challenge with `difficulty=4` leading hex zeroes), `bootstrap-verify` (validates the PoW and issues a Bearer booking access token), and `create-new-client` (consumes the token and creates the tunnel and first appointment). The token correctly binds to `tenantId`, `tunnelId`, `clientPublicKey`, and `emailHash`, but never to `channelId`. The `bootstrap-challenge` request schema does not even accept a `channelId`, and the issued token's payload contains no channel information. Independently, the service function `createNewClientWithAppointment` checks only `channel.archived = false`. The `channel.isPublic` check that protects `addAppointmentToTunnel` is missing in the new-client path. The combination means: an attacker completes the bootstrap flow normally (16-bit PoW, completes in well under one second on commodity hardware, no rate limiting beyond the throttle store), receives a valid booking access token, and then submits the `create-new-client` payload with `channelId` pointing to a private (`isPublic = false`) channel. The booking lands as `CONFIRMED` if the target channel has `requiresConfirmation = false` (the default), otherwise as `NEW`. The patient-facing UI does not list private channels in its picker (`/api/public/channels` correctly filters `isPublic = true`), so the channel ID must be obtained out of band. The companion finding V-10 (schedule endpoint discloses private channels) provides exactly that: a single unauthenticated GET reveals every private channel ID for any tenant. V-10 plus V-11 together make private channels fully reachable to anonymous attackers. As of time of publication, no known patched versions are available. | ||||
| CVE-2024-7885 | 1 Redhat | 21 Apache Camel Hawtio, Apache Camel Spring Boot, Build Keycloak and 18 more | 2026-08-07 | 7.5 High |
| A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the same StringBuilder instance, potentially leading to information leakage between requests or responses. In some cases, a value from a previous request or response may be erroneously reused, which could lead to unintended data exposure. This issue primarily results in errors and connection termination but creates a risk of data leakage in multi-request environments. | ||||
| CVE-2026-71497 | 1 Jhy | 1 Jsoup | 2026-08-07 | 4.7 Medium |
| jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a custom Safelist permits certain raw-text elements, this misparsing can cause content that should remain inert text to be emitted as active markup after serialization, potentially resulting in cross-site scripting. jsoup's built-in Safelists are not affected. This issue is fixed in version 1.23.1. | ||||