Export limit exceeded: 371572 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371572 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18358 | 1 Redhat | 1 Enterprise Linux | 2026-07-31 | 7.5 High |
| A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version. | ||||
| CVE-2026-46593 | 1 Php Jabbers | 1 Php Poll Script | 2026-07-31 | N/A |
| A SQL injection vulnerability has been identified in the PHP Jabbers - PHP Poll Script. Improper neutralization of input provided by user to pjAdminPolls.controller.php endpoint allows an authenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1. | ||||
| CVE-2026-18481 | 1 Aws | 1 Aws Ops Wheel | 2026-07-31 | 7.3 High |
| Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR #168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participant_url value containing a dangerous URI scheme. To remediate this issue, users should redeploy from the latest version of aws-ops-wheel. | ||||
| CVE-2026-43830 | 2026-07-31 | 9.8 Critical | ||
| Full details and mitigation steps are currently restricted and will be published at a later date. | ||||
| CVE-2025-67651 | 1 Php Jabbers | 35 Appointment Scheduler, Auto Classifieds Script, Availability Booking Calendar and 32 more | 2026-07-31 | N/A |
| A Cross-Site Request Forgery (CSRF) vulnerability has been identified in multiple PHP Jabbers scripts. The lack of CSRF tokens or appropriate SameSite attributes allows an attacker to send unauthorized requests in the context of an authenticated user, leading to unauthorized administrative actions, such as creating new admin accounts. This issue was fixed in the versions specified in the affected products list. | ||||
| CVE-2025-67650 | 1 Php Jabbers | 35 Appointment Scheduler, Auto Classifieds Script, Availability Booking Calendar and 32 more | 2026-07-31 | N/A |
| An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. Improper neutralization of input provided by an authenticated user into parameters responsible for sorting functions allows an attacker to perform SQL Injection attacks. This issue was fixed in the versions specified in the affected products list. | ||||
| CVE-2026-46594 | 1 Php Jabbers | 1 Php Poll Script | 2026-07-31 | N/A |
| A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1. | ||||
| CVE-2026-15227 | 1 Checkmk | 1 Checkmk | 2026-07-31 | N/A |
| Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to modify reports owned by other users. | ||||
| CVE-2025-67649 | 2 Php Jabbers, Phpjabbers | 2 Car Rental Script, Car Rental Script | 2026-07-31 | N/A |
| A SQL injection vulnerability has been identified in PHP Jabbers - Car Rental Script . Improper neutralization of input provided by user into parameters responsible for sorting functions allows an unauthenticated attacker to perform SQL Injection attacks. This issue was fixed in version 4.1. | ||||
| CVE-2026-15048 | 2026-07-31 | 7.5 High | ||
| The Geeky Bot WordPress plugin before 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps. | ||||
| CVE-2026-43829 | 2026-07-31 | 7.5 High | ||
| Full details and mitigation steps are currently restricted and will be published at a later date. | ||||
| CVE-2026-14931 | 2026-07-31 | 6.5 Medium | ||
| The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users. | ||||
| CVE-2026-14930 | 2026-07-31 | 7.5 High | ||
| The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unauthenticated users to upload files (limited to the JS Help Desk WordPress plugin before 3.1.4's inert allowed extensions) and attach them to arbitrary users' support tickets. | ||||
| CVE-2026-15209 | 2026-07-31 | 6.5 Medium | ||
| The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body. | ||||
| CVE-2026-13379 | 1 Openvpn | 1 Openvpn | 2026-07-31 | N/A |
| The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process | ||||
| CVE-2026-53599 | 2026-07-31 | 7.5 High | ||
| REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1. | ||||
| CVE-2026-14845 | 2026-07-31 | 6.1 Medium | ||
| The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users viewing the affected widget. | ||||
| CVE-2026-14554 | 2026-07-31 | 6.5 Medium | ||
| The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks. | ||||
| CVE-2026-14319 | 2 Givewp, Wordpress | 2 Givewp, Wordpress | 2026-07-31 | 7.5 High |
| The GiveWP WordPress plugin before 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records, allowing unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details. | ||||
| CVE-2026-18208 | 1 Redhat | 4 Build Keycloak, Jboss Data Grid, Jbosseapxp and 1 more | 2026-07-31 | 6.5 Medium |
| A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token. | ||||