Export limit exceeded: 368574 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10354 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10354 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15034 | 1 Flask-dashboard | 1 Flask-monitoringdashboard | 2026-07-08 | 4.3 Medium |
| A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-59999 | 1 Openbsd | 1 Openssh | 2026-07-08 | 5.9 Medium |
| In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not. | ||||
| CVE-2026-12064 | 1 Curl | 1 Curl | 2026-07-07 | 7.5 High |
| When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. | ||||
| CVE-2026-59713 | 1 Leantime | 1 Leantime | 2026-07-07 | 8.1 High |
| Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fixation, logging victims in as the attacker. | ||||
| CVE-2026-34171 | 1 Coollabsio | 1 Coolify | 2026-07-07 | 8 High |
| Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the GET /invitations/{uuid} endpoint can perform a state-changing password reset using an attacker-known invitation UUID, allowing an attacker who can cause a victim to visit the crafted invitation URL to reset the victim account password to a predictable value. This issue is fixed in version 4.0.0-beta.471. | ||||
| CVE-2024-54216 | 1 Reputeinfosystems | 1 Arforms | 2026-07-07 | 7.7 High |
| Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2. | ||||
| CVE-2026-58518 | 1 Wikimedia | 1 Mediawiki-redirectmanager Extension | 2026-07-06 | N/A |
| Cross-Site request forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - RedirectManager Extension allows Cross Site Request Forgery. This issue affects Mediawiki - RedirectManager Extension: from * before 1.3.3. | ||||
| CVE-2026-54431 | 1 Openidc | 1 Liboauth2 | 2026-07-06 | 5.3 Medium |
| In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a malformed DPoP proof that embeds the private Elliptic Curve (EC) key in the header. This issue was fixed in version 2.3.0 | ||||
| CVE-2026-49779 | 2 Addify, Wordpress | 2 Tax Exempt For Woocommerce, Wordpress | 2026-07-06 | 6.5 Medium |
| Customer Path Traversal in Tax Exempt for WooCommerce <= 1.9.3 versions. | ||||
| CVE-2026-57690 | 2 Fuelthemes, Wordpress | 2 Werkstatt, Wordpress | 2026-07-06 | 4.3 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Werkstatt <= 4.7.2 versions. | ||||
| CVE-2026-57751 | 2 Heateor Support, Wordpress | 2 Heateor Social Login, Wordpress | 2026-07-06 | 8.1 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions. | ||||
| CVE-2026-57757 | 2 Ploudapp, Wordpress | 2 Pcloud Wp Backup, Wordpress | 2026-07-06 | 7.1 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in pCloud WP Backup <= 2.0.2 versions. | ||||
| CVE-2026-57761 | 2 Blueastralthemes, Wordpress | 2 Seowp, Wordpress | 2026-07-06 | 7.1 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in SEOWP <= 3.12.2 versions. | ||||
| CVE-2026-12740 | 1 Cornelius | 1 Plack::middleware::oauth | 2026-07-06 | 8.1 High |
| Plack::Middleware::OAuth versions through 0.10 for Perl do not support the OAuth 2.0 state parameter. RequestTokenV2 builds the provider authorization redirect without issuing a state value, and AccessTokenV2 exchanges the callback code and registers the resulting token into the session (register_session) without verifying that the callback corresponds to an authorization request this session initiated. Any application that uses this middleware for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim's session to complete the attacker's authorization and associating the attacker's provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim's account through their own provider credentials. | ||||
| CVE-2026-59520 | 2 Properfraction, Wordpress | 2 Crawlwp Seo, Wordpress | 2026-07-06 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in properfraction CrawlWP SEO allows Cross Site Request Forgery. This issue affects CrawlWP SEO: from n/a through 3.0.16. | ||||
| CVE-2026-58297 | 1 Microsoft | 1 Edge Chromium | 2026-07-06 | 7.1 High |
| Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-58597 | 1 Microsoft | 1 Edge Chromium | 2026-07-06 | 4.3 Medium |
| Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-14620 | 2026-07-06 | 4.7 Medium | ||
| webpack-dev-server versions 5.2.5 and earlier expose two internal developer endpoints, /webpack-dev-server/open-editor and /webpack-dev-server/invalidate, that perform state-changing actions on any GET request without verifying that the request originated from the dev server's own page. Any website a developer visits while the dev server is running can trigger these endpoints cross-origin with no interaction beyond the visit. An attacker can open an arbitrary existing local file in the developer's editor, including files outside the project root, and repeated requests can spawn editor processes and force recompilations that degrade the developer's machine. Patches: upgrade to webpack-dev-server 5.2.6. Workarounds: none. | ||||
| CVE-2026-58296 | 1 Microsoft | 1 Edge Chromium | 2026-07-06 | 7.1 High |
| Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-12746 | 2026-07-06 | 8.1 High | ||
| Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl do not support the OAuth 2.0 state parameter. The authentication_url method builds the provider authorization redirect without issuing a state value, and the callback method exchanges the callback code and registers the resulting token into the session without verifying that the callback corresponds to an authorization request this session initiated. Any application that uses this plugin for OAuth 2.0 login is exposed to login cross-site request forgery: because the callback is not bound to the session that began the flow, an attacker who starts an authorization with their own provider account can deliver the resulting callback to a victim, causing the victim's session to complete the attacker's authorization and associating the attacker's provider identity and access token with that session. Where the application persists this as an account link, the attacker may retain access to the victim's account through their own provider credentials. | ||||