Export limit exceeded: 376878 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376878 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18035 | 2 User Access Manager Project, Wordpress | 2 User Access Manager, Wordpress | 2026-08-13 | 5.3 Medium |
| The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups. | ||||
| CVE-2026-18048 | 2 Wordpress, Wp Photo Album Plus Project | 2 Wordpress, Wp Photo Album Plus | 2026-08-13 | 7.5 High |
| The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root. | ||||
| CVE-2026-18049 | 2 Wordpress, Wp Photo Album Plus Project | 2 Wordpress, Wp Photo Album Plus | 2026-08-13 | 7.5 High |
| The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix. | ||||
| CVE-2026-18057 | 2 Events Manager Project, Wordpress | 2 Events Manager, Wordpress | 2026-08-13 | 8.1 High |
| The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people. | ||||
| CVE-2026-18230 | 2 Wordpress, Wpdirectorykit | 2 Wordpress, Wp Directory Kit | 2026-08-13 | 8.1 High |
| The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks. | ||||
| CVE-2026-18366 | 2 Events Manager Project, Wordpress | 2 Events Manager, Wordpress | 2026-08-13 | 9.8 Critical |
| The Events Manager WordPress plugin before 7.4.1 does not properly scope its capability mapping, discarding the access control decisions WordPress already made for unrelated privileged actions, which allows unauthenticated users to change the password of, escalate to Administrator, or delete any account whose user ID happens to match the ID of one of the Events Manager WordPress plugin before 7.4.1's own posts. | ||||
| CVE-2026-18391 | 2 Woocommerce, Wordpress | 2 Subscriptions, Wordpress | 2026-08-13 | 9.8 Critical |
| The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies. | ||||
| CVE-2026-18474 | 2 Wordpress, Wpdirectorykit | 2 Wordpress, Wp Directory Kit | 2026-08-13 | 8.6 High |
| The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured. | ||||
| CVE-2026-53996 | 1 Netbsd | 1 Netbsd | 2026-08-13 | 7 High |
| NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access check on /dev/hdaudioN device nodes. Attackers can repeatedly issue HDAUDIO_FGRP_SETCONFIG from one thread while keeping DMA and IRQs live from a second thread to trigger a use-after-free race condition in hdafg_detach() between stream_stop() and stream_disestablish(), where a latched DMA interrupt dereferences a freed callback pointer, resulting in outcomes ranging from audio-subsystem denial of service and kernel panic to potential local kernel privilege escalation. | ||||
| CVE-2026-4901 | 3 Control System, Hydrosystem, Hydrosystem.poznan | 3 Alanweb Scada, Control System, Control System | 2026-08-13 | 6.5 Medium |
| AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5 | ||||
| CVE-2026-34185 | 3 Control System, Hydrosystem, Hydrosystem.poznan | 3 Alanweb Scada, Control System, Control System | 2026-08-13 | 8.8 High |
| AlanWeb SCADA is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database. This issue was fixed in AlanWeb SCADA version 9.8.5 | ||||
| CVE-2026-34184 | 3 Control System, Hydrosystem, Hydrosystem.poznan | 3 Alanweb Scada, Control System, Control System | 2026-08-13 | 9.1 Critical |
| AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database. This issue was fixed in AlanWeb SCADA version 9.8.5 | ||||
| CVE-2026-67974 | 1 Nasa | 1 Cfs | 2026-08-13 | 7.5 High |
| A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet. | ||||
| CVE-2026-66151 | 1 Sonicwall | 1 Global Vpn Client | 2026-08-13 | 5.5 Medium |
| SonicWall Global VPN Client version 4.10.8.1108 and earlier is vulnerable to an out-of-bounds kernel memory read in the SWIPsec.sys driver, which could allow a local attacker to cause a system crash. | ||||
| CVE-2026-16267 | 2026-08-13 | 8.1 High | ||
| The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects. | ||||
| CVE-2026-16574 | 2 Dokan, Wordpress | 2 Ai Powered Woocommerce Multivendor Marketplace Solution:dokan: Ai Powered Woocommerce Multivendor Marketplace Solution, Wordpress | 2026-08-13 | 5.4 Medium |
| The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.0.11 does not verify that a downloadable product belongs to the requesting vendor before granting download permissions through one of its order REST endpoints, allowing an authenticated vendor to grant their own customer free download access to another vendor's paid downloadable files. | ||||
| CVE-2026-16608 | 2 Download Monitor, Wordpress | 2 Download Monitor, Wordpress | 2026-08-13 | 5.3 Medium |
| The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and inflate a site's download statistics. | ||||
| CVE-2026-16948 | 2 Solacewp, Wordpress | 2 Solace Extra, Wordpress | 2026-08-13 | 8.1 High |
| The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content. | ||||
| CVE-2026-16965 | 2026-08-13 | 4.3 Medium | ||
| The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrary posts and to deactivate the site's active templates. | ||||
| CVE-2026-16992 | 2026-08-13 | 6.5 Medium | ||
| The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticated attackers to read unpublished content and to make it publicly available. | ||||