Export limit exceeded: 10088 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 422008 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422008 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113961 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-10 | 7.5 High |
| An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A remote attacker may be able to join an iMessage group chat and receive its messages. | ||||
| CVE-2026-107244 | 1 Versa | 1 Vos | 2026-11-10 | N/A |
| The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /decryptTest endpoint of this service is registered in server.js before the session authentication middleware and creates an authenticated session whenever it receives a token that decrypts successfully. Because the key and initialization vector (IV) used for decryption are hardcoded and identical across all VOS appliances, an unauthenticated attacker with network access can compute a valid token, submit it to /decryptTest, and obtain a fully authenticated session without providing any credentials. Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled. | ||||
| CVE-2026-109832 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-11-10 | 7.5 High |
| A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS I/O handlers, retryable GnuTLS results (GNUTLS_E_AGAIN and GNUTLS_E_INTERRUPTED) are handled with an unbounded busy loop instead of yielding to the event loop. A remote attacker who can reach an enabled VNC TLS listener can cause the event-loop thread to spin at high CPU with no forward progress, resulting in denial of service. | ||||
| CVE-2026-109833 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-11-10 | 5.9 Medium |
| A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. In the VNC TLS read path, partial consumption of the internal peek buffer incorrectly moves remaining peeked bytes into the caller-supplied buffer instead of compacting the peek buffer. A remote attacker who can reach an enabled VNC TLS listener and trigger a peek/read size mismatch can cause an out-of-bounds write, leading to denial of service. | ||||
| CVE-2026-10077 | 1 Wordpress-extensions | 1 Yootheme Pro | 2026-11-10 | 6.8 Medium |
| The yootheme WordPress theme before 5.0.35 does not prevent its bundled front-end framework from treating certain HTML attributes, which are permitted by wp_kses_post(), as markup, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the browser of any user who views the affected post. | ||||
| CVE-2026-11781 | 1 Wordpress-extensions | 1 Adminify | 2026-11-10 | 2.7 Low |
| The Adminify WordPress plugin before 4.2.10 does not perform per-user read-capability checks on the results returned by one of its administration search features, allowing users with a low-privilege role (Contributor) to disclose non-public content that WordPress would not otherwise expose to them, such as other authors' unpublished post titles, pending comment content, the site's Adminify WordPress plugin before 4.2.10 inventory, and user account names. | ||||
| CVE-2025-69094 | 2 Thememove, Wordpress-extensions | 2 Unicamp, Unicamp | 2026-11-10 | 8.5 High |
| Subscriber SQL Injection in Unicamp <= 2.2.2 versions. | ||||
| CVE-2024-6228 | 1 Wordpress-extensions | 1 Wanotifier | 2026-11-10 | 7.5 High |
| The Notifications for Forms & WordPress Actions WordPress plugin before 2.6 does not validate a user-supplied value before using it to build a server-side file inclusion path, allowing authenticated users with subscriber-level access and above to include and execute arbitrary local PHP files on the server. | ||||
| CVE-2026-10830 | 1 Wordpress-extensions | 1 Allcoach | 2026-11-10 | 8.8 High |
| The AllCoach WordPress plugin before 1.0.2 does not verify that an email address submitted to a public account-registration endpoint is not already associated with an existing user before overwriting that user's password, allowing unauthenticated attackers to reset the password of arbitrary accounts, including administrators, and take over the site. | ||||
| CVE-2026-10834 | 1 Wordpress-extensions | 1 Wp Travel Engine | 2026-11-10 | 4.6 Medium |
| The WP Travel Engine WordPress plugin before 6.8.1 does not properly validate the source of a user-supplied profile image path before moving the file, allowing authenticated users with subscriber-level access and above to relocate arbitrary files within the WordPress uploads directory into their own profile-image path. This removes the targeted media from its original location and can break content across the site. | ||||
| CVE-2026-11571 | 1 Wordpress-extensions | 1 Everest Forms | 2026-11-10 | 7.5 High |
| The Everest Forms WordPress plugin before 3.5.0 does not reliably delete temporary CSV files generated during email-notification processing and leaves them publicly accessible in the uploads directory, allowing unauthenticated attackers to retrieve other users' form submission records via predictable, enumerable filenames. | ||||
| CVE-2026-10551 | 1 Wordpress-extensions | 1 Breeze Cache | 2026-11-10 | 6.1 Medium |
| The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format. | ||||
| CVE-2026-124503 | 1 Sooperset | 1 Mcp-atlassian | 2026-11-10 | 4.3 Medium |
| A vulnerability was identified in sooperset mcp-atlassian up to 0.24.0. This issue affects the function validate_safe_path of the file src/mcp_atlassian/utils/io.py. The manipulation of the argument path leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 0.24.1 is capable of addressing this issue. Upgrading the affected component is recommended. This CVE was requested by the vendor. | ||||
| CVE-2025-15665 | 1 Wordpress-extensions | 1 Beaf | 2026-11-10 | 5.4 Medium |
| The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortcode field before outputting it on the front end (the value is passed through do_shortcode, which echoes non-shortcode content verbatim), allowing users with administrator-level access to store a script that executes in the browser of any visitor who loads a page displaying the widget. | ||||
| CVE-2026-11563 | 1 Wordpress-extensions | 1 Word Count And Social Shares | 2026-11-10 | 9.6 Critical |
| The Word Count and Social Shares WordPress plugin through 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks, allowing any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g. by deleting wp-config.php). | ||||
| CVE-2026-11371 | 1 Wordpress-extensions | 1 Betterdocs | 2026-11-10 | 6.1 Medium |
| The BetterDocs WordPress plugin before 4.5.5 does not sanitise an AI-generated documentation summary before storing and outputting it, and the feature that generates it is exposed to unauthenticated users, allowing them to store a malicious payload via prompt injection that executes in the browser of any visitor who views the affected page, including administrators. | ||||
| CVE-2026-10525 | 1 Wordpress-extensions | 1 Nex-forms | 2026-11-10 | 6.1 Medium |
| The NEX-Forms WordPress plugin before 9.2.3 does not sanitise and escape some submitted form data before storing it and outputting it back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as administrators when they view the submitted entries. | ||||
| CVE-2026-10081 | 1 Wordpress-extensions | 1 Unlimited Elements For Elementor | 2026-11-10 | 8.8 High |
| The Unlimited Elements For Elementor WordPress plugin before 2.0.11 does not sanitize or escape Google review content fetched from the Serp API before rendering it in the Google Reviews widget output, allowing unauthenticated attackers who submit a malicious review on the targeted business's Google listing to deliver Stored XSS to any visitor (including administrators) of any WP page displaying that Place ID's reviews. | ||||
| CVE-2026-10724 | 1 Wordpress-extensions | 1 Reviews Feed | 2026-11-10 | 4.8 Medium |
| The Reviews Feed WordPress plugin before 2.6.5 does not neutralize WordPress shortcodes contained in third-party review content before rendering it through its dynamic block, allowing unauthenticated attackers to execute arbitrary shortcodes on pages that display the feed by planting a shortcode in a review on the connected source. | ||||
| CVE-2026-11349 | 1 Wordpress-extensions | 2 Modern Events Calendar Lite, Modern Events Calendar Pro | 2026-11-10 | 8.6 High |
| The Modern Event Calendar Pro WordPress plugin before 7.34.0, Modern Events Calendar Lite WordPress plugin before 7.34.0 do not sanitise and escape a request parameter before using it in a SQL statement, through an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection vulnerability that allows attackers to extract sensitive data from the database. | ||||