Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423974 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66379 | 1 Jfrog | 1 Artifactory | 2026-10-24 | 4.3 Medium |
| An authenticated user may view private Puppet module metadata without repository read access. | ||||
| CVE-2026-66703 | 2 Properfraction, Wordpress | 2 Mailoptin, Wordpress | 2026-10-24 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. | ||||
| CVE-2026-66470 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-10-24 | 7.1 High |
| Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. | ||||
| CVE-2026-65551 | 2 Soflyy, Wordpress | 2 Breakdance, Wordpress | 2026-10-24 | 7.5 High |
| Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdance: from n/a before 2.7. | ||||
| CVE-2026-65578 | 2026-10-24 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Agora <= 1.9 versions. | ||||
| CVE-2026-65552 | 2 Qlstudio, Wordpress | 2 Export User Data, Wordpress | 2026-10-24 | 9.8 Critical |
| Subscriber PHP Object Injection in Export User Data <= 2.2.6 versions. | ||||
| CVE-2026-66431 | 2 Woompaloompa, Wordpress | 2 Bitcoin Lightning Payment Gateway For Woocommerce (via Clink), Wordpress | 2026-10-24 | 7.5 High |
| Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions. | ||||
| CVE-2026-67589 | 1 Apache | 2 Qpid Proton-j, Qpid Protonj2 | 2026-10-24 | 7.5 High |
| A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue. | ||||
| CVE-2026-58247 | 1 Sap | 1 Abap Platform | 2026-10-24 | 5.3 Medium |
| SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used memory, leading to a low on confidentiality, with no impact on integrity and availability of the application. | ||||
| CVE-2026-58248 | 1 Sap Se | 1 Sap Business Objects Business Intelligence Platform | 2026-10-24 | 6.5 Medium |
| SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external references. When the file is processed as a data source, the affected component resolves these references and exposes the contents of sensitive server-side files within the resulting report. This results in a high impact on confidentiality, with no impact on integrity and availability. | ||||
| CVE-2026-63299 | 1 Canonical | 1 Lxd | 2026-10-24 | 8.5 High |
| An authorization bypass vulnerability in LXD allows an authenticated user to bypass project-level disk and volume limits. Two related code paths fail to verify resource limits during volume operations: the storagePoolVolumeTypePostMove function omits the limits.AllowVolumeCreation check before moving a volume across projects, and volume snapshot restore operations skip the AllowVolumeUpdate check when the configuration is nil (Config == nil). An attacker can exploit these flaws to allocate storage resources that exceed the administrative limits configured for a project. | ||||
| CVE-2026-63426 | 1 Lenovo | 1 Dock Manager | 2026-10-24 | 7.1 High |
| During an internal security assessment, a potential vulnerability was discovered in Lenovo Dock Manager that could allow an authenticated local user to perform an arbitrary file deletion with elevated privileges. | ||||
| CVE-2026-65513 | 2 Nsquared, Wordpress | 2 Simply Schedule Appointments, Wordpress | 2026-10-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.12.10 versions. | ||||
| CVE-2026-65546 | 2 Qode, Wordpress | 2 Qode Tours, Wordpress | 2026-10-24 | 9.3 Critical |
| Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | ||||
| CVE-2026-65553 | 2 Wbolt.com, Wordpress | 2 Spider Analyser – Wordpress搜索引擎蜘蛛分析插件, Wordpress | 2026-10-24 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. | ||||
| CVE-2026-65565 | 2 Ays-pro, Wordpress | 2 Survey Maker, Wordpress | 2026-10-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions. | ||||
| CVE-2026-65570 | 2026-10-24 | 8.1 High | ||
| Unauthenticated Bypass Vulnerability in Login with phone number <= 1.8.70 versions. | ||||
| CVE-2026-65573 | 2 Themerex, Wordpress | 2 Abelle, Wordpress | 2026-10-24 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Abelle <= 1.22 versions. | ||||
| CVE-2026-65933 | 1 Silabs.com | 1 Bt122 | 2026-10-24 | N/A |
| A malformed Bluetooth connection request message can cause the BT122 to leak potentially sensitive information. See vulnerability B-E4 in the related paper below. | ||||
| CVE-2026-66275 | 1 Apache | 1 Qpid Proton-j | 2026-10-24 | 6.5 Medium |
| An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue. | ||||