Export limit exceeded: 386193 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 386193 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386193 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18233 | 2 Mstore, Wordpress | 2 Mstore Api, Wordpress | 2026-09-01 | 6.5 Medium |
| The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any payment being made. | ||||
| CVE-2026-18234 | 2 Mstore, Wordpress | 2 Mstore Api, Wordpress | 2026-09-01 | 6.5 Medium |
| The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscribers, to mark arbitrary orders as paid without any payment being taken. | ||||
| CVE-2026-77007 | 2 Higheredlab, Wordpress | 2 Hel Online Classroom: Ai-powered Online Classrooms, Wordpress | 2026-09-01 | 7.5 High |
| The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform any authorisation check on one of its REST API routes, allowing unauthenticated users to retrieve its stored settings, including the shared secret used to sign API requests to the connected BigBlueButton server. | ||||
| CVE-2026-77008 | 2 Higheredlab, Wordpress | 2 Hel Online Classroom: Ai-powered Online Classrooms, Wordpress | 2026-09-01 | 6.5 Medium |
| The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not have any authorisation or authentication check when saving its settings, allowing unauthenticated users to overwrite them and repoint every online classroom, along with the shared secret those sessions are signed with, at infrastructure of their choosing. | ||||
| CVE-2026-77010 | 2 Higheredlab, Wordpress | 2 Hel Online Classroom: Ai-powered Online Classrooms, Wordpress | 2026-09-01 | 6.5 Medium |
| The HEL Online Classroom: AI-powered Online Classrooms WordPress plugin through 1.0.3 does not perform authorisation checks on its REST API routes and does not consistently enforce the per-class access code, allowing unauthenticated users to obtain a signed meeting join link for any classroom, including one protected by an access code, and to join it with moderator privileges. | ||||
| CVE-2026-77704 | 2 Ameliabooking, Wordpress | 2 Booking For Appointments And Events Calendar, Wordpress | 2026-09-01 | 2.7 Low |
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not check that a user holds the required capability before letting them change an appointment's status, allowing customers to set arbitrary statuses on appointments they are booked on, including approving their own bookings that were left awaiting approval and overwriting another customer's booking status on a shared appointment. | ||||
| CVE-2026-81026 | 2 Stylemix, Wordpress | 2 Masterstudy Lms Wordpress Plugin, Wordpress | 2026-09-01 | 4.8 Medium |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.40 does not verify the amount, receiver, currency or status of a payment notification before marking the corresponding order completed, allowing unauthenticated users to complete full-price orders and gain access to paid content by paying only a token amount. | ||||
| CVE-2026-81200 | 2 Stylemix, Wordpress | 2 Masterstudy Lms Wordpress Plugin, Wordpress | 2026-09-01 | 2.7 Low |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.42 does not correctly restrict access to order information, allowing any user with the instructor role to read other users' order billing details, including name, email address, phone number and postal address, by enumerating order IDs. | ||||
| CVE-2026-81342 | 2 Stylemix, Wordpress | 2 Masterstudy Lms Wordpress Plugin, Wordpress | 2026-09-01 | 4.7 Medium |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.43 does not validate a redirect parameter supplied during user registration before using it, allowing unauthenticated attackers to redirect users to arbitrary external URLs. | ||||
| CVE-2026-19722 | 2 Wordpress, Wpvividplugins | 2 Wordpress, Wpvivid — Backup, Migration & Staging | 2026-09-01 | 6.6 Medium |
| The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not validate the destination of files extracted from a backup package during restoration, allowing high privilege users such as administrators to write arbitrary files outside the intended restore directory, which can lead to code execution. | ||||
| CVE-2026-78364 | 2 Mw Wp Form Project, Wordpress | 2 Mw Wp Form, Wordpress | 2026-09-01 | 3.5 Low |
| The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin. | ||||
| CVE-2026-81756 | 2 E-goi, Wordpress | 2 Smart Marketing Sms And Newsletters Forms, Wordpress | 2026-09-01 | 9.3 Critical |
| Unauthenticated SQL Injection in Smart Marketing SMS and Newsletters Forms <= 5.1.24 versions. | ||||
| CVE-2026-10579 | 1 Redhat | 2 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Els | 2026-09-01 | 9.8 Critical |
| A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws. | ||||
| CVE-2026-18649 | 1 Redhat | 3 Enterprise Linux, Rhel E4s, Rhel Eus | 2026-09-01 | 7.5 High |
| A flaw was found in the GStreamer gst-plugins-good package. The rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer used during fragmented RTP packet processing. A remote, unauthenticated attacker can send a continuous stream of RTP fragments without ever transmitting an end-of-fragment marker, causing the reassembly buffer to grow without bound until process memory is exhausted. This results in a denial of service through process termination. | ||||
| CVE-2026-84200 | 1 Kyverno | 1 Kyverno | 2026-09-01 | 9 Critical |
| Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0. | ||||
| CVE-2026-84194 | 1 Librenms | 1 Librenms | 2026-09-01 | N/A |
| LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery. When libvirt support is enabled (enable_libvirt=true), the device hostname ($this->getDevice()->hostname) is concatenated into shell commands (ssh, virsh list/dumpxml/domstate) in VminfoLibvirt.php and passed to exec() without escapeshellarg() or argument separation. An authenticated admin can set a crafted device hostname to inject arbitrary OS commands, leading to remote code execution in the discovery worker context. | ||||
| CVE-2026-84193 | 1 Librenms | 1 Librenms | 2026-09-01 | N/A |
| LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced data fields including BGP peer descriptions, VRF names, process information, and SLA tags. Attackers with device management access or network access to enroll a rogue SNMP device can inject malicious JavaScript that executes when admins view affected routing and device pages, enabling credential theft and CSRF token exfiltration. | ||||
| CVE-2026-84189 | 1 Librenms | 1 Librenms | 2026-09-01 | 8.1 High |
| LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0. | ||||
| CVE-2026-84188 | 1 Librenms | 1 Librenms | 2026-09-01 | 4.8 Medium |
| LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr.<graphtype> configuration settings, which are echoed verbatim without HTML escaping in includes/html/pages/graphs.inc.php. An administrator can store a malicious HTML payload that executes in the browser of any authenticated user who views the affected graph type. The issue is fixed in version 26.7.0. | ||||
| CVE-2023-54356 | 1 Kyverno | 1 Kyverno | 2026-09-01 | 3.7 Low |
| Kyverno versions 1.9.4 and earlier support insecure 3DES cipher suites (TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA and TLS_RSA_WITH_3DES_EDE_CBC_SHA) on their TLS endpoints. These 64-bit block ciphers are vulnerable to the Sweet32 attack (CVE-2016-2183), which, over very long-lived TLS connections carrying large volumes of traffic, could allow an attacker to recover small amounts of plaintext. The issue is fixed in Kyverno 1.9.5 and 1.10.0. | ||||