Export limit exceeded: 16588 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 16303 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 42612 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (42612 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16044 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2026-08-18 | 3.9 Low |
| Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID: MMSA-2026-00672 | ||||
| CVE-2026-15754 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2026-08-18 | 4.2 Medium |
| Mattermost versions 11.7.x <= 11.7.6, 11.8.x <= 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC (attribute-based access control) policy assignments from channels outside their team via the policy unassign API after a channel has been moved to another team.. Mattermost Advisory ID: MMSA-2026-00718 | ||||
| CVE-2026-10527 | 1 Mattermost | 2 Mattermost, Mattermost Server | 2026-08-18 | 6.3 Medium |
| Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Advisory ID: MMSA-2026-00691 | ||||
| CVE-2026-74003 | 2 Rometheme, Wordpress | 2 Romethemeform For Elementor, Wordpress | 2026-08-18 | 4.3 Medium |
| Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions. | ||||
| CVE-2026-73367 | 2 Supsystic, Wordpress | 2 Easy Google Maps, Wordpress | 2026-08-18 | 7.2 High |
| Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | ||||
| CVE-2026-73352 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-08-18 | 6.5 Medium |
| Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. | ||||
| CVE-2026-73187 | 2 Gingerplugins, Wordpress | 2 Sticky Chat Widget, Wordpress | 2026-08-18 | 9.3 Critical |
| Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions. | ||||
| CVE-2026-67262 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-08-18 | 8.1 High |
| Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls and leading to protection mechanism bypass. | ||||
| CVE-2026-66622 | 2 Averta, Wordpress | 2 Depicter Slider, Wordpress | 2026-08-18 | 7.5 High |
| Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions. | ||||
| CVE-2026-55106 | 1 Goauthentik | 1 Authentik | 2026-08-18 | 5.3 Medium |
| authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the diagnostic action against a configured LDAP Source. The server then connects to the upstream directory using the source's configured bind credentials and returns a bounded set of directory entries. The response exposes the distinguished names of those entries and the names of the attributes present on them, revealing directory structure, naming conventions, and the existence of specific accounts and groups, but not attribute values. Deployments without a configured LDAP Source are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5. | ||||
| CVE-2026-48508 | 1 Netflix | 1 Lemur | 2026-08-18 | 8.8 High |
| Lemur manages TLS certificate creation. Prior to 1.9.1, StrictRolePermission and AuthorityCreatorPermission in lemur/auth/permissions.py call flask_principal.Permission.__init__() with zero Need objects when ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT are unset because both flags default to False. Flask-Principal Permission.allows() returns True when self.needs is empty, so the .can() authorization gate permits every authenticated identity, including the read-only role. A read-only user can access POST /api/1/authorities, POST /api/1/certificates/upload, POST /api/1/pending_certificates//upload, POST /api/1/notifications, PUT or DELETE /api/1/notifications/, and POST /api/1/domains to create root Certificate Authorities, upload arbitrary certificates, create or edit notifications that reach an SSRF sink, and create domain entries. Explicitly setting either flag to False continues to opt into the permissive behavior. This issue is fixed in version 1.9.1. | ||||
| CVE-2026-17582 | 2 Quantumcloud, Wordpress | 2 Slider Hero With Video Background, Animation, Wordpress | 2026-08-18 | 4.9 Medium |
| The Slider Hero plugin for WordPress is vulnerable to second-order SQL Injection in versions up to, and including, 9.1.7 via the qcld_sliderhero_duplicate() function. Slide data (description, title, btn, btn2, image_link, custom, etc.) is stored safely via $wpdb->update() with %s placeholders in the qchero_save_image AJAX handler, but when an administrator triggers the 'heroduplicateslider' task, qcld_sliderhero_duplicate() re-reads every slide column and concatenates the raw values directly into an INSERT VALUES tuple that is then executed with $wpdb->query() — with no $wpdb->prepare(), esc_sql(), or _real_escape_string in between. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-12248 | 2 Wordpress, Wpml | 2 Wordpress, Wpml Multilingual Cms | 2026-08-18 | 6.5 Medium |
| The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with translator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-73339 | 2 Webnus, Wordpress | 2 Modern Events Calendar, Wordpress | 2026-08-18 | 9.3 Critical |
| Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | ||||
| CVE-2026-65959 | 1 Vitessio | 1 Vitess | 2026-08-18 | 5.3 Medium |
| Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote caller who can reach the vttablet debug HTTP port can bypass the configured security policy and stream VrLogStats data produced from NewVrLogStats().Send(), including literal SQL statements and bound application values from MoveTables, Reshard, Materialize, and vitess-strategy Online DDL workflows | ||||
| CVE-2026-54730 | 1 Goauthentik | 1 Authentik | 2026-08-18 | N/A |
| authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran. Affected enterprise deployments place either a Google Chrome Endpoint stage with mode set to REQUIRED or the deprecated Google Chrome Device Trust Connector stage in an authentication flow. The device attestation occurs in a verification iframe that calls the Google Verified Access API and records the verified device on success, but the vulnerable stages treat the flow as passed as soon as the stage is submitted. An attacker who can reach such a stage, including after primary username and password authentication, can skip the verification iframe and authenticate from a device that was never verified. Where device trust is the only additional factor, that protection is fully bypassed, while other configured factors remain in force. This issue is fixed in versions 2026.2.6 and 2026.5.5. | ||||
| CVE-2026-69146 | 1 Mlflow | 1 Mlflow | 2026-08-18 | 6.5 Medium |
| MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to call POST /api/2.0/mlflow/runs/log-inputs for another user's run_id and inject attacker-controlled DatasetInput records into the dataset_inputs lineage metadata without UPDATE permission. This issue is fixed in version 3.15.0. | ||||
| CVE-2026-68939 | 1 Pyenv | 1 Pyenv | 2026-08-18 | N/A |
| Pyenv provides simple Python version management. Prior to 2.8.0, is_version_safe() in libexec/pyenv-version-file-read accepts shell glob metacharacters in .python-version values, and unquoted PYENV_VERSION expansion in libexec/pyenv-version-name, libexec/pyenv-which, libexec/pyenv-prefix, libexec/pyenv-local, libexec/pyenv-global, libexec/pyenv-version, and libexec/pyenv-versions pathname-expands the value against the current directory, allowing a matching attacker-controlled file to silently select a different installed interpreter or version. This issue is fixed in version 2.8.0. | ||||
| CVE-2026-45121 | 1 Mybb | 1 Mybb | 2026-08-18 | 4.3 Medium |
| MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40. | ||||
| CVE-2026-67917 | 1 Azuracast | 1 Azuracast | 2026-08-18 | 9.8 Critical |
| zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The `azuracast:restore` command executes the `db.sql` file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate privileges | ||||