Export limit exceeded: 382270 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (382270 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-28152 | 2 Select-themes, Wordpress | 2 Tonda Core, Wordpress | 2026-08-24 | 8.1 High |
| Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | ||||
| CVE-2026-78245 | 1 Itsourcecode | 1 Online Pharmacy System | 2026-08-24 | 7.3 High |
| A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used. | ||||
| CVE-2026-78169 | 1 Utt | 1 Hiper 1250gw | 2026-08-24 | 9.9 Critical |
| A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit is now public and may be used. | ||||
| CVE-2026-78155 | 1 Ongres | 1 Stackgres | 2026-08-24 | 9.9 Critical |
| privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges | ||||
| CVE-2026-78136 | 1 Chirpmyradio | 1 Chirp | 2026-08-24 | 7.8 High |
| chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py. | ||||
| CVE-2026-77027 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector. | ||||
| CVE-2026-76606 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Path Traversal via image element in Fabrik < 4.7.2. | ||||
| CVE-2026-76605 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. | ||||
| CVE-2026-76602 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors. | ||||
| CVE-2026-76598 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders in Fabrik < 4.7.2 - The onAjax_getFolders method of the elements model allows arbitrary directory listings. | ||||
| CVE-2026-76597 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Unauthenticated arbitrary file upload to web root via list email plugin in Fabrik < 4.7.2 - The list email plugin controller allows to upload non-executable files to the webroot. | ||||
| CVE-2026-76596 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Unauthenticated table truncation via list.doempty in Fabrik < 4.7.2- The list controllers doemtpy endpoints lacks ACL gates, a plain GET empties the target list's table | ||||
| CVE-2026-74019 | 2 Paulepro2019, Wordpress | 2 Eprolo Dropshipping, Wordpress | 2026-08-24 | 7.1 High |
| Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. | ||||
| CVE-2026-71049 | 1 Oracle | 1 Product Lifecycle Analytics | 2026-08-24 | 8.5 High |
| Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues). The supported version that is affected is 3.6.1. Easily exploitable vulnerability allows low privileged attacker with network access via Oracle Net to compromise Oracle Product Lifecycle Analytics. While the vulnerability is in Oracle Product Lifecycle Analytics, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Product Lifecycle Analytics accessible data as well as unauthorized update, insert or delete access to some of Oracle Product Lifecycle Analytics accessible data. CVSS 3.1 Base Score 8.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N). | ||||
| CVE-2026-69238 | 1 Esri | 1 Portal For Arcgis | 2026-08-24 | 3.5 Low |
| There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. | ||||
| CVE-2026-69229 | 1 Esri | 1 Portal For Arcgis | 2026-08-24 | 5.4 Medium |
| There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that allows a remote, authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5 and 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. | ||||
| CVE-2026-69228 | 1 Esri | 1 Portal For Arcgis | 2026-08-24 | 5.3 Medium |
| There is a missing authentication vulnerability in Esri Portal for ArcGIS versions 12.0 and prior that may allow a remote, unauthenticated attacker to access a specific resource (not user content) that should only be accessible by authenticated users. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, or 12.0 are encouraged to patch. All users are advised to upgrade to the latest long-term support release. | ||||
| CVE-2026-69225 | 1 Esri | 1 Portal For Arcgis | 2026-08-24 | 5.9 Medium |
| There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 11.5 through 12.0 and earlier that may allow a remote, unauthenticated attacker to reflect sensitive information in a http response body. | ||||
| CVE-2026-69224 | 1 Esri | 1 Portal For Arcgis | 2026-08-24 | 5.9 Medium |
| There is an information disclosure vulnerability in Esri Portal for ArcGIS versions 12.0 and earlier that may under difficult to reproduce circumstances allow a remote, unauthenticated attacker to reflect sensitive information in a http response body. | ||||
| CVE-2026-66607 | 2 Themehunk, Wordpress | 2 Advance Product Search, Wordpress | 2026-08-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Advance Product Search <= 1.4.8 versions. | ||||