Export limit exceeded: 46764 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46764 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-4362 | 2 Roxnor, Wordpress | 2 Elementskit Elementor Addons – Advanced Widgets & Templates Addons For Elementor, Wordpress | 2026-05-05 | 6.5 Medium |
| The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `Live_Action::reset()` function in all versions up to, and including, 3.8.2 The function is hooked to the WordPress `init` action and triggers when both `post` and `action=elementor` GET parameters are present, with no authentication or nonce verification. This makes it possible for unauthenticated attackers to overwrite the Elementor content (`_elementor_data`) of any `elementskit_widget` custom post type by visiting a specially crafted URL. The widget's custom designs, text, and configurations are permanently replaced with a blank template. | ||||
| CVE-2026-43530 | 1 Openclaw | 1 Openclaw | 2026-05-05 | 8.8 High |
| OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run. Attackers can exploit opaque multi-call binaries to bypass exec approval mechanisms and weaken risk classification of unsafe applet invocations. | ||||
| CVE-2026-43573 | 1 Openclaw | 1 Openclaw | 2026-05-05 | 7.7 High |
| OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypass SSRF navigation guards to interact with or navigate to unauthorized targets without policy enforcement. | ||||
| CVE-2026-43572 | 1 Openclaw | 1 Openclaw | 2026-05-05 | 5.3 Medium |
| OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender allowlist checks. Attackers can bypass sender authorization by sending SSO invoke requests that are processed without proper validation, allowing unauthorized access to Teams SSO signin functionality. | ||||
| CVE-2026-32736 | 1 Hytalemodding | 1 Wiki | 2026-05-05 | 4.3 Medium |
| The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. An Insecure Direct Object Reference (IDOR) vulnerability in versions of the wiki prior to 1.0.0 exposes mod authors' personal information - including full names and email addresses - to any authenticated user who visits a mod page. Any user who creates an account can access sensitive author details by simply navigating to a mod's page via its slug. Version 1.0.0 fixes the issue. | ||||
| CVE-2026-43567 | 1 Openclaw | 1 Openclaw | 2026-05-05 | 6.5 Medium |
| OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards. Attackers can exploit this by specifying an outPath outside the workspace boundary to write files to unintended locations on the system. | ||||
| CVE-2026-42433 | 1 Openclaw | 1 Openclaw | 2026-05-05 | 6.5 Medium |
| OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requiring admin-level authority. Attackers can exploit insufficient access controls to mutate persistent profile configuration through non-owner message-tool runs. | ||||
| CVE-2026-5712 | 2 Sailpoint, Sailpoint Technologies | 2 Identityiq, Identityiq | 2026-05-05 | 8 High |
| This vulnerability impacts all versions of IdentityIQ and allows an authenticated identity that is the requestor or assignee of a work item to edit the definition of a role without having an assigned capability that would allow role editing. | ||||
| CVE-2026-42434 | 1 Openclaw | 1 Openclaw | 2026-05-05 | 8.8 High |
| OpenClaw versions 2026.4.5 before 2026.4.10 contain a sandbox escape vulnerability allowing sandboxed agents to override exec routing by specifying host=node. Attackers can bypass sandbox boundaries and route execution to remote nodes instead of intended sandbox paths. | ||||
| CVE-2026-43571 | 1 Openclaw | 1 Openclaw | 2026-05-05 | 8.8 High |
| OpenClaw before 2026.4.10 contains a plugin trust bypass vulnerability that allows channel setup catalog lookups to resolve workspace plugin shadows before bundled channel plugins. Attackers can exploit this by crafting malicious workspace plugins that bypass intended trust gates during setup-time plugin loading. | ||||
| CVE-2026-7743 | 1 Codeastro | 1 Online Classroom | 2026-05-05 | 6.3 Medium |
| A vulnerability has been found in CodeAstro Online Classroom 1.0. The impacted element is an unknown function of the file /OnlineClassroom/studentdetails. The manipulation of the argument deleteid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-7731 | 1 Code-projects | 1 Blood Bank Management System | 2026-05-05 | 6.3 Medium |
| A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. The affected element is an unknown function of the file get_state.php. The manipulation of the argument G_STATE_ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-7694 | 1 Acrel Electrical | 1 Ecems Enterprise Microgrid Energy Efficiency Management System | 2026-05-05 | 7.3 High |
| A flaw has been found in Acrel Electrical ECEMS Enterprise Microgrid Energy Efficiency Management System 1.3.0. The impacted element is an unknown function of the file /SubstationWEBV2/main/elecMaxMinAvgValue. Executing a manipulation of the argument fCircuitids can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-35370 | 1 Uutils | 1 Coreutils | 2026-05-04 | 4.4 Medium |
| The id utility in uutils coreutils miscalculates the groups= section of its output. The implementation uses a user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils. Because many scripts and automated processes rely on the output of id to make security-critical access-control or permission decisions, this discrepancy can lead to unauthorized access or security misconfigurations. | ||||
| CVE-2025-63547 | 1 Eprosima | 1 Micro-xrec-dds Agent | 2026-05-04 | 7.5 High |
| An issue in Eprosima Micro-XREC-DDS Agent v.3.0.1 allows a remote attacker to cause a denial of service via a crafted packet to the MTU length field | ||||
| CVE-2026-42474 | 1 Mix-php | 1 Mix | 2026-05-04 | 6.5 Medium |
| SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `data` array to the data function in BuildHelper.php. | ||||
| CVE-2026-42475 | 2 Mix-php, Openmix | 2 Mix, Mix Php | 2026-05-04 | 6.5 Medium |
| SQL injection vulnerability in MixPHP Framework 2.x thru 2.2.17 via crafted `on` array to the joinOn function in BuildHelper.php. | ||||
| CVE-2026-7632 | 1 Code-projects | 1 Online Hospital Management System | 2026-05-04 | 7.3 High |
| A vulnerability was determined in code-projects Online Hospital Management System 1.0. This affects an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-7716 | 1 Code-projects | 2 Gym Management System, Windows Nt | 2026-05-04 | 6.3 Medium |
| A vulnerability was found in code-projects Gym Management System In PHP and Windows NT 1.0. This vulnerability affects unknown code of the file /index.php. Performing a manipulation of the argument day results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. | ||||
| CVE-2026-3143 | 2 Boldgrid, Wordpress | 2 Total Upkeep – Wordpress Backup Plugin Plus Restore & Migrate By Boldgrid, Wordpress | 2026-05-04 | 5.3 Medium |
| The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_ajax_cli_cancel' function in all versions up to, and including, 1.17.1. This makes it possible for unauthenticated attackers to cancel a pending rollback, potentially preventing a WordPress installation from automatically reverting a failed update. | ||||