Export limit exceeded: 413228 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413228 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413228 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111845 | 2 Wordpress-extensions, Yithemes | 2 Yith Woocommerce Product Bundles, Yith Woocommerce Product Bundles | 2026-10-21 | 5.3 Medium |
| Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH WooCommerce Product Bundles: from n/a through 2.29.0. | ||||
| CVE-2026-110008 | 1 Fastify | 1 Fastify/oauth2 | 2026-10-21 | 4.2 Medium |
| @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set without a Path attribute at a login route with two or more path segments, while the clearing step at the OAuth callback writes them with a root path, so the original cookies survive the callback and the documented single-use guarantee for the state value does not hold. A state value an attacker learns stays valid for the rest of the browser session, letting the attacker drive their own authorization flow in the victim's browser and sign the victim in to the attacker's account (login CSRF). The issue is fixed in @fastify/oauth2 8.3.2, and users should upgrade to 8.3.2 or later. As a workaround, set an explicit cookie path so the set and the clear name the same cookie. | ||||
| CVE-2026-110902 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-10-21 | 4.3 Medium |
| Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.1. | ||||
| CVE-2026-112222 | 2 Surfer, Wordpress-extensions | 2 Surfer, Surfer | 2026-10-21 | 5.4 Medium |
| Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through 1.8.0.744. | ||||
| CVE-2026-111828 | 2 Mamunur Rashid, Wordpress-extensions | 2 Classified Listing, Classified Listing | 2026-10-21 | 4.3 Medium |
| Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classified Listing: from n/a through 6.1.5. | ||||
| CVE-2026-111936 | 1 Aleksey-hoffman | 1 Sigma File Manager | 2026-10-21 | 4.3 Medium |
| Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validate_remote_url() in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud metadata addresses to read internal responses via files written to the extension directory. | ||||
| CVE-2026-112262 | 1 Risingwavelabs | 1 Risingwave | 2026-10-21 | 7.1 High |
| RisingWave before 3.1.0 contains a missing authorization vulnerability that allows low-privileged SQL users to read and write arbitrary server files by creating posix_fs sources and fs sinks. Attackers holding schema CREATE privilege can set posix_fs.root or fs.path to any directory to read credentials and keys or write files as root. | ||||
| CVE-2026-112268 | 1 Sgl-project | 1 Sglang | 2026-10-21 | 6.3 Medium |
| sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key to access mesh HA management routes because /ha/* endpoints skip control-plane Admin role checks. Attackers can read cluster topology, write gossiped configuration, change global rate limits, and call POST /ha/shutdown to silently dissolve HA coordination. | ||||
| CVE-2026-112271 | 1 Emersion | 1 Libdisplay-info | 2026-10-21 | 5.5 Medium |
| libdisplay-info through 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v1 section parser in displayid.c that occurs when a data block's declared length exceeds the section. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or EDID file to make is_all_zeroes read past the buffer, causing a possible crash. | ||||
| CVE-2026-112272 | 1 Emersion | 1 Libdisplay-info | 2026-10-21 | 5.5 Medium |
| Libdisplay-info 0.4.0 contains a heap out-of-bounds read vulnerability in the DisplayID v2 section parser in displayid2.c that allows attackers to read past the EDID buffer via oversized data block lengths. Attackers can supply a crafted EDID from a malicious monitor, KVM, capture device, or file to over-advance the parse cursor and crash applications. | ||||
| CVE-2026-112274 | 1 Libtins | 1 Libtins | 2026-10-21 | 3.7 Low |
| libtins through 4.6 contains an out-of-bounds read vulnerability in DNS::soa_record::init that allows remote attackers to read past buffer bounds by supplying SOA data lacking NUL terminators. Attackers can feed raw SOA RDATA without a zero byte to applications using the buffer constructor, causing strlen to overrun the heap buffer and possibly crash. | ||||
| CVE-2026-112280 | 1 Nkoriyama | 1 Aribb24 | 2026-10-21 | 6.1 Medium |
| libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap memory via an oversized caption data unit. Attackers can supply a crafted caption PES packet in a media file or broadcast stream, processed through arib_parse_pes(), to crash FFmpeg or VLC and possibly corrupt further memory. | ||||
| CVE-2026-112281 | 1 Nkoriyama | 1 Aribb24 | 2026-10-21 | 6.1 Medium |
| libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address. | ||||
| CVE-2026-112284 | 1 Xqq | 1 Libaribcaption | 2026-10-21 | 3.3 Low |
| libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding. | ||||
| CVE-2026-112289 | 1 Koalixswitzerland | 1 Koalixcrm | 2026-10-21 | 5.4 Medium |
| Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser. | ||||
| CVE-2026-112290 | 1 Mi6 | 1 Intelligence Community Ui Kit Canary Web Components | 2026-10-21 | 4.7 Medium |
| Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers. | ||||
| CVE-2026-112291 | 1 Flarum | 1 Extension Manager | 2026-10-21 | 5.3 Medium |
| Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version. | ||||
| CVE-2026-112292 | 1 Operacle | 1 Checkcle | 2026-10-21 | 9.8 Critical |
| CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data. | ||||
| CVE-2026-112293 | 1 Boxyhq | 1 Saas-starter-kit | 2026-10-21 | 5.4 Medium |
| BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions. | ||||
| CVE-2026-112328 | 2 Automattic, Wordpress-extensions | 2 Sensei Lms, Sensei Lms | 2026-10-21 | 4.3 Medium |
| The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own. | ||||