Export limit exceeded: 10389 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11210 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414442 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414442 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115214 | 2026-10-26 | 9.8 Critical | ||
| The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator. | ||||
| CVE-2026-115251 | 2026-10-26 | 7.2 High | ||
| The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator WordPress plugin before 5.0.0 directory. | ||||
| CVE-2026-103298 | 2026-10-26 | 5.3 Medium | ||
| The CCAvenue Payment Gateway for WooCommerce WordPress plugin through 3.1 does not verify that a payment-confirmation request genuinely originates from the payment provider, and derives its verification key from a value that is empty on a default install, allowing unauthenticated attackers to forge a confirmation and mark any WooCommerce order as paid without payment. | ||||
| CVE-2026-103319 | 2026-10-26 | 5.3 Medium | ||
| The OPay Payment Gateway for WooCommerce WordPress plugin through 2.5.5 does not properly verify that payment notifications originate from the payment provider, as the secret used to validate their signature is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid, cancelled or failed. | ||||
| CVE-2026-115961 | 2026-10-26 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider b-slider allows Stored XSS.This issue affects B Slider: from n/a through 2.2.2. | ||||
| CVE-2026-114708 | 2026-10-26 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.1. | ||||
| CVE-2026-114709 | 2 Igorfuna, Wordpress-extensions | 2 Ad Inserter, Ad Inserter | 2026-10-26 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18. | ||||
| CVE-2026-116281 | 1 Kameleo | 1 Kameleo | 2026-10-26 | 3.3 Low |
| A vulnerability was identified in Kameleo up to 5.0.1.26. Affected by this vulnerability is the function ListProfiles of the file client-engine-application/t.cs of the component Profile Controller. The manipulation leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses this issue. Upgrading the affected component is recommended. | ||||
| CVE-2026-113209 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-10-26 | 6.5 Medium |
| Memory corruption in Navigation in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113220 | 1 Google | 2 Android, Chrome | 2026-10-26 | 8.8 High |
| Memory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-113224 | 1 Google | 2 Android, Chrome | 2026-10-26 | 6.5 Medium |
| Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-108456 | 1 Microsoft | 1 Azure Ai Foundry | 2026-10-26 | 7.7 High |
| Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-115948 | 2026-10-26 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through 3.42. | ||||
| CVE-2026-115951 | 2026-10-26 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy Load for Videos lazy-load-for-videos allows Stored XSS.This issue affects Lazy Load for Videos: from n/a through 2.18.11. | ||||
| CVE-2026-115950 | 2026-10-26 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1. | ||||
| CVE-2026-115954 | 2026-10-26 | 5.4 Medium | ||
| Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22. | ||||
| CVE-2026-115953 | 2026-10-26 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Stored XSS.This issue affects Geo Mashup: from n/a through 1.13.22. | ||||
| CVE-2026-115608 | 2026-10-26 | 8.5 High | ||
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0. | ||||
| CVE-2026-115594 | 2026-10-26 | 6.5 Medium | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Retrieve Embedded Sensitive Data.This issue affects Media LIbrary Assistant: from n/a through 3.42. | ||||
| CVE-2026-114707 | 2 Crocoblock, Wordpress-extensions | 2 Jetelements For Elementor, Jetelements For Elementor | 2026-10-26 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.5. | ||||