Export limit exceeded: 420318 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420318 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-35112 | 2026-11-06 | 4.2 Medium | ||
| HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-35113 | 2026-11-06 | 4.8 Medium | ||
| HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions. | ||||
| CVE-2026-91049 | 2026-11-06 | 6.4 Medium | ||
| The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected. | ||||
| CVE-2026-90967 | 2026-11-06 | 4.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in one of its AJAX actions, allowing an authenticated low-privileged user to read other users' invoices, including the invoice owner's name, account email address and financial details. | ||||
| CVE-2026-90966 | 2026-11-06 | 4.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price. | ||||
| CVE-2026-90965 | 2026-11-06 | 5.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published. | ||||
| CVE-2026-90964 | 2026-11-06 | 5.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email actions, allowing unauthenticated users to send emails to arbitrary addresses with an attacker-controlled sender header and message body through the site. | ||||
| CVE-2026-90963 | 2026-11-06 | 5.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check in one of its AJAX actions, allowing unauthenticated users to read the full contents of property listings that have not been published, together with the private name, email address, phone number and office address of the listing agent. | ||||
| CVE-2026-88814 | 2026-11-06 | 3.7 Low | ||
| The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance when it is redeemed at checkout, allowing an attacker who holds a gift card code to spend more than its funded value by submitting multiple checkouts for the same code at the same time. | ||||
| CVE-2026-87856 | 2026-11-06 | 5.3 Medium | ||
| The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on standard front-end page views, allowing unauthenticated users to read the full contents of restricted posts and pages through other routes that render the same content. | ||||
| CVE-2026-86795 | 1 Wordpress-extensions | 1 Community Events | 2026-11-06 | 5.3 Medium |
| The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX actions, allowing unauthenticated users to retrieve details of event submissions awaiting moderation, which are not available anywhere on the public site. | ||||
| CVE-2026-86442 | 2026-11-06 | 8.2 High | ||
| The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied post identifier in its front-end event submission flow, allowing unauthenticated attackers to read and overwrite the content of arbitrary unpublished posts and pages, and to convert them into events. | ||||
| CVE-2026-85570 | 1 Wordpress-extensions | 1 Tutor Lms | 2026-11-06 | 4.3 Medium |
| The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included in the page it serves to the student taking the quiz, and does so regardless of the setting intended to control whether answers are revealed, allowing any enrolled student to obtain them before submitting their attempt. | ||||
| CVE-2026-85351 | 2026-11-06 | 5.0 Medium | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before performing a server-side fetch whose response body is stored and served publicly, allowing users with Contributor-level access and above to perform Server-Side Request Forgery (SSRF) attacks and to read the response of an internal resource when it is returned with an image content type. | ||||
| CVE-2026-85347 | 2026-11-06 | 6.8 Medium | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page. | ||||
| CVE-2026-85346 | 2026-11-06 | 4.3 Medium | ||
| The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on several of its cloud storage media browser handlers, allowing any authenticated user with minimal permissions (such as Subscriber) to disclose the configuration and stored file listings of the site's connected cloud storage accounts. | ||||
| CVE-2026-19256 | 2026-11-06 | 9.8 Critical | ||
| The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made against the short numeric code used by its default-enabled passwordless email login, and does not feed those failed attempts into its own brute-force protection, allowing unauthenticated attackers to take over any account including administrators. | ||||
| CVE-2026-16304 | 2026-11-06 | 8.1 High | ||
| The WP Event Manager WordPress plugin before 3.4.2 does not properly validate ownership or the type of the user-supplied post identifiers processed by one of its frontend forms, allowing any user with a Subscriber account or above to reassign the authorship of arbitrary posts to themselves and to force them to be published. This results in content takeover and in the public disclosure of otherwise private or draft content, and requires the relevant frontend feature to be enabled. | ||||
| CVE-2026-118584 | 1 Drupal | 1 Field Permissions | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||
| CVE-2026-118583 | 1 Drupal | 1 Field Permissions | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Field Permissions allows Forceful Browsing. This issue affects Field Permissions versions: from 0.0.0 to 1.6.0. | ||||