Export limit exceeded: 416056 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416056 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (416056 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110662 | 2026-10-28 | 7.2 High | ||
| The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feedback' parameter in all versions up to, and including, 3.2.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The stored payload is written by any unauthenticated visitor via a single POST to admin-ajax.php and detonates automatically when any administrator next loads the Transcripts page. | ||||
| CVE-2026-109381 | 2026-10-28 | 7.2 High | ||
| The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general. | ||||
| CVE-2026-103370 | 2026-10-28 | 6.4 Medium | ||
| The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpas_files' parameter in all versions up to, and including, 6.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the "Enable drag-n-drop uploader for ticket form" setting is enabled, as it is disabled by default. | ||||
| CVE-2026-116609 | 2026-10-28 | 6.5 Medium | ||
| The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and sibling 'to'/'first'/'second') shortcode attribute of the [wsm_showTrafficStatsList] shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the user-supplied attribute and lack of sufficient preparation on the existing SQL query: `shortcode_atts()` returns attacker-supplied shortcode attributes verbatim (WP core performs no sanitization), only `$atts['id']` is re-sanitized afterward, and the raw value is then concatenated into a double-quoted SQL string literal inside `fnGetHourlyReportByDateNameTimeZone()` (`includes/wsm_db.php:1449`) and executed via `$wpdb->get_results()`. This makes it possible for authenticated attackers, with Contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-99100 | 1 Linux | 2 Linux, Linux Kernel | 2026-10-28 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate firmware record lengths The p54 firmware parser accesses component ID and component version records without checking that their lengths cover the fields being read. A malformed record can therefore make the parser read past the record. Validate the component ID and component version record lengths before accessing their data. The descriptor record is also checked against the shortest descriptor length found in the supported firmware images. Reject descriptor values that underflow the RX offset or produce an empty RX range before updating the driver state. | ||||
| CVE-2026-110524 | 2026-10-28 | N/A | ||
| The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content. | ||||
| CVE-2026-118342 | 1 Google | 1 Chrome | 2026-10-28 | N/A |
| Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-107625 | 2 Ultimatemember, Wordpress-extensions | 2 Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin, Ultimate Member | 2026-10-28 | 6.4 Medium |
| The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_url' parameter in all versions up to, and including, 2.14.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a visitor to click the attacker's Website URL link on their public Ultimate Member profile, a condition that is trivially met since the redirect-confirmation onclick handler is enabled by default on all new installations. | ||||
| CVE-2026-15323 | 2026-10-28 | 7.5 High | ||
| The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_checkout function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The lumise_security nonce required to reach the vulnerable /?lumise=cart endpoint is freely obtainable by any unauthenticated visitor via the /?lumise=ajax action=init handler, making this exploitable with no prior access or credentials. | ||||
| CVE-2026-109236 | 2026-10-28 | 4.8 Medium | ||
| The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass via a Predictable Email-Verification Token in all versions up to, and including, 2.8.2. This is due to the `authenticate_user_by_email_link()` function — hooked on the `wp` action and triggered by the `cusomer_email_verify` GET parameter — lacking any capability check or nonce verification, while the `secret_code` it validates is generated as `md5(email . time())` and the `verify_otp_nonce` required to trigger token issuance via the `wp_ajax_nopriv_resend_otp` handler is emitted to every front-end visitor through `wp_localize_script`. This makes it possible for unauthenticated attackers to log in as a newly created, verified WooCommerce customer bound to an arbitrary email address — or to flip an existing account's `customer_email_verified` meta to verified — fully bypassing the plugin's core email-verification control. Exploitation requires the `cev_user_log` table to contain a `password` column, which is absent from the fresh-install schema shipped in version 2.8.2 but is present on sites upgraded from an older version where that column was defined. | ||||
| CVE-2026-118344 | 1 Google | 1 Chrome | 2026-10-28 | N/A |
| Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-118340 | 1 Google | 1 Chrome | 2026-10-28 | N/A |
| Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-117606 | 1 Blair2004 | 1 Nexopos | 2026-10-28 | 5.4 Medium |
| NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares used_by with the user. Attackers holding the default nexopos.use.registers permission can submit closing, cash-in, or cash-out actions to POST /api/cash-registers/{action}/{register} to force-close sessions or alter balances. | ||||
| CVE-2026-118375 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-28 | 8.1 High |
| llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdma_recv() function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack variable in rpc_serve_client(), crashing the server or potentially executing code. | ||||
| CVE-2026-109848 | 1 Growi | 1 Growi | 2026-10-28 | N/A |
| GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit. | ||||
| CVE-2026-115624 | 1 Growi | 1 Growi | 2026-10-28 | N/A |
| GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts. | ||||
| CVE-2026-115522 | 2026-10-28 | N/A | ||
| Exposure of Resource to Wrong Sphere (CWE-668) in FileArtifactService in Google Agent Development Kit (ADK) for Python (google-adk) versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application when both applications share a FileArtifactService root directory and use the same user_id (and session_id for session-scoped artifacts). FileArtifactService accepted app_name across its public API methods but omitted app_name when constructing on-disk paths (root/users/{user_id}/... instead of root/apps/{app_name}/users/{user_id}/...). Version 2.6.0 scoped writes by app_name but retained a legacy root/users/{user_id} fallback for reads and deletes; version 2.7.0 and the 1.x backport in version 1.39.1 removed the fallback and enforce full per-app path scoping. | ||||
| CVE-2026-118384 | 2026-10-28 | 6.1 Medium | ||
| GNU mtools through 4.0.49 has an out-of-bounds write in parse_vses in vfat.c. | ||||
| CVE-2026-104384 | 2026-10-28 | N/A | ||
| Insufficiently Protected Credentials in tunnel gateway and provisioning interfaces in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows unauthenticated remote attackers to escalate privileges via authentication abuse to access the access keys, secret keys, and deployment secrets | ||||
| CVE-2026-104383 | 2026-10-28 | N/A | ||
| Improper Control of Generation of Code in Pigeon MFA service in EagleCloud Aquila versions through 2.6.7.2 on on-premises platforms allows authenticated remote attackers to execute arbitrary code via code injection | ||||