Export limit exceeded: 403558 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (403558 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-94258 | 1 Wordpress-extensions | 1 Sms Alert | 2026-10-09 | 2.7 Low |
| The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site. | ||||
| CVE-2026-94275 | 1 Wordpress-extensions | 1 Track Orders For Woocommerce | 2026-10-09 | 5.3 Medium |
| The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address. | ||||
| CVE-2026-85097 | 2 Bricksforge, Wordpress-extensions | 2 Bricksforge, Bricksforge | 2026-10-09 | 9.8 Critical |
| The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This is due to insufficient validation of the attacker-controlled URL field in the 'temporaryFileUploads' parameter during form submission. An unauthenticated attacker can first obtain a valid nonce via the bricksforge_regenerate_nonce AJAX endpoint, then upload a GIF/PHP polyglot file to the temporary upload directory where MIME type validation is correctly performed. Subsequently, the attacker can submit a form with a crafted 'temporaryFileUploads' parameter where the server-side file path points to the validated GIF file, but the attacker-controlled url field ends with a .php extension. This makes it possible for unauthenticated attackers to upload and execute arbitrary PHP code on the server. | ||||
| CVE-2026-93699 | 2 Webpros, Wordpress-extensions | 2 Wordpress-toolkit, Wp Toolkit | 2026-10-09 | N/A |
| Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. | ||||
| CVE-2026-84224 | 2026-10-09 | 4.1 Medium | ||
| The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response. | ||||
| CVE-2026-89191 | 1 Sqlview | 1 Sqlview Kris | 2026-10-09 | 6.8 Medium |
| Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main dashboard without proper server-side sanitisation, allowing an attacker with administrative access to inject and store malicious scripts that execute in the browsers of affected users. | ||||
| CVE-2026-71183 | 1 Apache | 1 Dolphinscheduler | 2026-10-09 | 7.1 High |
| An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not authorized to access through the /unauth-datasource and /authed-datasource endpoints. These endpoints fail to enforce the required data source access controls and return sensitive connection information, including data source passwords. As a result, an authenticated user without permission to access a data source can retrieve its connection details and credentials. Successful exploitation exposes sensitive data source information and may enable unauthorized access to the underlying databases using the disclosed credentials. This issue affects Apache DolphinScheduler: before 3.4.3. Users are recommended to upgrade to version 3.4.3, which fixes the issue. | ||||
| CVE-2026-105110 | 1 Iskratel | 1 Innbox | 2026-10-09 | 9.8 Critical |
| OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter. | ||||
| CVE-2026-107503 | 1 Eclipse Ditto | 1 Ditto Explorer Ui | 2026-10-09 | N/A |
| Unvalidated environments URL allows OAuth authorization code + PKCE verifier theft and account takeover via injected OIDC authority in Ditto Explorer in Eclipse Ditto Ditto Explorer [3.6.0,3.9.7] allows a craft link set an attacker-controlled OIDC authority with autoSso enabled. The UI then automatically starts a login at the genuine identity provider but exchanges the returned authorization code together with its PKCE code_verifier at an attacker-controlled token endpoint. This lets the attacker redeem the code for the victim's access and refresh tokens. Alternatively, an attacker-controlled api_uri causes the UI to send the victim's bearer token or Basic credentials to the attacker. Because the configuration is persisted, later visits to the UI without the crafted link repeat the token theft. | ||||
| CVE-2026-103517 | 1 Wordpress-extensions | 1 Airwallex Online Payments Gateway | 2026-10-09 | 5.3 Medium |
| The Airwallex Online Payments Gateway WordPress plugin before 1.36.0 does not verify that an incoming payment notification genuinely comes from the payment provider when no webhook secret has been configured, allowing unauthenticated attackers to forge one and mark orders as paid without paying. | ||||
| CVE-2026-104671 | 1 Wordpress-extensions | 1 Tutorsstarter | 2026-10-09 | 5.3 Medium |
| The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled. | ||||
| CVE-2026-105190 | 1 Wordpress-extensions | 1 Easy Digital Downloads | 2026-10-09 | 5.3 Medium |
| The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role. | ||||
| CVE-2026-93509 | 1 Wordpress-extensions | 1 Wallet System For Woocommerce | 2026-10-09 | 6.5 Medium |
| The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not validate that a wallet transfer amount is positive, and computes the sender's new balance from a stale snapshot taken before crediting the recipient, allowing an authenticated attacker with Subscriber-level access to mint wallet funds for themselves or drain a specific victim's balance into their own account. | ||||
| CVE-2026-107275 | 1 Fastify | 1 Fastify/jwt | 2026-10-09 | 6.8 Medium |
| @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding whitespace, is silently dropped instead of refused. On the signing path this produces a token with no expiration claim that never expires, and on the verification path a configured maxAge stops being enforced, so a token that should be rejected for age is accepted. The issue is fixed in @fastify/jwt 10.2.3, and users should upgrade to 10.2.3 or later. As a workaround, pass these options as a number of seconds, or verify that any time-span string parses to a finite value before relying on it. | ||||
| CVE-2026-19083 | 1 Akin | 1 Octocloud | 2026-10-09 | 8.8 High |
| Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 before 1.12.07. | ||||
| CVE-2026-92555 | 1 Akin | 1 Akinsoft Wolvox Control Panel | 2026-10-09 | 9.8 Critical |
| Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel: from 26.02.25 before 26.02.26. | ||||
| CVE-2026-19218 | 1 Akin | 1 Myrezzta | 2026-10-09 | 9.1 Critical |
| Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01. | ||||
| CVE-2026-62128 | 2 Creator Lms, Wordpress-extensions | 2 Creator Lms, Creator Lms | 2026-10-09 | 5.3 Medium |
| Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21. | ||||
| CVE-2026-62127 | 2 Mediaron, Wordpress-extensions | 2 Wp Plugin Info Card, Wp Plugin Info Card | 2026-10-09 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5. | ||||
| CVE-2026-42698 | 2 Themeum, Wordpress-extensions | 2 Tutor Lms, Tutor Lms | 2026-10-09 | 5.3 Medium |
| Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows Leveraging Race Conditions.This issue affects Tutor LMS: from n/a through 4.1.1. | ||||