Export limit exceeded: 11698 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 93884 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (93884 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96602 | 1 Abdurrab5 | 1 Online-makeup-store | 2026-09-29 | 7.3 High |
| A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Customer Login Handler. This manipulation of the argument username/password causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-94613 | 1 Goauthentik | 1 Authentik | 2026-09-29 | 7.5 High |
| authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed SAML message to an authentik deployment using SAML in either the identity-provider or SAML source role. The message can stop the worker handling /application/saml/* or /source/saml/*, causing the requests assigned to that worker to fail. Worker process termination and automatic restart do not destroy database-backed sessions, but continued malicious messages can cause a sustained share of legitimate traffic to fail. Other protocol implementations are not affected. This issue is fixed in versions 2026.2.7, 2026.5.7, and 2026.8.2. | ||||
| CVE-2026-86065 | 1 Klever-io | 1 Klever-go | 2026-09-29 | 7.5 High |
| Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/api/websocket/routes.go accepts unauthenticated WebSocket clients with permissive origin handling, does not call SetReadLimit to bound message size, and has no live-connection cap. SocketHub.HandleClientInsertion also accepts an unbounded address list that grows addressSubscription, and client.loopIn continues reading without a size limit, allowing one client to grow subscription maps or many clients to retain goroutines, buffered channels, and descriptors. The global HTTP request throttler does not count upgraded live WebSocket connections. Because the REST and WebSocket API runs in the node process, memory or scheduler exhaustion can crash the node and interrupt P2P and consensus participation. This issue is fixed in version 1.7.20. | ||||
| CVE-2026-79766 | 1 Termix | 1 Termix | 2026-09-29 | 9.1 Critical |
| Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.1 until 2.5.1, an authenticated Termix administrator can store attacker-controlled domain and email values through PATCH /users/acme-ssl-settings and trigger their interpolation into a certbot shell command through POST /users/acme-ssl-request. In src/backend/database/routes/acme-ssl-routes.ts, child_process.execSync invokes /bin/sh -c with those values only wrapped in double quotes, so shell metacharacters can execute arbitrary operating-system commands as the Termix backend process. Both HTTP webroot and DNS Cloudflare challenge modes are affected, and compromise exposes Termix databases, process secrets, stored credentials, and network reachability. This issue is fixed in version 2.5.1. | ||||
| CVE-2026-92164 | 1 Streamlink | 1 Streamlink | 2026-09-29 | 6.5 Medium |
| Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAdapter for the file scheme and inherits redirect handling from requests.Session without rejecting cross-protocol redirects. A remote server controlling an HTTP or HTTPS URL reached by Streamlink can return a redirect to a local file URL, causing HTTPSession to read the local file and return its contents to the response consumer. This bypasses the direct file URL checks added for HLS and DASH content because the manifest contains an ordinary network URL and the scheme transition occurs later during fetch handling. The flaw applies to every request made through HTTPSession, and a segment fetch can place the local file contents into stream output. This issue is fixed in version 8.6.0. | ||||
| CVE-2026-10589 | 1 Lenovo | 57 Ideapad 5 15aba7 Bios, Ideapad Pro 5 16agp11 Bios, Ideapad Pro 5 16asp10 Bios and 54 more | 2026-09-28 | 6 Medium |
| A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode. | ||||
| CVE-2026-100658 | 1 Netty | 1 Netty | 2026-09-28 | 5.3 Medium |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-100657 | 1 Netty | 1 Netty | 2026-09-28 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-100656 | 1 Netty | 1 Netty | 2026-09-28 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-100655 | 1 Netty | 1 Netty | 2026-09-28 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-6721 | 2 Ibm, Linux | 2 Concert, Linux Kernel | 2026-09-28 | 9.8 Critical |
| IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS commands, resulting in arbitrary command execution on the underlying system. Successful exploitation allows remote code execution with the privileges of the affected application. | ||||
| CVE-2026-100313 | 1 Mathurvishal | 1 Cloudclassroom-php-project | 2026-09-28 | 4.3 Medium |
| A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. Executing a manipulation of the argument queryx can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-88993 | 2 Areoi, Wordpress-extensions | 2 All Bootstrap Blocks, All Bootstrap Blocks | 2026-09-28 | 6.8 Medium |
| The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed. | ||||
| CVE-2025-15698 | 1 Wordpress-extensions | 1 Business Name Generator | 2026-09-28 | 3.5 Low |
| The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). | ||||
| CVE-2026-19860 | 2 Jetmonsters, Wordpress-extensions | 2 Jetformbuilder — Dynamic Blocks Form Builder, Jetformbuilder | 2026-09-28 | 5.5 Medium |
| The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.3 does not sufficiently restrict which PHP functions can be used as a custom field-validation callback, relying on a blocklist that omits a file-deletion function, allowing users able to manage forms to cause arbitrary files on the server to be deleted. The deletion itself is carried out when the form is submitted, which requires no authentication. | ||||
| CVE-2026-76790 | 1 Wordpress-extensions | 1 Estatik | 2026-09-28 | 7.1 High |
| The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting. | ||||
| CVE-2026-88824 | 1 Wordpress-extensions | 1 Master Blocks | 2026-09-28 | 8.8 High |
| The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator visiting a wp-admin page. | ||||
| CVE-2026-15463 | 2 Sslzen, Wordpress-extensions | 2 Ssl Zen, Ssl Zen | 2026-09-28 | 6.1 Medium |
| The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'host' parameter in all versions up to, and including, 4.7.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The vulnerability is only exploitable when in the system_requirements stage. | ||||
| CVE-2026-15098 | 2 Creativeinteractivemedia, Wordpress-extensions | 2 Real3d Flipbook, Real 3d Flipbook | 2026-09-28 | 6.4 Medium |
| The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute (and other unsanitized attributes handled by on_shortcode()) in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping in the on_shortcode() and print_global_options() functions: shortcode attribute values are copied verbatim into $this->flipbook_options and then emitted via wp_json_encode() inside a <script type="application/json"> block without the JSON_HEX_TAG flag, allowing a literal </script> byte sequence in the attribute value to break out of the JSON script context. Because WordPress's shortcode_parse_atts() applies stripcslashes() to attribute values, an attacker can encode the breakout tag as \x3c/script\x3e\x3cscript\x3e…\x3c/script\x3e, which survives the wp_kses_post save-time filter applied to Contributor content (the escape bytes are safe text characters, not HTML tags) and is decoded to real angle brackets at render time. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user (typically an Editor or Administrator previewing/moderating the pending post) accesses an injected page. | ||||
| CVE-2026-79079 | 1 Crosswire | 1 Xiphos | 2026-09-28 | 7.8 High |
| An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components | ||||