Export limit exceeded: 16294 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 46487 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46487 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-46252 | 1 Kofimokome | 1 Message Filter For Contact Form 7 | 2026-08-24 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kofi Mokome Message Filter for Contact Form 7 allows SQL Injection. This issue affects Message Filter for Contact Form 7: from n/a through 1.6.3.2. | ||||
| CVE-2026-51366 | 2026-08-24 | 9.9 Critical | ||
| SQL Injection vulnerability in Bottinelli Informatica Vedo Suite v.1.2.5 allows a remote attacker to execute arbitrary code via the api_vedo/chat endpoint and the utente_chat parameter | ||||
| CVE-2026-39458 | 1 F5 | 22 Big-ip, Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager and 19 more | 2026-08-24 | 7.5 High |
| When a BIG-IP is configured with DNS caching (Such as a DNS profile with caching enabled, SSL Orchestrator, Advanced WAF DoS protection), undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | ||||
| CVE-2026-70818 | 1 Oracle | 1 Hyperion Financial Management | 2026-08-24 | 8.8 High |
| Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-11817 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-08-24 | N/A |
| This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only. | ||||
| CVE-2026-73345 | 2 Saad Iqbal, Wordpress | 2 License Manager For Woocommerce, Wordpress | 2026-08-24 | 7.1 High |
| Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions. | ||||
| CVE-2026-73365 | 2 Crocoblock. Jetimpex Inc., Wordpress | 2 Jetappointment, Wordpress | 2026-08-24 | 9.3 Critical |
| Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions. | ||||
| CVE-2026-78204 | 1 Ghostmanager | 1 Ghostwriter | 2026-08-24 | 5.4 Medium |
| Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed. | ||||
| CVE-2026-78200 | 1 Itsourcecode | 1 Library Management System | 2026-08-24 | 6.3 Medium |
| A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2026-28153 | 2 Notification Master, Wordpress | 2 Notification Master – Real-time Wordpress Notifications With Email, Sms, Webhooks & More, Wordpress | 2026-08-24 | 7.5 High |
| Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions. | ||||
| CVE-2026-28190 | 2 Themebing, Wordpress | 2 Prolancer Element, Wordpress | 2026-08-24 | 7.1 High |
| Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions. | ||||
| CVE-2026-32471 | 2 Themebing, Wordpress | 2 Prolancer Element, Wordpress | 2026-08-24 | 8.5 High |
| Subscriber SQL Injection in ProLancer Element <= 1.4.8 versions. | ||||
| CVE-2026-78258 | 2 Magepeople, Wordpress | 2 Booking & Rental Manager, Wordpress | 2026-08-24 | 5.3 Medium |
| Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. | ||||
| CVE-2026-78270 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluentcrm | 2026-08-24 | 7.6 High |
| Author SQL Injection in FluentCRM Pro <= 3.1.12 versions. | ||||
| CVE-2026-78272 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Support | 2026-08-24 | 5.4 Medium |
| Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions. | ||||
| CVE-2026-32478 | 2 Wedevs, Wordpress | 2 Wp Project Manager, Wordpress | 2026-08-24 | 8.5 High |
| Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions. | ||||
| CVE-2026-16930 | 1 Ibm | 39 Power System E1050 \(9043-mrx\), Power System E1050 \(9043-mrx\) Firmware, Power System E1080 \(9080-hex\) and 36 more | 2026-08-24 | 8.2 High |
| IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. | ||||
| CVE-2026-76836 | 1 Azuracast | 1 Azuracast | 2026-08-24 | 8.8 High |
| AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators. | ||||
| CVE-2026-70760 | 1 Oracle | 1 Order Management | 2026-08-24 | 7.1 High |
| Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Order Management. While the vulnerability is in Oracle Order Management, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Order Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Order Management accessible data. CVSS 3.1 Base Score 7.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N). | ||||
| CVE-2026-4245 | 2 Metaphorcreations, Wordpress | 2 Post Duplicator, Wordpress | 2026-08-24 | 4.3 Medium |
| The Post Duplicator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.11. This is due to the `duplicate_post_permissions()` permission callback only verifying the `duplicate_posts` capability without checking whether the requesting user holds `publish_posts` or other status-gated capabilities. This makes it possible for authenticated attackers, with Contributor-level access and above, to create duplicate posts with `future` (scheduled, auto-publishes) or `private` status, bypassing editorial review. Additionally, the REST endpoint does not enforce administrator-configured post-type duplication restrictions, allowing duplication of post types that have been explicitly disabled. | ||||