Export limit exceeded: 390926 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 390926 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390926 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13709 | 2 Iqonicdesign, Wordpress | 2 Graphina – Charts And Graphs For Elementor, Wordpress | 2026-09-13 | 6.4 Medium |
| The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-84293 | 2 Addonsorg, Wordpress | 2 Repeater Fields For Gravity Forms, Wordpress | 2026-09-13 | 7.2 High |
| The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only affects multi-input sub-field types within a repeater (such as Name, Address, and Checkbox fields), as scalar single-input field values are escaped with esc_html() at the output stage in version 3.0.4. | ||||
| CVE-2026-75966 | 2 Eric Teubert, Wordpress | 2 Podlove Podcast Publisher, Wordpress | 2026-09-13 | 6.4 Medium |
| The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The contributor comment is stored in a plugin-managed custom table, bypassing WordPress core's wp_kses_post filter, and the save_post hook fires without a nonce check, meaning any user who can edit posts can exploit this without further preconditions. | ||||
| CVE-2026-87732 | 1 Ocaml | 1 Mirage-crypto-pk | 2026-09-13 | 6.2 Medium |
| An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false, but the destination buffer already holds the full plaintext. | ||||
| CVE-2026-87733 | 1 Ocaml | 1 Mirage-crypto-ec | 2026-09-13 | 6.2 Medium |
| An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key. | ||||
| CVE-2026-87734 | 1 Ocaml | 1 Utcp | 2026-09-13 | 7.5 High |
| An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. | ||||
| CVE-2026-87736 | 1 Ocaml | 1 Mirage-crypto-ec | 2026-09-13 | 4.3 Medium |
| An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. | ||||
| CVE-2026-87737 | 1 Ocaml | 1 Mirage-crypto-ec | 2026-09-13 | 5.9 Medium |
| An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret. | ||||
| CVE-2026-11821 | 2 Arraytics, Wordpress | 2 Eventin – Event Calendar, Event Registration, Tickets & Booking (ai Powered), Wordpress | 2026-09-13 | 5.4 Medium |
| The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators. | ||||
| CVE-2026-21105 | 1 Samsung Mobile | 1 Collection | 2026-09-13 | N/A |
| Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access sensitive information. | ||||
| CVE-2026-21106 | 1 Samsung Mobile | 1 Samsung Assistant | 2026-09-13 | N/A |
| Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable enhanced data protection settings. | ||||
| CVE-2026-21109 | 1 Samsung Mobile | 1 Watch Plugin | 2026-09-13 | N/A |
| Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information. | ||||
| CVE-2026-21110 | 1 Samsung Mobile | 1 Libsavscmn.so | 2026-09-13 | N/A |
| Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code. | ||||
| CVE-2026-21111 | 1 Samsung Mobile | 1 Libsthmbc | 2026-09-13 | N/A |
| Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21112 | 1 Samsung Mobile | 1 Samsung Tips | 2026-09-13 | N/A |
| Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privilege. User interaction is required for triggering this vulnerability. | ||||
| CVE-2026-21113 | 1 Samsung Mobile | 1 Visual Voicemail | 2026-09-13 | N/A |
| Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission. | ||||
| CVE-2026-19946 | 2 Awesomesupport, Wordpress | 2 Awesome Support Wordpress Helpdesk & Support, Wordpress | 2026-09-13 | 4.3 Medium |
| The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability check on the wpas_do_mr_deny_user() function, which unlike its counterpart wpas_do_mr_activate_user() does not enforce current_user_can('edit_users') or current_user_can('edit_user', $user_id), relying solely on a nonce that is not scoped to the target user. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the mr_user_denied flag on any user account — including administrators — permanently blocking their moderated activation and dispatching a denial notification email to the victim. | ||||
| CVE-2026-76009 | 2 Martinnguyen1990, Wordpress | 2 Next-cart Store To Woocommerce Migration, Wordpress | 2026-09-13 | 8.1 High |
| The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin` visit, as token generation is deferred to `admin_init` via `register_settings()`. | ||||
| CVE-2026-8615 | 2 Ghera74, Wordpress | 2 Ilghera Support System For Woocommerce, Wordpress | 2026-09-13 | 4.3 Medium |
| The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the disconnect_callback() function in versions up to, and including, 1.2.3. The function is registered to the 'wp_ajax_wcefr-disconnect' AJAX action and unconditionally calls delete_option('wcefr-agt'), which removes the Reviso Agreement Grant Token used to authenticate API calls. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete the plugin's stored Agreement Grant Token, breaking the connection between WooCommerce and the Reviso service. | ||||
| CVE-2026-19729 | 1 Redhat | 4 Build Keycloak, Build Of Keycloak, Red Hat Single Sign On and 1 more | 2026-09-13 | 4.9 Medium |
| A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keystore parameters. This can be used to determine the existence and readability of files on the server, potentially exposing sensitive system information. | ||||