Export limit exceeded: 414263 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414263 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414263 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116255 | 1 Pgyer | 1 Codefever | 2026-10-26 | 5.3 Medium |
| A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990. Affected is the function _detail of the file application/controllers/doc.php of the component URI Sanitizer. The manipulation of the argument uri_string leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is e4433eee96883a222403854e8ac38b3146774a07. Applying a patch is the recommended action to fix this issue. | ||||
| CVE-2026-115602 | 2026-10-26 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1. | ||||
| CVE-2026-115958 | 2026-10-26 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP Discussion Board WP Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Discussion Board: from n/a through 2.6.0. | ||||
| CVE-2026-115613 | 2026-10-26 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1. | ||||
| CVE-2026-4316 | 1 Zuinq Studio | 1 Ismygym | 2026-10-26 | N/A |
| Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject arbitrary JavaScript code executed in the context of the victim’s browser. | ||||
| CVE-2026-116254 | 1 Rathena | 1 Fluxcp | 2026-10-26 | 6.5 Medium |
| A vulnerability was identified in rathena FluxCP up to 98cd4b8fd83228c11b36fb3d097b8e0f7c105a8d. This issue affects the function verifyiprange of the file lib/Flux/PaymentNotifyRequest.php of the component PayPal IPN Handler. The manipulation of the argument X-Real-IP leads to origin validation error. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-88842 | 1 Redhat | 2 Hardened Images, Hummingbird | 2026-10-26 | 3.3 Low |
| A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption. | ||||
| CVE-2026-116227 | 1 Edimax | 2 Br-6208ac, Br-6208ac Firmware | 2026-10-26 | 2.4 Low |
| A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the component Virtual Server Page. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-97023 | 2 Flatpak, Redhat | 2 Flatpak, Enterprise Linux | 2026-10-26 | 7.1 High |
| A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-wide installations, the deletion is performed as root. | ||||
| CVE-2026-97024 | 2 Flatpak, Redhat | 2 Flatpak, Enterprise Linux | 2026-10-26 | 7.1 High |
| A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink when the app is installed or upgraded. In system-wide installations, the write is performed as root. | ||||
| CVE-2026-112250 | 2026-10-26 | 4.4 Medium | ||
| A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the password of a Windows service account may be written in cleartext to a setup log file. The issue occurs when Microsoft SQL Server access is configured using Integrated Security and the Windows account intended to run the BRAIN2 MainService is specified during execution of the BRAIN2 installation wizard. The setup log file is stored in the temporary directory of the Windows administrator performing the installation. This directory is not accessible to standard Windows users and can generally only be accessed by users with administrative privileges. Successful exploitation could result in the disclosure of credentials belonging to the configured BRAIN2 service account. | ||||
| CVE-2026-115425 | 2026-10-26 | N/A | ||
| Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low privileged attacker to execute Javascript in the context of another user visiting a specific page or clicking on a specifically crafted link. | ||||
| CVE-2026-116253 | 1 Dedecms | 1 Dedecms | 2026-10-26 | 7.3 High |
| A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/ad_js.php of the component Advertisement Rendering. Executing a manipulation of the argument aid can lead to code injection. The attack can be executed remotely. | ||||
| CVE-2026-103377 | 1 Regional Parliament Of Castile-la Mancha | 1 Video Library Of The Regional Parliament Of Castile-la Mancha | 2026-10-26 | N/A |
| A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation of this vulnerability could allow a remote attacker to execute arbitrary JavaScript code in the browser of a victim who interacts with the content crafted for the attack. | ||||
| CVE-2026-116237 | 1 Oray | 1 Pugongying X5 Pro | 2026-10-26 | 8.4 High |
| A vulnerability was found in Oray Pugongying X5 Pro 7.6.1. This affects an unknown part of the component Dnsmasq. Performing a manipulation results in crlf injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-116236 | 1 Oray | 1 Pugongying X5 Pro | 2026-10-26 | 7.2 High |
| A vulnerability has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this issue is the function plugin_init of the file /tmp/upload_files of the component PPPoE WAN Setting Handler. Such manipulation of the argument pppd_options leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-107895 | 2026-10-26 | 7.8 High | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds write vulnerability. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107896 | 2026-10-26 | 7.8 High | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6ComFile!load_gr_item. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-107898 | 2026-10-26 | 7.8 High | ||
| V-SFT provided by FUJI ELECTRIC CO., LTD. contains an out-of-bounds read vulnerability in VS6EditData!CDataRomErrorCheck::MacroCommandCheck. Opening a crafted V7 file may lead to information exposure or arbitrary code execution on the affected product. | ||||
| CVE-2026-82947 | 2026-10-26 | 7.1 High | ||
| SOEM version 2.0.0 and earlier contains multiple vulnerabilities in frame processing where a malicious device can cause the master to read data outside allocated buffers. The software uses length and offset values from device messages without validating them against buffer sizes. This can cause the master to access invalid memory locations, potentially disclosing sensitive information or causing crashes. | ||||