Export limit exceeded: 390836 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 390836 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390836 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86151 | 1 Tenda | 2 Cp3, Cp3 Firmware | 2026-09-11 | 9.1 Critical |
| A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be initiated remotely. | ||||
| CVE-2026-86093 | 1 Ibm | 1 Db2 | 2026-09-11 | 7.5 High |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server endpoint to execute arbitrary commands on Db2 clients due to a stack-based buffer overflow that improperly copies user-controlled data into a fixed-size stack buffer without bounds checking. | ||||
| CVE-2026-85703 | 1 Ramon-victor | 1 Freegpt-webui | 2026-09-11 | 6.5 Medium |
| A flaw has been found in ramon-victor freegpt-webui up to 098db3dfeb41555c2ca9269df0f13e10ec1c35dc. Affected by this issue is the function getJailbreak of the file server/backend.py of the component Jailbreak Mode. Executing a manipulation can lead to allocation of resources. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-85645 | 2 10web, Wordpress | 2 Form Maker By 10web – Mobile-friendly Drag & Drop Contact Form Builder, Wordpress | 2026-09-11 | 6.1 Medium |
| The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the bulk_action parameter in all versions up to, and including, 1.15.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | ||||
| CVE-2026-85638 | 1 Jofpin | 1 Trape | 2026-09-11 | 7.3 High |
| A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-85516 | 1 Code-projects | 1 Vehicle Management System | 2026-09-11 | 7.3 High |
| A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-85408 | 1 Eleveo | 1 Quality Management | 2026-09-11 | 4.3 Medium |
| A vulnerability was determined in Eleveo Quality Management 9.7.0. Impacted is an unknown function of the file /enc-fwk-data/api/v3/conversations/<ID>/events of the component Conversation Handler. This manipulation of the argument createdBy causes dynamically-determined object attributes. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-85402 | 1 Code-projects | 1 Doctor Appointment System | 2026-09-11 | 7.3 High |
| A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument doc_id results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-85383 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-11 | 6.3 Medium |
| A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/inv_del.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. | ||||
| CVE-2026-85378 | 1 Light0011 | 1 Cms | 2026-09-11 | 7.3 High |
| A vulnerability was identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. Affected by this issue is the function AuthController::_initialize of the file App/Admin/Controller/ChapterController.class.php of the component Chapter Controller. The manipulation leads to authorization bypass. The attack can be initiated remotely. The exploit is publicly available and might be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-84816 | 2 Realmag777, Wordpress | 2 Wpcs, Wordpress | 2026-09-11 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPCS <= 1.3.2 versions. | ||||
| CVE-2026-82537 | 1 Roocode | 1 Roo-code | 2026-09-11 | 8.8 High |
| Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability that allows attackers to execute denied shell commands by exploiting a word-boundary mismatch in comment handling between the approval gate's shell parser and bash. Attackers can craft a command string with an allowlisted word immediately followed by a hash character, separator, and denied command to pass the approval gate while bash executes the denied command with the agent's auto-execute privileges on the developer's machine. | ||||
| CVE-2026-82099 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-11 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-82004 | 1 Adobe | 1 Campaign | 2026-09-11 | 10 Critical |
| Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-81940 | 1 Ibm | 1 Langflow Oss | 2026-09-11 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special characters in flow display names. | ||||
| CVE-2026-81825 | 2 Specialk, Wordpress | 2 Simple Ajax Chat – Add A Fast, Secure Chat Box, Wordpress | 2026-09-11 | 7.2 High |
| The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, <= 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce protecting chat message submission is publicly visible on the chat page, rendering it ineffective as an authentication barrier and allowing fully unauthenticated attackers to submit malicious messages that are stored persistently and rendered to all visitors on every page load. | ||||
| CVE-2026-81800 | 2026-09-11 | 9.3 Critical | ||
| Unauthenticated SQL Injection in Verified Reviews (Avis Vérifiés) <= 2.4.6 versions. | ||||
| CVE-2026-81786 | 2 Villatheme, Wordpress | 2 Thank You Page Customizer For Woocommerce, Wordpress | 2026-09-11 | 7.5 High |
| Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions. | ||||
| CVE-2026-81275 | 2 Wordpress, Youzify | 2 Wordpress, Youzify | 2026-09-11 | 6.5 Medium |
| Subscriber Arbitrary File Download in Youzify <= 1.3.7 versions. | ||||
| CVE-2026-81213 | 1 Ibm | 1 Langflow Oss | 2026-09-11 | 8.6 High |
| IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote attacker to obtain sensitive information from internal network resources due to improper validation of user-supplied URLs. | ||||