Export limit exceeded: 390872 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 390872 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 390872 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 390872 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390872 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87891 | 2026-09-12 | 6.5 Medium | ||
| The Rox Appointment Booking WordPress plugin before 1.2.0 does not perform any capability or authorization check when saving its holiday schedule, allowing unauthenticated attackers to overwrite the dates the booking system treats as unavailable, which can block legitimate bookings or open dates the site owner intended to keep closed. | ||||
| CVE-2026-68528 | 1 Concretecms | 1 Concrete Cms | 2026-09-12 | N/A |
| Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site scripting. An attacker able to control a title in a syndicated feed could execute script in the site origin for any visitor to the affected page, including administrators, without holding an account on that site. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.0 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks riodrwn for reporting. | ||||
| CVE-2026-77006 | 2026-09-12 | 9.6 Critical | ||
| The WebTotem Backups WordPress plugin through 1.0.1 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover. | ||||
| CVE-2026-77689 | 2026-09-12 | 5.3 Medium | ||
| The Booking for Appointments and Events Calendar WordPress plugin before 9.8.1 does not verify that a payment was actually taken before recording a booking as paid, trusting the payment gateway named in a public, unauthenticated booking request even when the site has never configured that gateway. This lets an unauthenticated attacker obtain confirmed, fully paid appointments and events without any payment being collected. | ||||
| CVE-2026-82851 | 2026-09-12 | 2.7 Low | ||
| The Masteriyo LMS WordPress plugin before 3.4.1 does not verify ownership of, or restrict the type of, the records a user requests for download, allowing users with the instructor role to retrieve the full content and metadata of arbitrary posts, including other instructors' private and draft courses. | ||||
| CVE-2026-84023 | 2026-09-12 | 6.5 Medium | ||
| The BEAR WordPress plugin before 1.2.2 does not verify a CSRF nonce or check user capabilities before updating taxonomy terms, allowing an attacker to modify arbitrary terms by tricking a logged-in privileged user into visiting a crafted page. | ||||
| CVE-2026-62133 | 2 Rometheme, Wordpress | 2 Rtmkit, Wordpress | 2026-09-12 | 5.4 Medium |
| Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. | ||||
| CVE-2026-62134 | 2 Brainstormforce, Wordpress | 2 Starter Templates, Wordpress | 2026-09-12 | 4.3 Medium |
| Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions. | ||||
| CVE-2026-62137 | 2 John James Jacoby, Wordpress | 2 Bbpress, Wordpress | 2026-09-12 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. | ||||
| CVE-2026-62138 | 2 Visualcomposer, Wordpress | 2 Visual Composer Website Builder, Wordpress | 2026-09-12 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. | ||||
| CVE-2026-62139 | 2 Google, Wordpress | 2 Site Kit By Google, Wordpress | 2026-09-12 | 4.3 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions. | ||||
| CVE-2026-68526 | 1 Concretecms | 1 Concrete Cms | 2026-09-12 | N/A |
| Concrete CMS before 9.5.3 did not validate an anti-CSRF token in the Calendar event duplicate dialog controller (concrete/controllers/dialog/event/duplicate.php) submit() action, which duplicated a calendar event after checking only canAccess() and the per-resource canAddCalendarEvent() permission, so a crafted cross-site request could cause an authenticated user with add-event permission to create duplicate CalendarEvents and CalendarEventVersions records under their own authority. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.3 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Winston Crooker for reporting. | ||||
| CVE-2026-89474 | 1 Linux | 1 Linux Kernel | 2026-09-12 | 4.4 Medium |
| In the Linux kernel, the following vulnerability has been resolved: power: supply: bq256xx: drain usb_work before freeing the charger The USB-PHY notifier queues usb_work, whose handler calls power_supply_changed(bq->charger). The reset devm action only unregisters the notifier and was registered before the power supplies, so devm frees bq->charger on unwind before the action runs; a usb_work still queued can then dereference it. Register the reset action after the power supplies, so it unregisters the notifiers and drains usb_work before the supplies are released. Initialize usb_work and obtain the PHY references before registering the notifiers, so the worker cannot run before the supplies exist. Found by static analysis. | ||||
| CVE-2026-87894 | 2026-09-12 | 5.3 Medium | ||
| The Rox Appointment Booking WordPress plugin before 1.2.3 does not perform any authorization check on the endpoint that returns a booking's confirmation details, and each booking is addressed by a sequential numeric identifier, allowing unauthenticated attackers to read any customer's name, email, phone, booking details and payment status by enumerating that identifier. | ||||
| CVE-2026-62110 | 2 Bold-themes, Wordpress | 2 Bold Page Builder, Wordpress | 2026-09-12 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. | ||||
| CVE-2026-62111 | 2 Ido Kobelkowsky, Wordpress | 2 Simple Payment, Wordpress | 2026-09-12 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. | ||||
| CVE-2026-62088 | 2 10up, Wordpress | 2 Elasticpress, Wordpress | 2026-09-12 | 5.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue affects ElasticPress: from n/a through 5.3.4. | ||||
| CVE-2026-89531 | 1 Linux | 1 Linux Kernel | 2026-09-12 | 5.9 Medium |
| In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handle_connect_req() returns without action when svc_rdma_create_xprt() fails to allocate the new transport. The CM core returns 0 for CONNECT_REQUEST events, so it does not destroy the new rdma_cm_id. Each allocation failure under memory pressure leaks one rdma_cm_id, and a remote peer driving connection attempts can amplify this. Reject the connection by returning a non-zero status from the CM event handler, which tells the CM core to destroy the orphaned cm_id. | ||||
| CVE-2026-85681 | 2026-09-12 | 9.8 Critical | ||
| The WP Component WordPress plugin through 2.2.4 does not have any capability or nonce checks on one of the actions it makes available to unauthenticated users, and it takes both the option name and the option value from the request, allowing unauthenticated attackers to overwrite any of the site's options. On a single site installation this leads to a full takeover, as registration can be enabled with a default role of administrator. | ||||
| CVE-2026-87892 | 2026-09-12 | 5.3 Medium | ||
| The Rox Appointment Booking WordPress plugin before 1.2.0 does not verify the order total or the selected payment method against its own server-side pricing when creating a booking, allowing unauthenticated attackers to create confirmed bookings at an arbitrary price and to bypass the site's configured payment-method restrictions. | ||||