Export limit exceeded: 422029 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422029 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-61996 | 2026-10-30 | 8.5 High | ||
| Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | ||||
| CVE-2026-61992 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | ||||
| CVE-2026-61991 | 2026-10-30 | 10 Critical | ||
| Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | ||||
| CVE-2026-61989 | 2 Merv Barrett, Wordpress-extensions | 2 Easy Property Listings, Easy Property Listings | 2026-10-30 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | ||||
| CVE-2026-5461 | 2 Wordpress-extensions, Wpmudev | 2 Forminator Forms, Forminator Forms | 2026-10-30 | 6.5 Medium |
| The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due to the plugin accepting arbitrary upload field metadata from POST requests in draft submissions without proper validation, which is then used to delete files when a subsequent draft references the poisoned draft via the previous_draft_id parameter. This makes it possible for unauthenticated attackers to delete arbitrary non-PHP files within the wp-content/uploads/ directory. | ||||
| CVE-2026-57207 | 1 Netboxlabs | 1 Netbox-mcp-server | 2026-10-30 | 5.9 Medium |
| NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox tools - no token or credential needed. This issue has been patched in version 1.2.1. | ||||
| CVE-2026-54865 | 2026-10-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | ||||
| CVE-2026-54864 | 2026-10-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | ||||
| CVE-2026-54860 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | ||||
| CVE-2026-54857 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | ||||
| CVE-2026-54856 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | ||||
| CVE-2026-54852 | 2026-10-30 | 5.3 Medium | ||
| Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1. | ||||
| CVE-2026-42701 | 2026-10-30 | 7.2 High | ||
| Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | ||||
| CVE-2026-42694 | 2 Themeum, Wordpress-extensions | 2 Kirki, Kirki | 2026-10-30 | 4.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0. | ||||
| CVE-2026-42691 | 2026-10-30 | 5.4 Medium | ||
| Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0. | ||||
| CVE-2026-39375 | 1 Frappe | 1 Lms | 2026-10-30 | N/A |
| Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting. This issue is fixed in version 2.52.0. | ||||
| CVE-2026-27394 | 2026-10-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | ||||
| CVE-2026-27063 | 2026-10-30 | 5.3 Medium | ||
| Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. | ||||
| CVE-2026-27062 | 2026-10-30 | 4.3 Medium | ||
| Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5. | ||||
| CVE-2026-21811 | 1 Hcltech | 1 Appscan Integration With Azure Boards For Asoc & A360 | 2026-10-30 | 3.8 Low |
| HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext during pipeline execution. Depending on the pipeline configuration, these secrets could be exposed through task outputs, debug logs, environment variable dumps, or build agent scripts, despite being masked in the user interface. | ||||