Export limit exceeded: 413938 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413938 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-31699 | 2 Apache, Apache Software Foundation | 3 Apache Traffic Server, Traffic Server, Apache Traffic Server | 2026-10-23 | 8.9 High |
| Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | ||||
| CVE-2026-106700 | 1 Elunez | 1 Eladmin | 2026-10-23 | 8.8 High |
| ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check applied to all other user-management endpoints and performs no role-level or ownership validation in UserServiceImpl.resetPwd. Any authenticated user of any role can reset the password of arbitrary users, including the built-in administrator. | ||||
| CVE-2026-106701 | 1 Elunez | 1 Eladmin | 2026-10-23 | 6.1 Medium |
| ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue. | ||||
| CVE-2026-95155 | 1 Fasterxml | 1 Jackson-mapper-asl | 2026-10-23 | 7.5 High |
| FasterXML Jackson 1.x, confirmed in jackson-mapper-asl versions 1.8.3, 1.9.2, 1.9.11, 1.9.12, and 1.9.13, allows attackers to cause a denial of service by supplying deeply nested JSON input to an application that deserializes untrusted JSON using ObjectMapper.readValue. | ||||
| CVE-2026-14572 | 2 Themeum, Wordpress-extensions | 2 Kirki, Kirki | 2026-10-23 | 6.4 Medium |
| The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with kirki_content_access capability granted by an administrator, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-17001 | 2 Carazo, Wordpress-extensions | 2 Import And Export Users And Customers, Import And Export Users And Customers | 2026-10-23 | 6.4 Medium |
| The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-115207 | 2 Red Hat, Redhat | 4 Enterprise Linux, Enterprise Linux, Hardened Images and 1 more | 2026-10-23 | 5.5 Medium |
| A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user. | ||||
| CVE-2026-111343 | 1 Pig-mesh | 1 Pig | 2026-10-23 | 4.3 Medium |
| pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real names, phone numbers, emails, linked third-party accounts, and role assignments. | ||||
| CVE-2026-111344 | 1 Apitable | 1 Apitable | 2026-10-23 | 4.3 Medium |
| APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read node descriptions from other spaces by supplying a user-controlled nodeId. Attackers can request GET /node/{nodeId}/description, which skips space membership and node permission checks, to disclose cross-tenant datasheet, folder, and form descriptions. | ||||
| CVE-2026-111356 | 2 Maccms, Magicblack | 2 Maccms, Maccms | 2026-10-23 | 7.4 High |
| MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password. | ||||
| CVE-2026-104730 | 2 Sunshinephotocart, Wordpress-extensions | 2 Sunshine Photo Cart, Sunshine Photo Cart | 2026-10-23 | 9.8 Critical |
| The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. If a POP chain is present via an additional plugin or theme installed on the target system, the attacker can store the malicious payload unauthenticated via the public favorites page and trigger deserialization by viewing any image in a non-viewable or private gallery. | ||||
| CVE-2026-115354 | 1 Mistune Project | 1 Mistune | 2026-10-23 | 6.5 Medium |
| Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output. | ||||
| CVE-2026-115725 | 1 Chatwoot | 1 Chatwoot | 2026-10-23 | 4.2 Medium |
| Chatwoot before 4.17.0 contains an authorization bypass vulnerability that allows authenticated agent bots to access other accounts by supplying a foreign contact inbox source_id. Attackers can call the conversations create endpoint with another account's source_id to create or retrieve conversations and post messages to that account's contacts. | ||||
| CVE-2026-95182 | 1 Deepseek | 1 Deepseek-harness | 2026-10-23 | 10 Critical |
| An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content. | ||||
| CVE-2026-111444 | 1 Wheels | 1 Wheels | 2026-10-23 | 9.8 Critical |
| Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0. | ||||
| CVE-2026-15222 | 2 Wordpress-extensions, Wpeverest | 2 User Registration & Membership, User Registration & Membership | 2026-10-23 | 5.4 Medium |
| The The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.2.8. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes. | ||||
| CVE-2026-92115 | 2 Opajaap, Wordpress-extensions | 2 Wp Photo Album Plus, Wp Photo Album Plus | 2026-10-23 | 8.8 High |
| The WP Photo Album Plus plugin for WordPress is vulnerable to authenticated Command Injection in all versions up to, and including, 9.3.02.002 via the `value` parameter of the `update-photo` AJAX action. This is due to insufficient shell escaping within the `wppa_image_magick_a()` function, where the attacker-controlled `value` parameter is concatenated raw — without `escapeshellarg()` — into an ImageMagick command string before being passed to `exec()`; further, `wppa_decode()` actively restores percent-encoded shell metacharacters (e.g., `%26`→`&`, `%23`→`#`) rather than stripping them, allowing crafted payloads to survive sanitization and break out of the ImageMagick argument context. This makes it possible for authenticated attackers holding the plugin-defined `wppa_upload` capability to execute arbitrary operating-system commands as the web-server user, achieving full remote code execution on the underlying server. Exploitation requires ImageMagick to be enabled on the server; the `wppa_upload` capability is a plugin-level privilege that site administrators may grant to lower-privileged WordPress roles via the plugin's Users settings, broadening the pool of potential attackers beyond administrators. | ||||
| CVE-2026-18223 | 1 Mattermost | 1 Mattermost | 2026-10-23 | 5 Medium |
| Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the invited recipient's email address when redeeming team and guest invitation tokens, which allows an authenticated attacker to join a team or gain unauthorized access to private channels via a forwarded or leaked invitation link.. Mattermost Advisory ID: MMSA-2026-00747 | ||||
| CVE-2026-109224 | 2 Surecart, Wordpress-extensions | 2 Surecart, Surecart | 2026-10-23 | 7.2 High |
| The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires the affected comment to appear on a post that loads the surecart-components runtime (e.g. via a [sc_buy_button] shortcode) and contains no sc-checkout element, as these conditions trigger the innerHTML sink in sc-cart-loader. | ||||
| CVE-2026-107685 | 1 Agentjido | 1 Req Llm | 2026-10-23 | N/A |
| Improper Certificate Validation vulnerability in the WebSocket streaming client in agentjido req_llm allows an on-path attacker to read and modify OpenAI WebSocket sessions, including the authorization bearer token, via a TLS certificate the client does not trust. ReqLLM.Streaming.WebSocketSession.Client.start/3 in lib/req_llm/streaming/web_socket_session/client.ex starts WebSockex without TLS options, and WebSockex defaults to insecure: true, which connects with verify: :verify_none. The option allowlist also drops any caller-supplied cacerts or ssl_options, so an application cannot turn verification on. The OpenAI Responses, Realtime, and Codex WebSocket paths reach this client and send the API key or OAuth access token in the authorization header. HTTP streaming through Finch and the HTTP/2 duplex session through Mint verify certificates and are not affected. This issue affects req_llm: from 1.9.0 before 1.29.0. | ||||