Export limit exceeded: 421367 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421367 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121380 | 2026-11-07 | 5.3 Medium | ||
| The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams. | ||||
| CVE-2026-121857 | 2026-11-07 | 4.2 Medium | ||
| The Event Tickets with Ticket Scanner WordPress plugin before 3.1.14 does not check that a user may manage WooCommerce orders before returning or removing ticket data for any order, allowing any role an administrator has granted access to the Event Tickets with Ticket Scanner WordPress plugin before 3.1.14's admin area (down to Subscriber) to view other customers' ticket codes and names and to remove tickets from their orders. | ||||
| CVE-2026-124058 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-07 | 9.1 Critical |
| A weakness has been identified in TOTOLINK CA300-PoE 6.2c.884. Affected is the function setWiFiRepeaterConfig of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument ApCliKeyStr can lead to buffer overflow. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-66669 | 2026-11-07 | 8.8 High | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Suplugins Superb Addons: Blocks, Patterns & Theme Designer superb-blocks allows Cross Site Request Forgery.This issue affects Superb Addons: Blocks, Patterns & Theme Designer: from n/a through 4.2.4. | ||||
| CVE-2026-52713 | 2 Thimpress, Wordpress-extensions | 2 Learnpress, Learnpress | 2026-11-07 | 5.4 Medium |
| Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12. | ||||
| CVE-2026-124274 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-124258 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.1. | ||||
| CVE-2026-123861 | 2026-11-07 | 5.3 Medium | ||
| Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10. | ||||
| CVE-2026-123474 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18. | ||||
| CVE-2026-123468 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128. | ||||
| CVE-2026-123467 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128. | ||||
| CVE-2026-123466 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18. | ||||
| CVE-2026-123462 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-123461 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.6. | ||||
| CVE-2026-123357 | 1 Grobidorg | 1 Grobid | 2026-11-07 | 0 Low |
| GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto, which interpolates the path into a bash -c command string. A single quote in the filename can terminate the intended quoting, and ProcessRunner.run in grobid-core/src/main/java/org/grobid/core/process/ProcessRunner.java starts the resulting command through ProcessBuilder, allowing arbitrary commands to execute with GROBID process privileges. The bundled REST server path is not affected. This issue is fixed in version 0.9.1. | ||||
| CVE-2026-123321 | 1 Jetbrains | 1 Webstorm | 2026-11-07 | 7.8 High |
| In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects | ||||
| CVE-2026-123317 | 1 Jetbrains | 1 Ktor | 2026-11-07 | 8.1 High |
| In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies | ||||
| CVE-2026-123307 | 1 Jetbrains | 1 Intellij Idea | 2026-11-07 | 6.8 Medium |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible | ||||
| CVE-2026-123306 | 1 Jetbrains | 1 Intellij Idea | 2026-11-07 | 7.4 High |
| In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs | ||||
| CVE-2026-123297 | 1 Jetbrains | 1 Hub | 2026-11-07 | 6.8 Medium |
| In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow | ||||