Export limit exceeded: 358249 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (358249 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-34898 | 2026-06-15 | 7.5 High | ||
| Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions. | ||||
| CVE-2026-34892 | 2026-06-15 | 6.5 Medium | ||
| Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions. | ||||
| CVE-2026-34891 | 2026-06-15 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in IDPay Payment Gateway for Woocommerce <= 2.2.5 versions. | ||||
| CVE-2026-27407 | 2026-06-15 | 7.2 High | ||
| Editor Privilege Escalation in AI Engine <= 3.4.9 versions. | ||||
| CVE-2026-27333 | 2026-06-15 | 8.1 High | ||
| Unauthenticated Deserialization of untrusted data in Paid Videochat Turnkey Site <= 7.3.23 versions. | ||||
| CVE-2026-27089 | 2026-06-15 | 7.5 High | ||
| Unauthenticated Bypass Vulnerability in WpTravelly <= 2.1.7 versions. | ||||
| CVE-2026-27053 | 2026-06-15 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Broadcast Live Video < 7.1.3 versions. | ||||
| CVE-2026-25440 | 2026-06-15 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions. | ||||
| CVE-2026-24637 | 2026-06-15 | 8.5 High | ||
| Contributor SQL Injection in PowerPress Podcasting <= 11.15.10 versions. | ||||
| CVE-2026-23970 | 2026-06-15 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions. | ||||
| CVE-2026-9691 | 2026-06-15 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Integration for ActiveCampaign and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.1.1 versions. | ||||
| CVE-2025-69332 | 2026-06-15 | 6.5 Medium | ||
| Subscriber Broken Access Control in Bookify <= 1.1.1 versions. | ||||
| CVE-2025-68872 | 2026-06-15 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions. | ||||
| CVE-2025-68851 | 2026-06-15 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions. | ||||
| CVE-2025-68049 | 2026-06-15 | 6.3 Medium | ||
| Subscriber Broken Access Control in bunny.net <= 2.3.6 versions. | ||||
| CVE-2025-60175 | 2026-06-15 | 4.4 Medium | ||
| Administrator Server Side Request Forgery (SSRF) in PopAd <= 1.0.4 versions. | ||||
| CVE-2025-59133 | 2026-06-15 | 7.5 High | ||
| Custom role Insecure Direct Object References (IDOR) in Projectopia <= 5.1.25.2 versions. | ||||
| CVE-2026-49954 | 2026-06-15 | 7.2 High | ||
| Discuz! X5.0 releases 20260320 through 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences in the directory attribute. Attackers can trigger an exception during plugin installation to bypass sanitization routines, causing malicious paths to be stored unsanitized and subsequently passed to include(), which combined with file upload functionality escalates to arbitrary code execution in the context of the web server user. | ||||
| CVE-2026-49953 | 2026-06-15 | 6.5 Medium | ||
| Discuz! X5.0 releases 20260320 through 20260610 contains a CAPTCHA bypass vulnerability that allows unauthenticated remote attackers to defeat challenge controls by exploiting limited complexity and predictable character sets in generated CAPTCHA images. Attackers can train a custom optical character recognition model against collected CAPTCHA samples to reliably predict challenge text, bypassing protections on login, registration, and other functionality from automated abuse. | ||||
| CVE-2026-49952 | 2026-06-15 | 9.1 Critical | ||
| Discuz! X5.0 releases 20260320 through 20260501 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to database backup and restore functionality by exploiting a shared cryptographic key between UCenter integration and the database backup API exposed by dbbak.php. Attackers can inject a crafted payload through the username parameter during login to abuse the encryption oracle in logging_ctl::logging_more(), obtain a legitimately signed token, and use it to bypass authorization for database export and import operations, with the additional ability to trigger a race condition to impersonate arbitrary users. | ||||