Export limit exceeded: 373055 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 90703 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (90703 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16400 | 1 Mozilla | 1 Firefox | 2026-07-27 | 7.5 High |
| Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16404 | 1 Mozilla | 1 Firefox | 2026-07-27 | 7.4 High |
| Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16409 | 1 Mozilla | 1 Firefox | 2026-07-27 | 7.5 High |
| Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-59534 | 2 Aurovrata Venet, Wordpress | 2 Post My Cf7 Form, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | ||||
| CVE-2026-59546 | 2 John Darrel, Wordpress | 2 Hide My Wp Ghost, Wordpress | 2026-07-27 | 7.4 High |
| Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. | ||||
| CVE-2026-59553 | 2 Rextheme, Wordpress | 2 Product Feed Manager, Wordpress | 2026-07-27 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Product Feed Manager <= 7.6.1 versions. | ||||
| CVE-2026-66427 | 2 Jgwhite33, Wordpress | 2 Wp Google Review Slider, Wordpress | 2026-07-27 | 7.6 High |
| Administrator SQL Injection in WP Google Review Slider <= 18.4 versions. | ||||
| CVE-2026-12255 | 2026-07-27 | 8.1 High | ||
| The MainWP Child WordPress plugin before 6.1.2 does not verify the requester's identity in its site-registration request handler when password authentication has been disabled for the targeted account, allowing an unauthenticated attacker to obtain a valid authentication session as that account, including an administrator, by naming its login in a single registration request. | ||||
| CVE-2026-59686 | 1 Progress | 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more | 2026-07-27 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise. | ||||
| CVE-2026-59687 | 1 Progress | 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more | 2026-07-27 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise. | ||||
| CVE-2026-59688 | 1 Progress | 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more | 2026-07-27 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise. | ||||
| CVE-2026-59528 | 2 Shiptime, Wordpress | 2 Shiptime: Discounted Shipping Rates, Wordpress | 2026-07-27 | 7.5 High |
| Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. | ||||
| CVE-2026-59530 | 2 Paymentplugins, Wordpress | 2 Stripe For Woocommerce, Wordpress | 2026-07-27 | 7.5 High |
| Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | ||||
| CVE-2026-57396 | 2 Flintop, Wordpress | 2 Free Gifts For Woocommerce, Wordpress | 2026-07-27 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Flintop Free Gifts for WooCommerce free-gifts-for-woocommerce allows Stored XSS.This issue affects Free Gifts for WooCommerce: from n/a through <= 13.1.0. | ||||
| CVE-2026-57705 | 2 Nexcess, Wordpress | 2 Event Tickets, Wordpress | 2026-07-27 | 7.5 High |
| Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through <= 5.28.5. | ||||
| CVE-2026-57787 | 2 Creativews, Wordpress | 2 Cws Svgicons, Wordpress | 2026-07-27 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CreativeWS CWS SVGicons cws-svgicons allows Blind SQL Injection.This issue affects CWS SVGicons: from n/a through <= 1.5.5. | ||||
| CVE-2026-66143 | 1 Apache | 1 Neethi | 2026-07-27 | 7.5 High |
| It is possible to bypass the maximum number of normalized policy alternatives that was introduced in Apache Neethi 3.2.2 via certain crafted policies, which may lead to a denial of service attack via resource consumption. Users are recommended to upgrade to version 3.2.3, which fixes this issue. | ||||
| CVE-2026-66144 | 1 Apache | 1 Neethi | 2026-07-27 | 7.5 High |
| Although remote policy references are not retrieved during policy normalization, if they are manually retrieved via the API it can cause a denial of service attack if a huge policy is retrieved. Users are recommended to upgrade to version 3.2.3, which fixes this issue by imposing a default maximum size on data read from remote policy references. | ||||
| CVE-2026-45815 | 1 Apache | 1 Nimble | 2026-07-27 | 7.5 High |
| Reachable Assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response (BLE_ATT_OP_READ_MULT_VAR_RSP) may trigger assert in ATT parser. Severity is medium as this requires DUT to first send ATT Read Multiple Variable Request. This issue affects Apache NimBLE: through 1.9.0. Users are recommended to upgrade to version 1.10.0, which fixes the issue. | ||||
| CVE-2026-9765 | 1 Grafana | 1 Grafana | 2026-07-27 | 7.1 High |
| Note: The CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access Controls are “Broken” when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application, and gain unauthorized access to resources that are not available with their permissions. Broken access control can allow attackers to: Access resources only accessible to certain users, thus allowing unauthorized access to data Perform operations on behalf of other users, leading to account takeovers in the worst cases Attempt privilege escalation Attempt to take over an account | ||||