Export limit exceeded: 370606 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 370606 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370606 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59549 | 2026-07-27 | 9.3 Critical | ||
| Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.10 versions. | ||||
| CVE-2026-59548 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in Byteflows Travel & Hotel Booking <= 1.0.0 versions. | ||||
| CVE-2026-59546 | 2026-07-27 | 7.4 High | ||
| Subscriber Broken Authentication in Hide My WP Ghost <= 7.0.06 versions. | ||||
| CVE-2026-59539 | 2026-07-27 | 7.5 High | ||
| Subscriber Insecure Direct Object References (IDOR) in Paid Member Subscriptions <= 3.0.7 versions. | ||||
| CVE-2026-59538 | 2026-07-27 | 9.3 Critical | ||
| Unauthenticated SQL Injection in GamiPress <= 7.9.7 versions. | ||||
| CVE-2026-59537 | 2026-07-27 | 7.6 High | ||
| Administrator SQL Injection in Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce <= 2.10.22 versions. | ||||
| CVE-2026-59536 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | ||||
| CVE-2026-59535 | 2026-07-27 | 7.3 High | ||
| Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | ||||
| CVE-2026-59534 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | ||||
| CVE-2026-59533 | 2026-07-27 | 9.3 Critical | ||
| Unauthenticated SQL Injection in Relevanssi Light <= 1.2.2 versions. | ||||
| CVE-2026-59532 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Other Vulnerability Type in Booking and Rental Manager <= 2.7.2 versions. | ||||
| CVE-2026-59531 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Unknown in Falcon – WordPress Optimizations & Tweaks <= 2.10.0 versions. | ||||
| CVE-2026-59530 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | ||||
| CVE-2026-59529 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | ||||
| CVE-2026-59528 | 2026-07-27 | 7.5 High | ||
| Subscriber Sensitive Data Exposure in ShipTime: Discounted Shipping Rates <= 1.1.1 versions. | ||||
| CVE-2026-59527 | 2026-07-27 | 9.3 Critical | ||
| Unauthenticated SQL Injection in MapSVG <= 8.14.0 versions. | ||||
| CVE-2026-14955 | 2026-07-27 | 6.5 Medium | ||
| The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.7.7 via the 'thwcfe_legacy_file' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. | ||||
| CVE-2026-13400 | 2026-07-27 | 6.1 Medium | ||
| Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time. | ||||
| CVE-2026-61511 | 2026-07-27 | 9.8 Critical | ||
| vBulletin 5.x through 5.7.5 and 6.x through 6.2.1 contains an eval injection vulnerability in the vB5_Template_Runtime::runMaths() method within the template runtime that allows unauthenticated remote attackers to execute arbitrary PHP code by supplying crafted input through the pagenav[pagenumber] parameter. Attackers can exploit the insufficiently restrictive regex filter by using phpfuck-style encoding with permitted characters to inject and execute arbitrary PHP code via the unauthenticated ajax/render template route without any authentication. | ||||
| CVE-2026-15003 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Openshift | 2026-07-27 | 5.6 Medium |
| A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could exploit this by providing a malicious file, leading to an out-of-bounds read of memory. This can result in information disclosure, potentially revealing sensitive heap data, and a Denial of Service (DoS) due to the linker crashing. | ||||