Export limit exceeded: 384355 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 384355 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 384355 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 95490 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95490 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-57362 | 2 Quantumcloud, Wordpress | 2 Chatbot, Wordpress | 2026-07-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in ChatBot <= 8.3.2 versions. | ||||
| CVE-2026-57356 | 2026-07-02 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in MC Woocommerce Wishlist <= 1.9.19 versions. | ||||
| CVE-2026-57343 | 2026-07-02 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Real Estate 7 <= 3.5.9 versions. | ||||
| CVE-2026-57765 | 2 Levelfourdevelopment, Wordpress | 2 Wp-easycart, Wordpress | 2026-07-02 | 8.5 High |
| Contributor SQL Injection in WP EasyCart <= 5.9.0 versions. | ||||
| CVE-2026-57758 | 2026-07-02 | 7.1 High | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Permalink Manager for WooCommerce <= 1.0.8.2 versions. | ||||
| CVE-2026-57752 | 2026-07-02 | 8.5 High | ||
| Contributor SQL Injection in iNET Webkit 1.2.4 versions. | ||||
| CVE-2026-57746 | 2026-07-02 | 7.1 High | ||
| Subscriber Broken Access Control in Booked <= 3.0.0 versions. | ||||
| CVE-2026-57687 | 2 Hiroaki Miyashita, Wordpress | 2 Custom Field Template, Wordpress | 2026-07-02 | 8.5 High |
| Contributor SQL Injection in Custom Field Template <= 2.7.8 versions. | ||||
| CVE-2026-46680 | 2 Containerd, Linuxfoundation | 2 Containerd, Containerd | 2026-07-02 | 7.8 High |
| containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an /etc/passwd file mapping this large numeric string to root, the container ultimately runs as root (UID 0). This allows the Kubernetes runAsNonRoot restriction to be bypassed, causing unexpected behavior for environments that require containers to run as a non-root user. This issue has been fixed in versions 1.7.32, 2.0.9, 2.2.4 and 2.3.1. | ||||
| CVE-2026-53346 | 1 Linux | 1 Linux Kernel | 2026-07-02 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: rust: arm64: set uwtable llvm module flag for CONFIG_UNWIND_TABLES Due to a rustc bug [1] the -Cforce-unwind-tables=y flag only emits the uwtable annotation for functions, but not for the module. This means that compiler-generated functions such as 'asan.module_ctor' do not receive the uwtable annotation. When CONFIG_UNWIND_PATCH_PAC_INTO_SCS is enabled, this leads to boot failures because the dwarf information emitted for the kasan constructors is wrong, which causes the SCS boot patching code to patch the constructor in an illegal manner. Specifically, the paciasp instruction is patched, but the autiasp instruction is not. This mismatch leads to a crash when the constructor is called during boot. ================================================================== BUG: KASAN: global-out-of-bounds in do_basic_setup+0x4c/0x90 Read of size 8 at addr ffffffe3cc7eb488 by task swapper/0/1 Specifically the faulting instruction is the (*fn)() to invoke the constructor in do_ctors() of the init/main.c file. Once the fix lands in rustc, this flag can be made conditional on the rustc version. Note that passing the flag on a rustc with the fix present has no effect. [ The fix [1] has landed for Rust 1.98.0 (expected release on 2026-08-20). Thus add a version check as discussed. - Miguel ] [ Adjusted link and comment. - Miguel ] | ||||
| CVE-2026-9272 | 2 Progress, Progress Software | 2 Flowmon Anomaly Detection System, Flowmon Ads | 2026-07-02 | 8.1 High |
| In Progress Flowmon ADS versions prior to 12.5.6 and 13.0.5, a vulnerability exists whereby an adversary who is authenticated as a low-privileged user in the Anomaly Detection System (ADS) may send specially crafted requests that could result in unauthorized access to application data and its modification. | ||||
| CVE-2026-14265 | 2 Amazon, Aws | 2 Advanced Jdbc Wrapper, Aws Advanced Jdbc Wrapper | 2026-07-02 | 7.5 High |
| Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later. | ||||
| CVE-2026-13251 | 2 Perfmatters, Wordpress | 2 Perfmatters, Wordpress | 2026-07-02 | 7.5 High |
| The Perfmatters plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.4 via the 's' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires the Local Google Fonts feature to be enabled (disabled by default), pretty permalinks to be active, and RSS feed links to remain enabled in the plugin settings. | ||||
| CVE-2025-69133 | 2 Goodlayers, Wordpress | 2 Tour Master, Wordpress | 2026-07-02 | 7.5 High |
| Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. | ||||
| CVE-2026-57344 | 2 Radiustheme, Wordpress | 2 Classified Listing, Wordpress | 2026-07-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.4.2 versions. | ||||
| CVE-2026-57351 | 2 Haktansuren, Wordpress | 2 Handl Utm Grabber, Wordpress | 2026-07-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in HandL UTM Grabber <= 2.9.2 versions. | ||||
| CVE-2026-57366 | 2 Greg Winiarski, Wordpress | 2 Wpadverts, Wordpress | 2026-07-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.1 versions. | ||||
| CVE-2026-57675 | 2 Jacob N. Breetvelt, Wordpress | 2 Wp Photo Album Plus, Wordpress | 2026-07-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.2.02.004 versions. | ||||
| CVE-2026-56037 | 2026-07-02 | 8.8 High | ||
| Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection. This issue affects Themify Popup: from n/a through 1.4.3. | ||||
| CVE-2025-69094 | 2026-07-02 | 8.5 High | ||
| Subscriber SQL Injection in Unicamp <= 2.2.2 versions. | ||||