Export limit exceeded: 378299 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (378299 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-9577 | 2 Ifeelweb, Wordpress | 2 Post Status Notifier Lite, Wordpress | 2026-07-30 | 4.8 Medium |
| The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the `mod` URL parameter before reflecting it into the admin settings page (`admin.php?page=post-status-notifier-lite`), leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's session when they are tricked into following a crafted URL. | ||||
| CVE-2026-9729 | 2 Webpushr, Wordpress | 2 Web Push Notifications, Wordpress | 2026-07-30 | 6.4 Medium |
| The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushr_notification_title' and 'webpushr_notification_body' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the save_send_notification_flag() function and missing output escaping in the wpp_notification_box() function, which concatenates raw post meta values directly into HTML attribute and textarea contexts. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-65758 | 1 Tassos.gr | 1 Convert Forms Component For Joomia | 2026-07-30 | N/A |
| Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions. | ||||
| CVE-2026-47755 | 1 Itflow | 1 Itflow | 2026-07-30 | 6.5 Medium |
| ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly requesting the credential edit modal with an arbitrary `credential_id`. The endpoint does not enforce client scoping or object-level authorization before loading and decrypting the credential record. Version 26.05 fixes the issue. | ||||
| CVE-2026-15687 | 1 Kubernetes | 1 Java | 2026-07-30 | N/A |
| A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false. | ||||
| CVE-2026-51078 | 1 Dedecms | 1 Dedecms | 2026-07-30 | 7.5 High |
| An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the file_manage_control.php component | ||||
| CVE-2026-18207 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-07-30 | 6.5 Medium |
| A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles. | ||||
| CVE-2026-18255 | 1 Redhat | 2 Quay, Quay 3 | 2026-07-30 | 7.2 High |
| A flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account. | ||||
| CVE-2026-65635 | 1 Malach-it | 2 Boruta, Boruta-server | 2026-07-30 | N/A |
| Improper Isolation or Compartmentalization vulnerability in malach-it boruta (Elixir.Boruta.Openid module) allows attackers to register OpenID Connect clients with administrative privileges through the dynamic client registration entry point. Boruta.Openid.register_client/3 forwards caller-supplied registration parameters to the administrative client creation path without a public/admin field-level allowlist, so an unauthenticated registrant can set security-sensitive attributes including supported grant types, authorized scopes, PKCE enforcement, public refresh and revocation behavior, token lifetimes, and signing settings. The library does not distinguish between metadata a public registrant is allowed to set and administrative controls that should require operator approval. This vulnerability is associated with program files lib/boruta/openid.ex and program routines 'Elixir.Boruta.Openid':register_client/3, 'Elixir.Boruta.Openid':parse_registration_params/2. This issue affects boruta from 2.3.0 before 2.3.7. | ||||
| CVE-2026-14227 | 1 Mikrotik | 1 Routeros | 2026-07-30 | 4.9 Medium |
| An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information. | ||||
| CVE-2026-26081 | 1 Haproxy | 1 Haproxy | 2026-07-30 | 4.8 Medium |
| HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. | ||||
| CVE-2024-51311 | 1 Tenda | 1 Tx9 | 2026-07-30 | 9.8 Critical |
| The Tenda TX9 V22.03.02.05 firmware has a stack overflow vulnerability in the sub_4418CC function of the file /goform/SetNetControlList. | ||||
| CVE-2024-51312 | 1 Tenda | 1 Tx9 | 2026-07-30 | 9.8 Critical |
| The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EEE0 function of the file /goform/SetStaticRouteCfg. | ||||
| CVE-2024-51313 | 1 Tenda | 1 Tx9 | 2026-07-30 | 9.8 Critical |
| The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_42EA38 function of the file /goform/SetVirtualServerCfg. | ||||
| CVE-2024-51314 | 1 Tenda | 1 Tx9 | 2026-07-30 | 9.8 Critical |
| The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_424CE0 function of the file /goform/setMacFilterCfg. | ||||
| CVE-2024-51315 | 1 Tenda | 1 Tx9 | 2026-07-30 | 9.8 Critical |
| The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub_425964 function of the file /goform/SetOnlineDevName | ||||
| CVE-2024-51316 | 1 Tenda | 1 Tx9 | 2026-07-30 | 7.5 High |
| The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the update_dev_name function of the file /goform/SetOnlineDevName | ||||
| CVE-2026-51025 | 2026-07-30 | 6.1 Medium | ||
| Cross Site Scripting vulnerability in fuint Member Marketing System <=v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file | ||||
| CVE-2026-51031 | 2026-07-30 | 7.5 High | ||
| FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint. This allows a remote attacker to obtain sensitive information | ||||
| CVE-2026-52656 | 2026-07-30 | 9.8 Critical | ||
| An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute arbitrary code via a crafted FEX file | ||||