Export limit exceeded: 380204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 380204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (380204 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-32553 | 2 Brainstorm Force, Wordpress | 2 Ottokit, Wordpress | 2026-08-18 | 7.2 High |
| Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions. | ||||
| CVE-2026-32473 | 2026-08-18 | 7.2 High | ||
| Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions. | ||||
| CVE-2026-32466 | 2026-08-18 | 8.5 High | ||
| Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions. | ||||
| CVE-2026-23922 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint. | ||||
| CVE-2026-16309 | 2026-08-18 | 5.3 Medium | ||
| Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects EdoWEB: before 780-g7. | ||||
| CVE-2026-15748 | 2 Wordpress, Wpmudev | 2 Wordpress, Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 2026-08-18 | 9.8 Critical |
| The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function. This is due to insufficient file type validation in handle_file_upload, where the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, combined with a public submission handler that trusts attacker-controlled upload field configuration injected via a forged Select field value. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. | ||||
| CVE-2026-11817 | 2026-08-18 | N/A | ||
| This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In a multi-organization stack, a user who is an Org Admin of a single organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data belonging to other organizations. The disclosed data is limited to dashboard and folder identifiers (UIDs) and per-user permission/scope mappings (which user holds which access on which dashboard). Dashboard contents, panels, query results, datasource credentials, secrets, and personal data are not exposed. This is a limited cross-organization information disclosure affecting multi-org deployments only. | ||||
| CVE-2026-13072 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 8.1 High |
| When compute mode is enabled on a standalone mongod instance, insufficient validation of externally sourced BSON data during aggregation pipeline processing can result in memory corruption, potentially leading to process termination or other unintended behavior. This configuration is non-default and requires explicit enablement at startup. | ||||
| CVE-2026-13073 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 4.3 Medium |
| An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options. | ||||
| CVE-2026-13074 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 5.3 Medium |
| An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability. | ||||
| CVE-2026-73380 | 2026-08-18 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | ||||
| CVE-2026-68565 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-08-18 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions. | ||||
| CVE-2026-73189 | 2 Themeum, Wordpress | 2 Wp Crowdfunding, Wordpress | 2026-08-18 | 6.5 Medium |
| Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions. | ||||
| CVE-2026-13075 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 6.5 Medium |
| An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries. | ||||
| CVE-2026-13076 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 6.5 Medium |
| An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries. | ||||
| CVE-2026-13077 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 7.1 High |
| A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents. | ||||
| CVE-2026-13078 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 7.7 High |
| A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process. | ||||
| CVE-2026-50185 | 1 Rustcrypto | 2 Cmov, Utils | 2026-08-18 | 3.3 Low |
| RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4. | ||||
| CVE-2026-35616 | 1 Fortinet | 1 Forticlientems | 2026-08-18 | 9.1 Critical |
| A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | ||||
| CVE-2026-32465 | 2 G5theme, Wordpress | 2 Essential Real Estate, Wordpress | 2026-08-18 | 8.8 High |
| Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | ||||