Export limit exceeded: 421557 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421557 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124623 | 1 Piprapay | 1 Piprapay | 2026-11-09 | 4.7 Medium |
| A security flaw has been discovered in PipraPay 3.0.0. Affected is the function system-settings-import of the file /sumo166/CVE-apply/blob/main/PipraPay/PipraPay/system-settings-import of the component ZIP Archive Handler. Performing a manipulation results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-119483 | 2 10web, Wordpress-extensions | 2 Form Maker By 10web, Form Maker By 10web | 2026-11-09 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker by 10Web form-maker allows Stored XSS.This issue affects Form Maker by 10Web: from n/a through 1.15.50. | ||||
| CVE-2026-124684 | 1 Samsung Open Source | 1 Escargot | 2026-11-09 | 5.1 Medium |
| Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation. This issue affects Escargot: before 8bc35b7b88f0f96c66a42aa965a1a710308b61d5. | ||||
| CVE-2026-40913 | 1 Apache | 1 Airflow | 2026-11-09 | N/A |
| Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the `ImportError.can_read` permission when the failing file has no registered DAG. This happens when a file fails to parse before any DAG is defined, or when all of its previously registered DAGs are removed but the parse error remains. Users who should not see that file's details can read stack traces that may expose file paths and code. Users are advised to upgrade to Apache Airflow 3.4.0 or later, which restricts these stack traces to users with the new `IMPORT_ERRORS_ALL` permission. | ||||
| CVE-2026-54863 | 2 Mamunur Rashid, Wordpress-extensions | 2 Review Schema, Review Schema | 2026-11-09 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Review Schema review-schema allows Reflected XSS.This issue affects Review Schema: from n/a through 3.1.4. | ||||
| CVE-2026-118196 | 1 Apache | 1 Allura | 2026-11-09 | N/A |
| OAuth 1 rebinding vulnerability in Apache Allura. This issue affects Apache Allura: through 1.22.0. Users are recommended to upgrade to version 1.22.1, which fixes the issue. | ||||
| CVE-2026-122673 | 2026-11-09 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8. | ||||
| CVE-2026-112205 | 1 Fundacja Widzialni | 1 Widzialnicms | 2026-11-09 | N/A |
| WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionality. The cookie-based lockout can be bypassed by omitting the login_count and login_timeout cookies, allowing an unauthenticated attacker to perform an unlimited number of login attempts. This issue has been fixed in version 2.5. | ||||
| CVE-2026-112204 | 1 Fundacja Widzialni | 1 Widzialnicms | 2026-11-09 | N/A |
| WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft. This issue has been fixed in version 2.5. | ||||
| CVE-2026-110469 | 1 Fundacja Widzialni | 1 Widzialnicms | 2026-11-09 | N/A |
| WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the uploadPath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5. | ||||
| CVE-2026-110468 | 1 Fundacja Widzialni | 1 Widzialnicms | 2026-11-09 | N/A |
| WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpoint. Due to a client-controlled permission check parameter and insufficient validation of the currentpath parameter, an unauthenticated attacker can upload arbitrary files to any locations on the server, leading to Remote Code Execution. This issue has been fixed in version 2.5. | ||||
| CVE-2026-124622 | 1 Olivier-ls | 1 Php-fts | 2026-11-09 | 5.3 Medium |
| A vulnerability was identified in olivier-ls PHP-FTS up to 1.1.3. This impacts the function TrigramIndex::open of the file Storage.php. Such manipulation leads to time-of-check time-of-use. The attack needs to be performed locally. Upgrading to version 1.1.4 will fix this issue. The name of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. Upgrading the affected component is recommended. The project maintainer explains: "[T]he attack requires write access to the index directory by a user other than the one running the application. That is a real shared-hosting scenario and worth defending against, which is why it is fixed but it is a hardening measure rather than a remotely reachable vulnerability, and the "Code Execution" impact additionally assumes the symlink target is a web-served .php file." | ||||
| CVE-2026-123475 | 2 Pt Norther Lights Production, Wordpress-extensions | 2 Mapsvg, Mapsvg | 2026-11-09 | 7.5 High |
| Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through 8.16.3. | ||||
| CVE-2026-122661 | 2 Wordpress-extensions, Wpwax | 2 Directorist, Directorist | 2026-11-09 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist directorist allows Stored XSS.This issue affects Directorist: from n/a through 8.10.7. | ||||
| CVE-2026-123460 | 2 Nickboss, Wordpress-extensions | 2 Wordpress File Upload, Wordpress File Upload | 2026-11-09 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2. | ||||
| CVE-2026-112171 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| An attacker can inject malicious SQL statements through user-controlled input, allowing unauthorized access to, modification of, or disclosure of database data. | ||||
| CVE-2026-112170 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| The software downloads upgrade files without performing integrity checks, allowing the installation of tampered updates. | ||||
| CVE-2026-112169 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| Magistra software contains undocumented backdoor functionality that allows authentication bypass and the creation of a privileged user account without credential verification. | ||||
| CVE-2026-112168 | 1 Galeno Sistemi | 1 Magistra | 2026-11-09 | N/A |
| The Magistra software uses weak custom encryption, relies on an outdated compression algorithm to protect the database, and contains embedded secrets. | ||||
| CVE-2026-95648 | 2026-11-09 | 8.1 High | ||
| Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729. | ||||