Export limit exceeded: 402509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (402509 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-32578 | 2026-10-06 | 7.1 High | ||
| Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions. | ||||
| CVE-2026-32577 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions. | ||||
| CVE-2026-32575 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions. | ||||
| CVE-2026-32574 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Smart Forms <= 2.6.104 versions. | ||||
| CVE-2026-32572 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions. | ||||
| CVE-2026-32571 | 2026-10-06 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions. | ||||
| CVE-2026-32570 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions. | ||||
| CVE-2026-32569 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions. | ||||
| CVE-2026-32568 | 2026-10-06 | 9.9 Critical | ||
| Subscriber Remote Code Execution (RCE) in WooCommerce Designer Pro <= 1.9.33 versions. | ||||
| CVE-2026-32557 | 2026-10-06 | 9.3 Critical | ||
| Unauthenticated SQL Injection in WooCommerce Appointments <= 5.3.2 versions. | ||||
| CVE-2026-25434 | 2026-10-06 | 8.5 High | ||
| Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. | ||||
| CVE-2026-25433 | 2026-10-06 | 7.1 High | ||
| Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. | ||||
| CVE-2026-105985 | 1 Craftcms | 1 Cms | 2026-10-06 | 8.8 High |
| Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required. | ||||
| CVE-2026-105879 | 2026-10-06 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2. | ||||
| CVE-2026-105317 | 2026-10-06 | 8.5 High | ||
| Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. | ||||
| CVE-2026-105072 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. | ||||
| CVE-2026-105071 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. | ||||
| CVE-2026-105070 | 2026-10-06 | 8.8 High | ||
| Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | ||||
| CVE-2026-105061 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | ||||
| CVE-2026-105059 | 2026-10-06 | 6.5 Medium | ||
| Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions. | ||||