Export limit exceeded: 374346 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (374346 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65541 | 2 Solutioned, Wordpress | 2 Staff Training, Wordpress | 2026-08-07 | 7.3 High |
| Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. | ||||
| CVE-2026-65542 | 2 Rajat Varlani, Wordpress | 2 Super Socializer, Wordpress | 2026-08-07 | 8.8 High |
| Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | ||||
| CVE-2026-65543 | 2 Vimeodev, Wordpress | 2 Vimeo, Wordpress | 2026-08-07 | 7.5 High |
| Subscriber Sensitive Data Exposure in Vimeo <= 1.2.2 versions. | ||||
| CVE-2026-65544 | 2 Rajat Varlani, Wordpress | 2 Super Socializer, Wordpress | 2026-08-07 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions. | ||||
| CVE-2026-65546 | 2 Qode, Wordpress | 2 Qode Tours, Wordpress | 2026-08-07 | 9.3 Critical |
| Unauthenticated SQL Injection in Qode Tours <= 3.1.3.1 versions. | ||||
| CVE-2026-65553 | 2 Wbolt.com, Wordpress | 2 Spider Analyser – Wordpress搜索引擎蜘蛛分析插件, Wordpress | 2026-08-07 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. | ||||
| CVE-2026-65554 | 2 Lattepress, Wordpress | 2 Anspress – Question And Answer, Wordpress | 2026-08-07 | 7.1 High |
| Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. | ||||
| CVE-2026-65556 | 2 Mihche, Wordpress | 2 Wpbruiser {no- Captcha Anti-spam}, Wordpress | 2026-08-07 | 9.8 Critical |
| Unauthenticated PHP Object Injection in WPBruiser {no- Captcha anti-Spam} <= 3.1.43 versions. | ||||
| CVE-2026-65571 | 2 Axiomthemes, Wordpress | 2 69 Clothing, Wordpress | 2026-08-07 | 9.8 Critical |
| Unauthenticated PHP Object Injection in 69 Clothing <= 1.2.11.1 versions. | ||||
| CVE-2026-65572 | 2 Axiomthemes, Wordpress | 2 A.williams, Wordpress | 2026-08-07 | 9.8 Critical |
| Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions. | ||||
| CVE-2026-66665 | 2 Brandexponents, Wordpress | 2 Type Hub, Wordpress | 2026-08-07 | 10 Critical |
| Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | ||||
| CVE-2026-66681 | 2 Jeff Farthing, Wordpress | 2 Theme My Login, Wordpress | 2026-08-07 | 4.3 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Theme My Login <= 7.1.14 versions. | ||||
| CVE-2026-66683 | 2 Wordpress, Wp Zone | 2 Wordpress, Custom Css And Javascript | 2026-08-07 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in Custom CSS and JavaScript <= 2.0.16 versions. | ||||
| CVE-2026-66685 | 2 Alex, Wordpress | 2 Featured Video Plus, Wordpress | 2026-08-07 | 5.3 Medium |
| Unauthenticated Sensitive Data Exposure in Featured Video Plus <= 2.3.3 versions. | ||||
| CVE-2026-66686 | 2 Vladimir Garagulya, Wordpress | 2 Plugins Garbage Collector (database Cleanup), Wordpress | 2026-08-07 | 6.5 Medium |
| Unauthenticated Cross Site Request Forgery (CSRF) in Plugins Garbage Collector (Database Cleanup) <= 0.14 versions. | ||||
| CVE-2026-66696 | 2 Nexcess, Wordpress | 2 Gutenberg Blocks By Kadence Blocks, Wordpress | 2026-08-07 | 4.3 Medium |
| Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. | ||||
| CVE-2026-53977 | 1 Bohdan Triapitsyn | 1 Openchamber | 2026-08-07 | 7.5 High |
| OpenChamber 1.11.7 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to terminate the server process by sending a POST request to the /api/system/shutdown endpoint, which is registered before the authentication middleware in the Express route handler chain. Attackers can exploit the route registration order in bootstrap-runtime.js to reach the shutdown handler before auth middleware executes, causing denial of service to all active AI coding sessions and locking out legitimate remote users regardless of whether UI_PASSWORD is configured. | ||||
| CVE-2026-18276 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 4.3 Medium |
| Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity via the object_cls and object_pk values of a join-room message, which are passed to group_add without an access check | ||||
| CVE-2026-18275 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 6.5 Medium |
| Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part primary keys supplied to a many=True related field whose queryset restriction was applied to the ManyRelatedField instead of its child_relation and therefore had no effect | ||||
| CVE-2026-18359 | 1 Scripta | 1 Escriptorium | 2026-08-07 | 8.5 High |
| Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, via the mets_uri or iiif_uri parameter of POST /api/documents/{pk}/imports/, because the IMPORT_ALLOWED_DOMAINS setting defaults to '*' and no address filtering, redirect cap or timeout is applied | ||||