Export limit exceeded: 402016 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (402016 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-25434 | 2026-10-06 | 8.5 High | ||
| Subscriber SQL Injection in WP2LEADS <= 3.5.7 versions. | ||||
| CVE-2026-25433 | 2026-10-06 | 7.1 High | ||
| Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions. | ||||
| CVE-2026-105985 | 1 Craftcms | 1 Cms | 2026-10-06 | 8.8 High |
| Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any authenticated user with basic Control Panel access can submit request-controlled component classes and property overrides. By first overriding an EntryType object’s uiLabelFormat and then rendering an Entry that resolves the same request-cached entry type, an attacker can cause arbitrary Twig supplied in the request to be evaluated by renderObjectTemplate(). This render path is not sandboxed. A Twig string callable can therefore reach PHP functions such as system(), resulting in operating-system command execution with the privileges of the PHP/web-server process. The issue was reproduced with an active non-admin Craft Team user with no optional permissions enabled. No access to entry-editing, Settings, utility, user-management, project-config, filesystem, Kubernetes, or environment variables was required. | ||||
| CVE-2026-105879 | 2026-10-06 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2. | ||||
| CVE-2026-105317 | 2026-10-06 | 8.5 High | ||
| Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. | ||||
| CVE-2026-105072 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions. | ||||
| CVE-2026-105071 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. | ||||
| CVE-2026-105070 | 2026-10-06 | 8.8 High | ||
| Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | ||||
| CVE-2026-105061 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | ||||
| CVE-2026-105059 | 2026-10-06 | 6.5 Medium | ||
| Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions. | ||||
| CVE-2026-105058 | 2026-10-06 | 8.8 High | ||
| Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. | ||||
| CVE-2026-105057 | 2026-10-06 | 5.3 Medium | ||
| Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. | ||||
| CVE-2026-105056 | 2026-10-06 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ecommerce-product-catalog allows Stored XSS.This issue affects eCommerce Product Catalog: from n/a through 3.6.2. | ||||
| CVE-2026-104814 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. | ||||
| CVE-2026-104757 | 2026-10-06 | 7.2 High | ||
| Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. | ||||
| CVE-2026-104747 | 2026-10-06 | 8.1 High | ||
| Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. | ||||
| CVE-2026-104672 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. | ||||
| CVE-2026-104670 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. | ||||
| CVE-2026-104409 | 2026-10-06 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Image Photo Gallery Final Tiles Grid final-tiles-grid-gallery-lite allows Stored XSS.This issue affects Image Photo Gallery Final Tiles Grid: from n/a through 3.6.13. | ||||
| CVE-2026-104407 | 2026-10-06 | 7.1 High | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Cross Site Request Forgery.This issue affects PowerPress Podcasting: from n/a through 11.17.9. | ||||