Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
115,897 matching · page 41/2318Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-54854(opens NVD record) | Medium | 6.3 | Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions. | Oct 30, 2026 |
| CVE-2026-54850(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions. | Oct 30, 2026 |
| CVE-2026-52710(opens NVD record) | Medium | 5.3 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT – Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT – Free Gifts for WooCommerce: from n/a through 4.5. | Oct 30, 2026 |
| CVE-2026-48201(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. | Oct 30, 2026 |
| CVE-2026-46560(opens NVD record) | High | 7.5 | Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `RADIUS` authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the response identifier to the outstanding request, or verify the RFC 2865 `Response Authenticator`; the RFC 2869 `Message-Authenticator` is neither sent nor required. Any non-Reject/non-Challenge packet is treated as success. On a deployment with a `RADIUS` module instance enabled on a login chain, an unauthenticated network attacker can race the real server on-path or spray forged `Access-Accept` packets off-path and obtain a session for any `RADIUS`-mapped username without knowing the shared secret. Unlike CVE-2024-3596, exploitation requires no MD5 chosen-prefix forgery because no response authenticator is checked. The resulting session carries the impersonated principal's privileges. This issue is fixed in version 16.1.1. | Oct 30, 2026 |
| CVE-2026-39786(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. | Oct 30, 2026 |
| CVE-2026-39739(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor allows Stored XSS.This issue affects Ultimate Addons for Elementor - Lite: from n/a through 2.9.5. | Oct 30, 2026 |
| CVE-2026-39738(opens NVD record) | Critical | 9.8 | Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1. | Oct 30, 2026 |
| CVE-2026-39734(opens NVD record) | High | 7.5 | Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. | Oct 30, 2026 |
| CVE-2026-39732(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions. | Oct 30, 2026 |
| CVE-2026-28160(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10. | Oct 30, 2026 |
| CVE-2026-27061(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | Oct 30, 2026 |
| CVE-2026-120046(opens NVD record) | Medium | 5.3 | Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually. | Oct 30, 2026 |
| CVE-2026-120007(opens NVD record) | Medium | 6.5 | NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation state and revoke all their sessions. | Oct 30, 2026 |
| CVE-2026-119842(opens NVD record) | Medium | 6.5 | A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file. | Oct 30, 2026 |
| CVE-2026-119729(opens NVD record) | Medium | 6.5 | A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service. | Oct 30, 2026 |
| CVE-2026-119728(opens NVD record) | Medium | 6.5 | A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service. | Oct 30, 2026 |
| CVE-2026-119727(opens NVD record) | Medium | 6.5 | A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash. An attacker can deliver the malformed bitstream as a local file or over a network stream such as HTTP, HLS, DASH, RTSP, RTP, or WebRTC. Successful exploitation requires the application to open or play that content, and is limited to a denial-of-service impact. | Oct 30, 2026 |
| CVE-2026-119526(opens NVD record) | Critical | 9.8 | Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection. This issue affects Royal Event: from n/a through 2.0. | Oct 30, 2026 |
| CVE-2026-119117(opens NVD record) | Medium | 6.5 | Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later. | Oct 30, 2026 |
| CVE-2026-118090(opens NVD record) | High | 8.8 | Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions. | Oct 30, 2026 |
| CVE-2026-118089(opens NVD record) | High | 7.2 | Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | Oct 30, 2026 |
| CVE-2026-118086(opens NVD record) | High | 8.8 | Subscriber Privilege Escalation in WP BASE Booking <= 6.5.2 versions. | Oct 30, 2026 |
| CVE-2026-116862(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. | Oct 30, 2026 |
| CVE-2026-116861(opens NVD record) | High | 7.5 | Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions. | Oct 30, 2026 |
| CVE-2026-116854(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | Oct 30, 2026 |
| CVE-2026-116853(opens NVD record) | Medium | 6.5 | Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | Oct 30, 2026 |
| CVE-2026-116852(opens NVD record) | Critical | 9.1 | Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions. | Oct 30, 2026 |
| CVE-2026-116851(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. | Oct 30, 2026 |
| CVE-2026-116847(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. | Oct 30, 2026 |
| CVE-2026-116410(opens NVD record) | Medium | 6.5 | Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. | Oct 30, 2026 |
| CVE-2026-116405(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. | Oct 30, 2026 |
| CVE-2026-116401(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions. | Oct 30, 2026 |
| CVE-2026-116386(opens NVD record) | Critical | 9.8 | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | Oct 30, 2026 |
| CVE-2026-115947(opens NVD record) | Medium | 6.5 | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | Oct 30, 2026 |
| CVE-2026-115604(opens NVD record) | Medium | 5.0 | Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. | Oct 30, 2026 |
| CVE-2026-114711(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. | Oct 30, 2026 |
| CVE-2026-109213(opens NVD record) | Unscored | — | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-113499. Reason: This candidate is a reservation duplicate of CVE-2026-113499. Notes: All CVE users should reference CVE-2026-113499 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. | Oct 30, 2026 |
| CVE-2026-107868(opens NVD record) | Medium | 5.3 | Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions. | Oct 30, 2026 |
| CVE-2026-105077(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | Oct 30, 2026 |
| CVE-2026-104674(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31. | Oct 30, 2026 |
| CVE-2026-9239(opens NVD record) | Medium | 6.4 | The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick. | Oct 30, 2026 |
| CVE-2026-97638(opens NVD record) | High | 7.5 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary saved drafts belonging to other users and take over those draft identifiers by overwriting them with attacker-controlled form submissions. This requires the attacker to have obtained a victim's draft_id, which may be harvested from a shared "continue later" link; the nominally present nonce check is effectively bypassed because the nonce is publicly obtainable by any unauthenticated visitor loading a form page. | Oct 30, 2026 |
| CVE-2026-96894(opens NVD record) | High | 7.2 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The inbound email router's only gate is a regex match on the References header for a reply token whose hash is never cryptographically validated, meaning any external party who received or can mimic a CRM outbound email can satisfy the check without a WordPress account. | Oct 30, 2026 |
| CVE-2026-84243(opens NVD record) | High | 7.0 | The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid (AT_SECURE). An attacker who can set LANGUAGE in the environment of a program that uses gettext can make it load a message catalog (.mo file) from an arbitrary location in the file system. A crafted .mo file can crash the program through out-of-range offsets, or supply translations whose format directives do not match the arguments passed by the program. That causes undefined behaviour in the printf family of functions and may allow arbitrary code execution with the privileges of the program. The safety of message catalogs relies on them being installed in trusted, read-only locations, and the directory traversal bypasses this. The fix for CVE-2014-0475 rejects ".." path components in locale names passed to setlocale or taken from the LC_ALL, LC_* and LANG environment variables. gettext reads LANGUAGE directly and appends each colon-separated entry to the message catalog directory, so that fix did not cover LANGUAGE. LANGUAGE is only used when the LC_MESSAGES locale is not "C", "C.<encoding>" or "POSIX", so the attacker must also be able to select another installed locale, for example through LANG or LC_ALL. Exploitation also requires that the attacker can place the crafted file in a location readable by the target program, and that the environment crosses a trust boundary without the program running as AT_SECURE. An example is an SSH server that accepts LANGUAGE and LANG from clients through the AcceptEnv directive and restricts an account to a forced command; the attacker may use this to escape the restriction. | Oct 30, 2026 |
| CVE-2026-76012(opens NVD record) | High | 7.5 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.4.1 via the legacy_render function. This is due to broken authorization on the Lightroom gallery_edit endpoint combined with mass assignment of gallery path and unrestricted file upload into a registered template directory, whose extension check uses a substring match that accepts sanitized .php_ filenames as valid templates. This makes it possible for authenticated attackers, with custom-level access and above, to execute code on the server. Exploitation requires the authenticated attacker to be the stored author of at least one existing NextGEN gallery, as ownership of that gallery is the sole authorization check gating the mass-assignment and upload steps. | Oct 30, 2026 |
| CVE-2026-69446(opens NVD record) | Medium | 4.4 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally. | Oct 30, 2026 |
| CVE-2026-13747(opens NVD record) | Medium | 6.5 | The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to enumerate and read metadata — including post ID, title, date, author, and status — of all private and draft posts on the site, including those authored by other users. | Oct 30, 2026 |
| CVE-2026-119979(opens NVD record) | High | 8.8 | LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a crafted model repository that plants a plugin manifest.json, install-state.json and mcp-bridge-config.json, running an attacker-supplied Python payload on every launch. | Oct 30, 2026 |
| CVE-2026-119978(opens NVD record) | High | 8.5 | Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOW_BUILTIN_DEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth package via LocalFileStore and requires it, escaping vm2 as the Flowise process user. | Oct 30, 2026 |