Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
168,566 matching · page 58/3372Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-102590(opens NVD record) | Medium | 5.0 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery vulnerability. | Oct 29, 2026 |
| CVE-2026-101288(opens NVD record) | High | 8.8 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code. | Oct 29, 2026 |
| CVE-2025-13050(opens NVD record) | Medium | 5.4 | Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user | Oct 29, 2026 |
| CVE-2026-97073(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | Oct 29, 2026 |
| CVE-2026-80069(opens NVD record) | Medium | 5.4 | MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin. | Oct 29, 2026 |
| CVE-2026-80067(opens NVD record) | Medium | 5.4 | MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata. | Oct 29, 2026 |
| CVE-2026-54871(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.2. | Oct 29, 2026 |
| CVE-2026-54853(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5. | Oct 29, 2026 |
| CVE-2026-54852(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1. | Oct 29, 2026 |
| CVE-2026-52708(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13. | Oct 29, 2026 |
| CVE-2026-48884(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13. | Oct 29, 2026 |
| CVE-2026-42691(opens NVD record) | Medium | 5.4 | Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0. | Oct 29, 2026 |
| CVE-2026-39742(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2. | Oct 29, 2026 |
| CVE-2026-39737(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6. | Oct 29, 2026 |
| CVE-2026-27063(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kit (formerly ConvertKit): from n/a through 3.4.7. | Oct 29, 2026 |
| CVE-2026-27062(opens NVD record) | Medium | 4.3 | Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects WPFunnels: from n/a through 3.13.5. | Oct 29, 2026 |
| CVE-2026-25450(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.3.0. | Oct 29, 2026 |
| CVE-2026-25448(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10. | Oct 29, 2026 |
| CVE-2026-118097(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0. | Oct 29, 2026 |
| CVE-2026-118095(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42. | Oct 29, 2026 |
| CVE-2026-118092(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MasterStudy LMS: from n/a through 3.7.55. | Oct 29, 2026 |
| CVE-2026-118091(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5. | Oct 29, 2026 |
| CVE-2026-118088(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through 3.13.5. | Oct 29, 2026 |
| CVE-2026-116856(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.24. | Oct 29, 2026 |
| CVE-2026-116850(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.1. | Oct 29, 2026 |
| CVE-2026-116849(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6. | Oct 29, 2026 |
| CVE-2026-116846(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26. | Oct 29, 2026 |
| CVE-2026-116406(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4. | Oct 29, 2026 |
| CVE-2026-116387(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.12.9. | Oct 29, 2026 |
| CVE-2026-115713(opens NVD record) | High | 7.5 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132). | Oct 29, 2026 |
| CVE-2026-115712(opens NVD record) | Medium | 4.3 | Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change. | Oct 29, 2026 |
| CVE-2026-115711(opens NVD record) | Medium | 6.4 | Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token. | Oct 29, 2026 |
| CVE-2026-115709(opens NVD record) | High | 8.2 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132). | Oct 29, 2026 |
| CVE-2026-115708(opens NVD record) | High | 7.2 | Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132). | Oct 29, 2026 |
| CVE-2026-115707(opens NVD record) | Medium | 6.4 | Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages. | Oct 29, 2026 |
| CVE-2026-115706(opens NVD record) | Medium | 6.8 | Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages. | Oct 29, 2026 |
| CVE-2026-115610(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0. | Oct 29, 2026 |
| CVE-2026-115605(opens NVD record) | Medium | 4.3 | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.3. | Oct 29, 2026 |
| CVE-2026-115601(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in WP Desk Custom Price for WooCommerce custom-price-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Price for WooCommerce: from n/a through 1.1.29. | Oct 29, 2026 |
| CVE-2026-114706(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15. | Oct 29, 2026 |
| CVE-2026-114181(opens NVD record) | Medium | 5.3 | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.6. | Oct 29, 2026 |
| CVE-2026-110881(opens NVD record) | Medium | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureDash suredash allows Stored XSS.This issue affects SureDash: from n/a through 1.12.3. | Oct 29, 2026 |
| CVE-2026-107024(opens NVD record) | High | 7.5 | Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL. | Oct 29, 2026 |
| CVE-2026-107023(opens NVD record) | Medium | 6.5 | Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content. | Oct 29, 2026 |
| CVE-2026-107021(opens NVD record) | Critical | 9.1 | Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attackers to arbitrarily read flashcards across the user's entire memorization database. | Oct 29, 2026 |
| CVE-2026-107020(opens NVD record) | High | 7.5 | An issue in the activity.LoadLinkLaterActivity component of FeedEx / Handy News Reader versionCode 116 allows attackers to force victim users into fetching a crafted URL. | Oct 29, 2026 |
| CVE-2026-107019(opens NVD record) | High | 8.8 | Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to create forged holiday/work-time entries via crafted ICS imports. | Oct 29, 2026 |
| CVE-2026-107018(opens NVD record) | High | 8.1 | Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage. | Oct 29, 2026 |
| CVE-2026-107017(opens NVD record) | Critical | 9.1 | Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions. | Oct 29, 2026 |
| CVE-2026-107016(opens NVD record) | High | 7.5 | Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | Oct 29, 2026 |