Export limit exceeded: 369862 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369862 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64873 | 2026-07-23 | N/A | ||
| Custom query URLs could access internal or reserved network services. | ||||
| CVE-2026-64871 | 2026-07-23 | N/A | ||
| Administrator URL purges did not consistently require a valid token and cache-management permission. | ||||
| CVE-2026-65757 | 2026-07-23 | N/A | ||
| The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens. | ||||
| CVE-2026-65755 | 2026-07-23 | N/A | ||
| Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable. | ||||
| CVE-2026-65754 | 2026-07-23 | N/A | ||
| ReReplacer XML include paths could read files outside the site directory. | ||||
| CVE-2026-64875 | 2026-07-23 | N/A | ||
| GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass. | ||||
| CVE-2026-64876 | 2026-07-23 | N/A | ||
| Database-update requests lacked consistent token and Super User checks, this could cause unauthorized updates. | ||||
| CVE-2026-64872 | 2026-07-23 | N/A | ||
| Custom purge and log paths could escape the site webroot directory. | ||||
| CVE-2026-65712 | 2026-07-23 | N/A | ||
| CDN versioning could check file paths outside the site directory, exposing local file existence and modification metadata. | ||||
| CVE-2026-65756 | 2026-07-23 | N/A | ||
| Shortcut configuration accepted arbitrary inline JavaScript. | ||||
| CVE-2026-64874 | 2026-07-23 | N/A | ||
| CDN credentials were exposed in administrator request URLs. | ||||
| CVE-2026-64799 | 2026-07-23 | N/A | ||
| Content-controlled image URLs could request private or reserved network services, follow unsafe redirects and save responses without validating that they were images. This could result in SSRF, internal-data access or writing attacker-controlled files into a web-accessible folder. | ||||
| CVE-2026-65430 | 2026-07-23 | N/A | ||
| MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability. | ||||
| CVE-2026-65431 | 2026-07-23 | N/A | ||
| Geo IP database update archives have been broadly extracted without path validation, leading to unsafe file extractions. | ||||
| CVE-2025-70796 | 2026-07-23 | 7.5 High | ||
| An unauthenticated path traversal vulnerability exists in the web management interface of WTI (Wireless Technology, Inc.) version 3.5.0.r 2024/05/24 00:00:00. An unauthenticated attacker can craft malicious HTTP requests containing traversal sequences to access files outside of the intended web root directory. This may allow disclosure of sensitive system files and configuration data | ||||
| CVE-2026-21039 | 1 Samsung | 1 Mobile Devices | 2026-07-23 | N/A |
| Improper access control in Settings prior to SMR Jul-2026 Release 1 allows local attackers to configure Theft protection settings. | ||||
| CVE-2026-21040 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-07-23 | N/A |
| Improper access control in IAFDService prior to SMR Jul-2026 Release 1 allows local privileged attackers to use the privileged APIs. | ||||
| CVE-2026-21041 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-07-23 | N/A |
| Improper access control in SamsungSEAgentService prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information. | ||||
| CVE-2026-15906 | 2026-07-23 | 6.5 Medium | ||
| The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 7.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-16078 | 2026-07-23 | 6.5 Medium | ||
| The WCPOS – Point of Sale (POS) plugin for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.9.8 via the 'type' parameter parameter. This makes it possible for authenticated attackers, with shop manager-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires supplying context=edit in the request, which bypasses the content-stripping logic in prepare_item_for_response() and returns the traversed file verbatim in the REST API response. | ||||