Export limit exceeded: 369876 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 369876 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369876 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65463 | 2026-07-23 | 5.4 Medium | ||
| Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions. | ||||
| CVE-2026-65469 | 2026-07-23 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. | ||||
| CVE-2026-65482 | 2026-07-23 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions. | ||||
| CVE-2026-65488 | 2026-07-23 | 7.1 High | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in LA-Studio Element Kit for Elementor <= 1.6.2 versions. | ||||
| CVE-2026-65494 | 2026-07-23 | 7.1 High | ||
| Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. | ||||
| CVE-2026-65500 | 2026-07-23 | 7.5 High | ||
| Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||||
| CVE-2026-65511 | 2026-07-23 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||||
| CVE-2026-65521 | 2026-07-23 | 5.3 Medium | ||
| Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions. | ||||
| CVE-2026-64802 | 2026-07-23 | 7.8 High | ||
| In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration | ||||
| CVE-2026-56852 | 2026-07-23 | 7.5 High | ||
| A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes. | ||||
| CVE-2026-65534 | 2026-07-23 | 5.9 Medium | ||
| Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. | ||||
| CVE-2026-65540 | 2026-07-23 | 7.1 High | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. | ||||
| CVE-2026-48864 | 2 Opensuse, Redhat | 9 Libsolv, Enterprise Linux, Hardened Images and 6 more | 2026-07-23 | 7.8 High |
| A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service. | ||||
| CVE-2025-10911 | 1 Redhat | 11 Discovery, Enterprise Linux, Enterprise Linux Eus and 8 more | 2026-07-23 | 5.5 Medium |
| A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash. | ||||
| CVE-2026-65069 | 2026-07-23 | 4 Medium | ||
| Data::DisjointSet::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The segment is created in dsu.h with open(path, O_RDWR|O_CREAT, 0666). The mode is 0666, so under the default umask 022 the file is created mode 0644 (world-readable). O_NOFOLLOW is absent, so a symlink planted at the path is followed, and O_EXCL is absent, so the open silently uses a pre-planted file instead of failing. A "Shared" segment naturally lives in a shared directory such as /tmp or /dev/shm, where any local user can read the IPC payloads stored in the world-readable segment, and a pre-planted file or symlink at the path lets a local attacker win a pre-creation race or redirect the open. | ||||
| CVE-2026-65895 | 1 Getgrav | 1 Grav | 2026-07-23 | 8.5 High |
| Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. | ||||
| CVE-2026-64814 | 2026-07-23 | 8.6 High | ||
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | ||||
| CVE-2026-58016 | 2 Gnome, Redhat | 5 Glib, Enterprise Linux, Hardened Images and 2 more | 2026-07-23 | 7.5 High |
| A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a <node> element nested within other elements like <method>, <signal>, <property> or <arg>. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. | ||||
| CVE-2026-64815 | 2026-07-23 | 8.1 High | ||
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | ||||
| CVE-2025-6170 | 2 Redhat, Xmlsoft | 7 Enterprise Linux, Hummingbird, Jboss Core Services and 4 more | 2026-07-23 | 2.5 Low |
| A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections. | ||||