Export limit exceeded: 372793 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372793 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58047 | 1 Webpros | 2 Cpanel, Wp Squared | 2026-08-02 | N/A |
| HTTP Smuggling in cPanel allows potential leak of credentials. | ||||
| CVE-2026-58048 | 1 Webpros | 2 Cpanel, Wp Squared | 2026-08-02 | N/A |
| Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. | ||||
| CVE-2026-15932 | 2026-08-02 | N/A | ||
| The Support Genix WordPress plugin before 1.4.48 does not prevent directory traversal in its ticket-attachment download route, allowing unauthenticated attackers to read arbitrary files with an allowlisted extension — including other users' private ticket attachments — from the server. | ||||
| CVE-2026-14309 | 2026-08-02 | N/A | ||
| The Chat On Desk Order Notifications WordPress plugin before 1.0.9 does not verify that the one-time password has been validated before processing a password-reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, and take over their accounts when SMS one-time-password password reset is enabled. | ||||
| CVE-2026-14596 | 2026-08-02 | N/A | ||
| The DynamicKit for Elementor WordPress plugin before 1.0.3 does not validate the host of a user-supplied URL used as the base of the password-reset link it emails, allowing unauthenticated attackers to send a target user a legitimately-formatted reset email whose link points to an attacker-controlled host and carries a valid reset key, leading to account takeover when the victim clicks it. | ||||
| CVE-2026-14836 | 2026-08-02 | N/A | ||
| The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers to reset the limit at will and brute-force the code to take over any account, including administrators, when the verification-code reset mode is enabled. | ||||
| CVE-2026-15244 | 2026-08-02 | N/A | ||
| The HUSKY WordPress plugin before 1.4.1 does not sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path, allowing users with the shop manager capability to cause the inclusion and execution of arbitrary local files, which is then triggered on every front-end request including for unauthenticated visitors. | ||||
| CVE-2026-13157 | 2026-08-02 | N/A | ||
| The Demo Import WordPress plugin through 1.1.3 does not validate the type of files uploaded during demo-content import (the WordPress file-type test is disabled), allowing high-privilege users (Administrator by default, including non-super-admin site administrators on multisite) to upload executable PHP files to the uploads directory. | ||||
| CVE-2026-10827 | 2026-08-02 | N/A | ||
| The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block. The injected styles are served to anonymous visitors of those pages and can force external resource loads, deface/redress the page, or exfiltrate data via CSS attribute selectors. JavaScript execution is not possible at this role (the script-tag breakout is removed by KSES), so the impact is limited to CSS injection. | ||||
| CVE-2026-13729 | 2026-08-02 | N/A | ||
| The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page. | ||||
| CVE-2026-14195 | 2 Brizy, Wordpress | 2 Brizy, Wordpress | 2026-08-02 | N/A |
| The Brizy WordPress plugin before 2.8.18 does not properly verify authorization on a request handler before returning post content, allowing users with the Contributor role or higher to read the content of arbitrary posts, including other users' private, pending, and draft posts. | ||||
| CVE-2026-14214 | 2026-08-02 | N/A | ||
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.4 does not restrict which fields can be written through its customer import, allowing a user with the Amelia Manager role to modify arbitrary columns of any stored user record by supplying them in the import request. | ||||
| CVE-2026-14292 | 2 Downloadmanager, Wordpress | 2 Download Manager, Wordpress | 2026-08-02 | N/A |
| The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package. | ||||
| CVE-2026-14822 | 2026-08-02 | N/A | ||
| The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not perform any authorization check on one of its order-management REST endpoints, allowing unauthenticated users to change the status of existing orders. | ||||
| CVE-2026-14823 | 2026-08-02 | N/A | ||
| The Event Tickets and Registration WordPress plugin before 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own. | ||||
| CVE-2026-67293 | 1 Freerdp | 1 Freerdp | 2026-08-02 | 4.2 Medium |
| FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains an improper certificate hostname validation vulnerability. The TLS hostname matcher (tls_match_hostname() in libfreerdp/crypto/tls.c) treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, so it incorrectly accepts a wildcard certificate for multi-label subdomains like a.b.example.com (which OpenSSL's X509_check_host() rejects). This weakens TLS server authentication under wildcard-certificate conditions. | ||||
| CVE-2026-66402 | 1 Freerdp | 1 Freerdp | 2026-08-02 | 9.8 Critical |
| FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication. | ||||
| CVE-2025-31200 | 1 Apple | 6 Ipados, Iphone Os, Macos and 3 more | 2026-08-02 | 9.8 Critical |
| A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visionOS 2.4.1, watchOS 11.5. Processing an audio stream in a maliciously crafted media file may result in code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS released before iOS 18.4.1. | ||||
| CVE-2026-16566 | 1 Jenkins | 1 Credentials | 2026-08-02 | 6.1 Medium |
| A flaw was found in the community.general Ansible collection's jenkins_credential module. When creating a Jenkins API token (credential_type: token), the module correctly protects the input password with no_log=True in the argument specification, but places the generated API token returned by the Jenkins API directly into the Ansible task result dictionary without output suppression. The token is emitted in plaintext via exit_json(), causing it to appear in Ansible task output, AWX/Tower/AAP Controller job logs, callback plugin output, CI/CD pipeline logs, and fact caching backends. An attacker with access to any of these output channels can obtain the Jenkins API token and gain the same privileges as the user who created it. | ||||
| CVE-2025-67038 | 1 Lantronix | 7 Eds5000, Eds5008, Eds5008 Firmware and 4 more | 2026-08-02 | 9.8 Critical |
| An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authantication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. | ||||