Export limit exceeded: 371149 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371149 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-51304 | 1 Sqlite | 1 Sqlite | 2026-07-27 | 7.5 High |
| sqlite 3.41 has a use-after-free (UAF) vulnerability in the ORDER BY clause parsing routine. The affected code first releases the memory of an ExprList object via sqlite3ExprListDelete(), then attempts to access the nExpr member of the already freed object. This dangling pointer access causes invalid memory read operations. By constructing a malicious SQL statement containing an ORDER BY clause with a large number of items, a remote adversary can trigger this vulnerability. Successful exploitation can result in application crash (denial of service), leakage of sensitive memory contents, and under certain memory layout conditions, arbitrary code execution on the affected system. | ||||
| CVE-2025-50455 | 1 Easyappointments | 1 Easyappointments | 2026-07-27 | 9.1 Critical |
| SQL injection vulnerability exists in the order_by parameter of the /customers/search endpoint in Alex Tselegidis EasyAppointments <= 1.5.1. The vulnerability arises from unsanitized user input passed to the order_by method of the CodeIgniter Query Builder, enabling attackers to perform time-based queries and schema enumeration. Under certain MySQL configurations, the flaw may lead to remote code execution by writing a PHP shell using INTO OUTFILE. | ||||
| CVE-2026-14827 | 2 Calendar, Wordpress | 2 Calendar, Wordpress | 2026-07-27 | 6.8 Medium |
| The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allowing users with the Contributor role to inject arbitrary JavaScript that executes in the browser of anyone viewing the calendar. | ||||
| CVE-2026-64798 | 1 Regularlabs.com | 1 Ip Login Extension For Joomla | 2026-07-27 | 9.1 Critical |
| Joomla Extension - regularlabs.com - Insecure login URL keys in IP login extension - Persistent URL login keys were also generated using a non-cryptographic random generator with insufficient entropy. | ||||
| CVE-2026-64792 | 1 Regularlabs.com | 7 Articles Anywhere Extension For Joomla, Conditional Content Extension For Joomla, Modules Anywhere Extension For Joomla and 4 more | 2026-07-27 | 7.5 High |
| Joomla Extension - regularlabs.com - disclosure of restricted content via search index in various Regular Labs extensions - Smart Search indexing could render generated content using the indexing administrator’s identity instead of a public guest. Restricted or administrator-only content could consequently be stored in the public search index and disclosed to visitors. | ||||
| CVE-2026-14820 | 2 Quizandsurveymaster, Wordpress | 2 Quiz And Survey Master, Wordpress | 2026-07-27 | 5.3 Medium |
| The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3. | ||||
| CVE-2026-64791 | 1 Regularlabs.com | 1 Regular Labs Extension Manager Extension For Joomla | 2026-07-27 | 8.8 High |
| Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Regular Labs Extension Manager - Administrator routes and install/update/uninstall processing did not consistently enforce component-management and installation permissions. An unauthorized backend user or CSRF attack could install, update or remove extensions. | ||||
| CVE-2026-63684 | 1 Regularlabs.com | 3 Content Templater Extension For Joomla, Rereplacer Extension For Joomla, Snippets Extension For Joomla | 2026-07-27 | 8.8 High |
| Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in various admin/import/export actions of multiple Regular Labs extension - Administrator actions, editor popups and import/export requests lacked consistent token, item-permission and input-validation checks. Unauthorized backend users or CSRF attacks could expose, create or modify extension configuration and items. | ||||
| CVE-2026-14289 | 2026-07-27 | 9 Critical | ||
| The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution. | ||||
| CVE-2026-13089 | 1 Ritou | 1 Oidc::lite | 2026-07-27 | 7.5 High |
| OIDC::Lite versions through 0.12.1 for Perl allow ID Token signature verification bypass via a token-controlled algorithm allowlist in verify. When the caller does not pin an algorithm, OIDC::Lite::Model::IDToken::verify sets $self->alg($self->header->{alg}) from the token's own header and then calls decode_jwt(token, key, 1, [$self->alg]), handing JSON::WebToken an accepted-algorithm allowlist taken from the untrusted token. A token with alg=none yields ['none'], so decode_jwt returns the claims with no signature check, and a token with alg=HS256 is verified with the RP's RSA public key as the HMAC secret (RS to HS confusion). The ID Token is the OpenID Connect authentication assertion delivered to the Relying Party. Any caller that verifies an ID Token through the unpinned load(token)->verify path, or load(token, key) with only the key pinned, accepts a forged token carrying attacker-chosen claims such as sub and is authenticated as any user. Passing an explicit algorithm so $self->alg is already set bypasses the header-derived allowlist and is not affected. Note that the latest version uploaded to CPAN is 0.10. Later versions are available in the git repository. | ||||
| CVE-2026-65436 | 2 Themeum, Wordpress | 2 Kirki, Wordpress | 2026-07-27 | 6.8 Medium |
| Editor Arbitrary File Deletion in Kirki <= 6.0.13 versions. | ||||
| CVE-2026-65562 | 2 Wordpress, Wpdeveloper | 2 Wordpress, Betterdocs | 2026-07-27 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions. | ||||
| CVE-2026-14236 | 2026-07-27 | 4.7 Medium | ||
| The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow. | ||||
| CVE-2026-57978 | 1 Microsoft | 1 Edge Chromium | 2026-07-27 | 5.4 Medium |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-17459 | 1 Perwendel | 1 Spark | 2026-07-27 | 4.3 Medium |
| A vulnerability was determined in perwendel spark up to 2.9.4. This vulnerability affects the function staticFiles.externalLocation of the file src/main/java/spark/resource/ExternalResourceHandler.jav of the component SparkJava. Executing a manipulation can lead to symlink following. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2025-71408 | 1 Ntlk | 1 Ntlk | 2026-07-27 | 7.8 High |
| NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module that allows an attacker who controls command-line arguments to execute arbitrary Python code. When collocations.py is invoked directly, the __main__ block passes command-line arguments directly to eval() as suffixes of BigramAssocMeasures without allowlist validation or sanitization, enabling an attacker to supply a Python expression that escapes the intended attribute lookup and executes arbitrary code including OS commands via the os module. | ||||
| CVE-2026-48032 | 1 Kerberosmansour | 1 Hulumi | 2026-07-27 | N/A |
| Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, IAM-role policy checks can be bypassed when the role trusts multiple OIDC providers. This issue has been patched in version 1.4.0. | ||||
| CVE-2026-63094 | 1 Signoz | 1 Signoz | 2026-07-27 | 8.1 High |
| SigNoz before 0.134.0 contains an open redirect vulnerability in the SSO authentication flow that allows unauthenticated attackers to steal session tokens from any user on instances configured with Google OAuth, SAML, or OIDC. Attackers can call the unauthenticated sessions context endpoint with a ref parameter pointing to an attacker-controlled host, deliver the resulting crafted login URL to a victim, and receive the victim's access and refresh tokens when they complete SSO authentication. | ||||
| CVE-2026-16634 | 1 Felipe | 1 Toml::xs | 2026-07-27 | 9.8 Critical |
| TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document. TOML::XS version 0.06 or later uses the successor tomlc17 library. | ||||
| CVE-2026-16337 | 1 Dotcms | 1 Dotcms | 2026-07-27 | N/A |
| Improper authorization in the ToolGroupResource and RoleAjax REST/DWR endpoints in dotCMS dotCMS 21.02 through 26.06.22-03 on all platforms allows a low-privileged authenticated backend user to self-assign the administrative layout and self-grant the CMS Administrator role, then achieve remote code execution via a crafted OSGi bundle upload whose BundleActivator executes arbitrary shell commands. | ||||