Export limit exceeded: 425933 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425933 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125796 | 2 Ahmad, Wordpress-extensions | 2 Js Help Desk, Js Help Desk | 2026-11-15 | 6.5 Medium |
| Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 5.0.5. | ||||
| CVE-2026-71531 | 1 Prestashop | 1 Prestashop | 2026-11-15 | 8.1 High |
| PrestaShop before 8.2.9 and 9.2.1 contains an authorization flaw in the Webservice API that allows an attacker holding a key restricted to one shop to act on data of every shop by submitting requests with id_shop=all or id_shop_group=N, which expand the shop context without validating the key's actual shop associations and cause shopHasRight() to evaluate the expanded set as a disjunction. Attackers can exploit this flaw via classes/webservice/WebserviceRequest.php to read, modify, or delete data belonging to shops they are not authorized for, including full customer records such as email addresses, secure_key, and password hashes across the installation. | ||||
| CVE-2026-71519 | 1 Prestashop | 1 Prestashop | 2026-11-15 | 8.1 High |
| PrestaShop before 8.2.9 and 9.2.1 contains a broken access control vulnerability that allows an authenticated Webservice API key holder to read and modify customer records belonging to any shop in a multi-shop installation. Attackers can exploit the missing record-level shop ownership check in shopHasRight() and saveEntityFromXml() to read sensitive customer data such as password hashes and secure keys, and change a customer's email and password via create, update, and delete requests, resulting in account takeover. | ||||
| CVE-2026-126953 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-15 | 8.1 High |
| Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that set_UserUsername() in obuspa_system.lua passes to os.execute(), gaining root command execution. | ||||
| CVE-2026-64682 | 1 Nauelg | 1 Astro-blocks | 2026-11-15 | 9.8 Critical |
| AstroBlocks is a block-first CMS for Astro projects. Prior to version 3.4.0, admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name. An attacker who knows the public fallback value (readable in the published package) can forge a valid session token with role: "owner" and obtain full administrative control of the CMS — creating/deleting content, users, media, redirects, and configuration. This issue has been patched in version 3.4.0. | ||||
| CVE-2026-64678 | 1 Nitrite | 1 Nitrite-java | 2026-11-15 | 9.8 Critical |
| NOsql Object (NO2 a.k.a Nitrite) database is an open source nosql embedded document store. Prior to version 4.4.1, when Nitrite opens a database file, MVStoreUtils.openOrCreate() automatically checks for a legacy v1-format store and, on detecting one (or hitting a compatibility error while opening), triggers an automatic migration path. This path deserializes stored values using NitriteDataType.deserialize(byte[]), which passes the raw bytes directly to java.io.ObjectInputStream.readObject() via a custom NitriteObjectInputStream subclass. That subclass overrides only readClassDescriptor() — solely to remap a handful of known legacy class names to their current equivalents — and implements no class allowlist, blocklist, or ObjectInputFilter (JEP 290). Any Serializable class reachable on the embedding application's classpath can therefore be instantiated via readObject(), with readObject()/readExternal()/readResolve() callbacks invoked unconditionally. If a suitable gadget class (e.g. from commons-collections or similar) happens to be present on the classpath, this is a precondition for remote code execution. This issue has been patched in version 4.4.1. | ||||
| CVE-2026-59192 | 1 Cakephp | 1 Twig-view | 2026-11-15 | N/A |
| TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, the unserialize filter has no restriction on which classes are allowed. This can used as a deserialization remote-code-execution gadget. This issue has been patched in versions 1.3.3 and 2.1.2. | ||||
| CVE-2026-59191 | 1 Cakephp | 1 Twig-view | 2026-11-15 | N/A |
| TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2. | ||||
| CVE-2026-15785 | 2 Creapuntome, Wordpress-extensions | 2 Joinchat – Enhanced “click To Chat”, Joinchat | 2026-11-15 | 6.1 Medium |
| The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via '{HREF}' Dynamic Variable via Query Parameter Name in all versions up to, and including, 6.3.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that an administrator has configured a telephone number and included the {HREF} dynamic variable in the Call-to-Action text. | ||||
| CVE-2026-78287 | 2 Staggs, Wordpress-extensions | 2 Staggs, Staggs | 2026-11-15 | 10 Critical |
| Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code Inclusion.This issue affects STAGGS: from n/a through 3.3.0. | ||||
| CVE-2026-125446 | 2 Wisdmlabs, Wordpress-extensions | 2 Edwiser Bridge, Edwiser Bridge | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request Forgery.This issue affects Edwiser Bridge: from n/a through 4.3.4. | ||||
| CVE-2026-112201 | 3 Keycloak, Red Hat, Redhat | 6 Keycloak-services, Red Hat Build Of Keycloak 26.4, Build Keycloak and 3 more | 2026-11-15 | 4.8 Medium |
| A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution. This issue specifically affects deployments using MySQL or MariaDB databases in a multi-node configuration. When multiple failed login attempts occur simultaneously for the same account, a synchronization error can cause the system to enter a repetitive loop that locks the user's record in the database. This results in legitimate login attempts for that user being blocked and failing with an error. Furthermore, because some failures are not correctly recorded during this loop, the system's brute-force protection may not accurately count all failed attempts. | ||||
| CVE-2026-126658 | 1 Jordan-dalby | 1 Bytestash | 2026-11-15 | 5.4 Medium |
| ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp. | ||||
| CVE-2026-125045 | 2 John-michael L'allier, Wordpress-extensions | 2 Create, Create | 2026-11-15 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1. | ||||
| CVE-2026-125433 | 2 Futuriowp, Wordpress-extensions | 2 Futurio Extra, Futurio Extra | 2026-11-15 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FuturioWP Futurio Extra futurio-extra allows Stored XSS.This issue affects Futurio Extra: from n/a through 2.0.25. | ||||
| CVE-2026-125743 | 2 Wordpress-extensions, Wpvibes | 2 Elementor Addon Elements, Elementor Addon Elements | 2026-11-15 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.5. | ||||
| CVE-2026-125448 | 2 Kaliforms, Wordpress-extensions | 2 Kali Forms, Kali Forms | 2026-11-15 | 5.3 Medium |
| Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.31. | ||||
| CVE-2026-125766 | 2 Wordpress-extensions, Wpzoom | 2 Wpzoom Social Feed Widget & Block, Wpzoom Social Feed Widget & Block | 2026-11-15 | 5.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in WPZOOM WPZOOM Social Feed Widget & Block instagram-widget-by-wpzoom allows Retrieve Embedded Sensitive Data.This issue affects WPZOOM Social Feed Widget & Block: from n/a through 2.4.1. | ||||
| CVE-2026-125746 | 2 Propluginslab, Wordpress-extensions | 2 Back In Stock Notifier For Woocommerce, Back In Stock Notifier For Woocommerce | 2026-11-15 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2. | ||||
| CVE-2026-125046 | 2 John-michael L'allier, Wordpress-extensions | 2 Create, Create | 2026-11-15 | 5.3 Medium |
| Missing Authorization vulnerability in John-Michael L'Allier Create mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create: from n/a through 3.1.1. | ||||