Export limit exceeded: 424885 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424885 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125445 | 2026-11-11 | 4.3 Medium | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site Request Forgery.This issue affects VOD Infomaniak: from n/a through 1.5.16. | ||||
| CVE-2026-125435 | 2026-11-11 | 5.3 Medium | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3. | ||||
| CVE-2026-124411 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1. | ||||
| CVE-2026-124417 | 2026-11-11 | 4.3 Medium | ||
| Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. | ||||
| CVE-2026-124269 | 2026-11-11 | 4.3 Medium | ||
| Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.51.0. | ||||
| CVE-2026-124262 | 2026-11-11 | 5.3 Medium | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19. | ||||
| CVE-2026-112261 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP. Opening a crafted XCF that selects a path and then fails to load that path can cause a use-after-free in the main process, leading to a crash and potentially arbitrary code execution. | ||||
| CVE-2026-112260 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-11 | 7.1 High |
| A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service. | ||||
| CVE-2026-112258 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP. The XCF loader can leave a dangling pointer in the linked-channels list when a linked channel is later destroyed via a selection property. Opening a crafted XCF file can cause a use-after-free in the main GIMP process, leading to a crash and potentially arbitrary code execution. | ||||
| CVE-2026-112257 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP. The PSD thumbnail resource loader performs a BGR-to-RGB channel swap with a fixed 3-byte stride and does not verify that the JPEG thumbnail is RGB. A crafted grayscale PSD thumbnail can cause a heap out-of-bounds read and write in the plug-in process, leading to a crash and potentially arbitrary code execution when the victim browses or opens the file. | ||||
| CVE-2026-106062 | 2 Gimp, Redhat | 3 Gimp, Enterprise Linux, Rhel Els | 2026-11-11 | 7.8 High |
| A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process. | ||||
| CVE-2026-124255 | 2026-11-11 | 5.3 Medium | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy allows Code Injection.This issue affects Events Made Easy: from n/a through 3.3.5. | ||||
| CVE-2026-124421 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in BdThemes ZoloBlocks zoloblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ZoloBlocks: from n/a through 2.8.2. | ||||
| CVE-2025-66364 | 1 Samsung Semiconductor | 20 Exynos 1080, Exynos 1280, Exynos 1330 and 17 more | 2026-11-11 | 7.5 High |
| Continuously sending control‑plane messages causes the baseband to crashes. | ||||
| CVE-2025-66368 | 1 Samsung Semiconductor | 3 Exynos 1080, Exynos 9110, Exynos Modem 5123 | 2026-11-11 | 7.5 High |
| Incorrect handling of SDP payload leads to a Denial of Service | ||||
| CVE-2026-93404 | 2026-11-11 | 8.1 High | ||
| A flaw was found in rsyslog. The built-in ClickHouse output templates fail to properly escape backslash characters when formatting Structured Query Language (SQL) queries. An attacker capable of submitting crafted log messages routed to an affected ClickHouse action can exploit this issue to alter executed SQL commands, potentially leading to unauthorized database modification or information disclosure. | ||||
| CVE-2026-125680 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11. | ||||
| CVE-2026-124753 | 2026-11-11 | 4.3 Medium | ||
| Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Job Portal: from n/a through 2.7.2. | ||||
| CVE-2026-125437 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through 1.6.13.0. | ||||
| CVE-2026-125761 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith-woocommerce-ajax-search allows Stored XSS.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.30.0. | ||||