Export limit exceeded: 424285 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424285 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424285 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424285 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424285 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124263 | 2026-11-11 | 5.4 Medium | ||
| Cross-Site Request Forgery (CSRF) vulnerability in plainware Locatoraid Store Locator locatoraid allows Cross Site Request Forgery.This issue affects Locatoraid Store Locator: from n/a through 3.9.75. | ||||
| CVE-2026-108338 | 2026-11-11 | N/A | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through 6.1.6 allows an authenticated user with the Author role on a weblog to store script in entry tags submitted through AtomPub. Roller's tag filter allowed HTML characters in tag names, and the bundled gaurav, fauxcoly and frontpage themes and the showEntryTags macro print tag names without escaping, so the script runs in the browser of anyone who views the weblog. This matters when weblog authors are not trusted with script (weblogAdminsUntrusted=true, the default since 6.1.4). AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes HTML characters from tag names, including names stored earlier. | ||||
| CVE-2026-105154 | 2026-11-11 | 6.1 Medium | ||
| Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6 allows an unauthenticated attacker to make the Roller server fetch a URL the attacker chooses, including internal addresses, by inducing a logged-in global administrator to open a crafted web page. The action that adds a Planet subscription can be triggered cross-site; in recent releases it accepts GET requests, which Roller's CSRF token check does not cover. The action fetches the supplied URL and saves the subscription, and any fetched content that parses as a feed is then published without authentication in the aggregated Planet feed. The Planet aggregator is enabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires POST requests with a valid CSRF token for Planet administration changes and turns the Planet aggregator off by default. | ||||
| CVE-2026-105153 | 2026-11-11 | 7.7 High | ||
| Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user with no weblog permissions to read files readable by the Roller process and cause the server to issue outbound HTTP requests to attacker-chosen destinations, by submitting a crafted Atom entry to the AtomPub endpoint. The entry body is parsed with a parser configuration that permits external parameter entities and external DTD subsets, and the parse happens before any per-weblog authorization check and before any check of whether the AtomPub feature is enabled, so the endpoint is reachable by any authenticated account on a default installation. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which parses AtomPub entries with a hardened XML configuration and rejects AtomPub requests while the feature is disabled. | ||||
| CVE-2026-105152 | 2026-11-11 | 4.3 Medium | ||
| Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects. | ||||
| CVE-2026-124261 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a through 2.1.7. | ||||
| CVE-2026-118405 | 2026-11-11 | 4.3 Medium | ||
| Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators. | ||||
| CVE-2026-125431 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in Mamunur Rashid Food Menu – Restaurant Menu & Online Ordering for WooCommerce tlp-food-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Food Menu – Restaurant Menu & Online Ordering for WooCommerce: from n/a through 6.0.7. | ||||
| CVE-2026-125776 | 2026-11-11 | 5.3 Medium | ||
| Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.6. | ||||
| CVE-2026-125762 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.116. | ||||
| CVE-2026-125045 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in John-Michael L'Allier Create mediavine-create allows Stored XSS.This issue affects Create: from n/a through 3.1.1. | ||||
| CVE-2026-119528 | 2 Red Hat, Redhat | 3 Enterprise Linux, Enterprise Linux, Rhel Els | 2026-11-11 | 7.8 High |
| A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution. | ||||
| CVE-2026-124496 | 2026-11-11 | N/A | ||
| The DRPC HTTP endpoint lets an authenticated client act as another user without applying the configured impersonation authorizer. An authenticated user can execute DRPC functions that are restricted to another user. Users are recommended to upgrade to version 3.2.0, which fixes the issue. | ||||
| CVE-2026-125450 | 2026-11-11 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank allows Stored XSS.This issue affects SureRank: from n/a through 1.10.3. | ||||
| CVE-2026-124495 | 2026-11-11 | N/A | ||
| When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue. | ||||
| CVE-2026-126537 | 2026-11-11 | 9.1 Critical | ||
| The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deletion (and arbitrary file read via S3/Dropbox/Google Drive exfiltration) in versions up to, and including, 3.3.36. The flaw spans NF_FU_Fields_Upload::process() in includes/fields/upload.php — which returns early (leaving the client-supplied files[] intact) whenever a public submission carries a nonempty extra.saveProgress — and NF_FU_External_Abstracts_Service::process_upload() in includes/external/abstracts/service.php, whose authoritative-path reload only fires when the client sends upload_id. By omitting upload_id, an attacker's data[file_path] survives into the Background Upload queue and is used by both upload_file_to_s3() (as SourceFile) and the maybe_delete_server_file() unlink() call in includes/external/abstracts/backgroundupload.php, with no canonicalization or upload-directory containment check (the plugin's own is_path_within_upload_dir() helper is only applied on admin paths). This makes it possible for unauthenticated attackers to delete arbitrary files on the affected site's server which may make remote code execution possible — specifically, deleting wp-config.php forces WordPress into its setup screen, enabling full site takeover. | ||||
| CVE-2026-94125 | 2026-11-11 | N/A | ||
| Nimbus returns the worker placement of every topology running on a supervisor, including the host, port, owner and resource assignment of topologies the caller is not authorized to read. In a multi-tenant cluster, an authenticated user who is allowed to access Nimbus can learn where the workers of other users' topologies run. Users are recommended to upgrade to version 3.2.0, which fixes the issue. | ||||
| CVE-2026-87766 | 1 Redhat | 9 Enterprise Linux, Enterprise Linux Eus, Hardened Images and 6 more | 2026-11-11 | 8.8 High |
| A flaw was found in bubblewrap. During sandbox setup, creating files or directories under the new root can follow a parent symlink onto the host via /oldroot, writing attacker-chosen paths outside the sandbox as the launching user. This happens before the sandboxed process starts. This issue is GHSA-pxhw-h44j-8pfx. It is fixed in bubblewrap 0.12.0. | ||||
| CVE-2026-124745 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 6.3 Medium |
| A flaw was found in BusyBox. When extracting an archive, the tar utility improperly resolves deferred hardlink targets across symbolic links pointing outside the intended extraction directory. An attacker could provide a specially crafted archive that links to sensitive files outside the extraction tree, allowing subsequent extraction operations to overwrite arbitrary files on the system. | ||||
| CVE-2026-124744 | 1 Redhat | 2 Hummingbird, Rhel Els | 2026-11-11 | 6.3 Medium |
| A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations. | ||||