Export limit exceeded: 421579 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421579 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421579 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123364 | 2026-11-09 | N/A | ||
| OctoPrint provides a web interface for controlling consumer 3D printers. From 2.0.0rc1 until 2.0.0rc7, an authenticated user can supply a crafted default port or baudrate through a connect request to the bundled Serial Connector plugin. OctoPrint persists these values in printerConnection.preferred.parameters.port or printerConnection.preferred.parameters.baudrate and renders them as HTML when another user views the saved connection parameters, allowing script execution in that user's browser and actions within the user's OctoPrint access. This issue is fixed in version 2.0.0rc7. | ||||
| CVE-2026-119670 | 1 Ibm | 1 Storage Copy Data Management | 2026-11-09 | 6.3 Medium |
| IBM Storage Copy Data Management 2.2.0.0 through 2.3.1.0 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input. | ||||
| CVE-2026-104989 | 2026-11-09 | N/A | ||
| Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows remote unauthenticated attackers to execute arbitrary code via redirecting access to libraries | ||||
| CVE-2026-121576 | 2026-11-09 | 8.8 High | ||
| Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1. | ||||
| CVE-2026-122664 | 2026-11-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Reflected XSS.This issue affects Broadcast Live Video: from n/a through 7.3.14. | ||||
| CVE-2026-123482 | 2026-11-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Stored XSS.This issue affects JetFormBuilder: from n/a through 3.6.8. | ||||
| CVE-2026-121612 | 2026-11-09 | 4.3 Medium | ||
| Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication Abuse.This issue affects WPBruiser {no- Captcha anti-Spam}: from n/a through 3.6.2. | ||||
| CVE-2026-115204 | 1 Wordpress-extensions | 1 Azexo Store Locator | 2026-11-09 | 8.8 High |
| The AZEXO Store Locator WordPress plugin through 1.4 does not perform capability or nonce checks on its AJAX actions and does not sanitise a request header used to build a file path, allowing any authenticated user such as a subscriber to write a file with an arbitrary name, location, and content, leading to remote code execution. | ||||
| CVE-2026-123064 | 2026-11-09 | 8.8 High | ||
| The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict access to one of its user-creation actions, allowing authenticated users with Subscriber-level access and above to create a new administrator account and thereby escalate their privileges. | ||||
| CVE-2026-123128 | 2026-11-09 | 3.7 Low | ||
| The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests. | ||||
| CVE-2026-123145 | 2026-11-09 | 4.4 Medium | ||
| The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed. | ||||
| CVE-2026-95778 | 1 Hpe | 1 Morpheus Software | 2026-11-09 | 8.8 High |
| A remote code execution vulnerability exists in HPE Morpheus Software. | ||||
| CVE-2026-115340 | 2026-11-09 | 7.1 High | ||
| Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to a temporary file during file transfer operations. | ||||
| CVE-2026-115339 | 2026-11-09 | 7.5 High | ||
| Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an unauthenticated remote attacker to cause denial of service. | ||||
| CVE-2026-115341 | 2026-11-09 | 7.7 High | ||
| Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows could allow an authenticated FTP user to access files outside their intended scope. | ||||
| CVE-2026-124959 | 2 Hnswlib, Spotify | 2 Hnswlib, Voyager | 2026-11-09 | N/A |
| The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized HNSW index is within the stored capacity used to allocate the heap buffer. An attacker can supply a crafted index file with an element count greater than the stored capacity, causing the loader to write beyond the allocated buffer and potentially crash the application when it loads the file. | ||||
| CVE-2026-119503 | 2 Welcart, Wordpress-extensions | 2 Welcart E-commerce, Welcart E-commerce | 2026-11-09 | 6.5 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Code Injection.This issue affects Welcart e-Commerce: from n/a through 2.12.6. | ||||
| CVE-2026-123484 | 2 Crocoblock, Wordpress-extensions | 2 Jetformbuilder, Jetformbuilder | 2026-11-09 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows DOM-Based XSS.This issue affects JetFormBuilder: from n/a through 3.6.8. | ||||
| CVE-2026-115337 | 2026-11-09 | 6.3 Medium | ||
| Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users. | ||||
| CVE-2026-115336 | 2026-11-09 | 6.5 Medium | ||
| Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an authenticated user with upload and delete permissions to exceed storage quotas, potentially causing denial of service. | ||||