Export limit exceeded: 425601 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425601 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425601 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-120509 | 2 Shapedplugin, Wordpress-extensions | 2 Real Testimonials, Real Testimonials | 2026-11-12 | 4.7 Medium |
| The Real Testimonials – Testimonial Slider, Collect Customer Reviews and Video Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tpro_client_name' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires an administrator to publish the submitted testimonial, trigger the Show Preview AJAX handler, and save an Update, which canonicalizes and persists the attacker-controlled payload as the Manage View title — matching the plugin's standard moderation workflow. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own. | ||||
| CVE-2026-109973 | 2 Oxilab, Wordpress-extensions | 2 Flipbox, Flipbox | 2026-11-12 | 6.4 Medium |
| The Image Hover Effects Ultimate Visual Composer (Flipbox - Awesomes Flip Boxes Image Overlay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'flip-box-image-upload-url-01-alt' parameter in versions up to, and including, 3.1.1. This is due to the plugin saving the image-alt field through sanitize_text_field() in Inc/Style22::register_child() (and Inc/Style18, 19, 20, 25, 29) — which preserves the double-quote character — and then concatenating the stored value into a double-quoted HTML attribute in Public_Render/Style22::default_render() (and the corresponding Style18/19/20/25/29 renderers) with no esc_attr() escaping. This makes it possible for authenticated attackers, with contributor-level access and above (when an administrator has delegated the plugin's 'Who can edit' capability via the plugin Settings page, or on multisite installations where even administrators lack unfiltered_html), to inject arbitrary web scripts in pages that will execute whenever a user accesses any page containing an affected [oxilab_flip_box] shortcode or block. | ||||
| CVE-2026-123462 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-122660 | 2 Bakkbone Australia, Wordpress-extensions | 2 Floristpress, Floristpress | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5. | ||||
| CVE-2026-121777 | 2 Cool Plugins, Wordpress-extensions | 2 Cool Formkit Lite, Cool Formkit Lite | 2026-11-12 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10. | ||||
| CVE-2026-120531 | 2 Wedevs, Wordpress-extensions | 2 Subscribe2, Subscribe2 | 2026-11-12 | 7.2 High |
| The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data[ip]’ parameter in all versions up to, and including, 10.47 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-121576 | 2 Atlasaidev, Wordpress-extensions | 2 Mcp Server For Wordpress, Mcp Server For Wordpress | 2026-11-12 | 8.8 High |
| Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub allows Privilege Escalation.This issue affects MCP Server for WordPress: from n/a through 2.0.1. | ||||
| CVE-2026-19706 | 1 Redhat | 6 Assisted Installer, Assisted Installer For Red Hat Openshift Container Platform, Multicluster Engine and 3 more | 2026-11-12 | 8.3 High |
| During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation. An attacker on the install network can retrieve the unauthenticated Ignition file (ports 22623/22624), extract a limited kubeconfig, submit a CSR for CN=system:admin, receive the signed certificate, and gain full cluster-admin access. Exploitable only during the narrow bootstrap window. | ||||
| CVE-2026-121573 | 2 Melapress, Wordpress-extensions | 2 Wp Activity Log, Wp Activity Log | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Melapress WP Activity Log wp-security-audit-log allows Stored XSS.This issue affects WP Activity Log: from n/a through 5.6.7. | ||||
| CVE-2026-123806 | 1 Theupdateframework | 1 Python-tuf | 2026-11-12 | 4 Medium |
| python-tuf is a Python reference implementation of The Update Framework (TUF). Prior to 7.0.0, DelegatedRole._is_target_in_pathpattern in tuf/api/_payload.py uses fnmatch.fnmatch, which applies os.path.normcase before matching and makes delegation path authorization case-insensitive on Windows. When a TUF repository has path-based delegations that differ only by case and an attacker-controlled role is visited before the legitimate role, ngclient can accept an attacker-provided target from the wrong delegation for a requested path. Linux and macOS clients are not affected because their path normalization does not change case. This issue is fixed in 7.0.0. | ||||
| CVE-2026-125367 | 1 Picosh | 1 Pico | 2026-11-12 | 5.4 Medium |
| Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints. | ||||
| CVE-2026-104676 | 1 Wordpress-extensions | 1 Zion Builder | 2026-11-12 | 6.8 Medium |
| The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before storing them in a publicly accessible location and serving them from the site's own origin, allowing authenticated users with the Author role or above to upload a crafted SVG containing JavaScript that executes in the browser of anyone who opens the file. | ||||
| CVE-2026-100962 | 1 Nvidia | 1 Nemo Deploy | 2026-11-12 | 5.3 Medium |
| NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could cause a server-side request forgery. A successful exploit of this vulnerability might cause information disclosure. | ||||
| CVE-2026-120796 | 1 Microsoft | 4 .net 11.0 Installed On Linux, .net 11.0 Installed On Mac Os, .net 11.0 Installed On Windows and 1 more | 2026-11-12 | 5.3 Medium |
| Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-121660 | 1 Microsoft | 1 Visual Studio Code | 2026-11-12 | 7.5 High |
| Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-121661 | 1 Microsoft | 1 Visual Studio Code | 2026-11-12 | 7.8 High |
| Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | ||||
| CVE-2026-121663 | 1 Microsoft | 1 Visual Studio Code | 2026-11-12 | 8.8 High |
| Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-115539 | 2 Docker, Moby | 3 Docker Engine, Moby, Swarmkit | 2026-11-12 | N/A |
| SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identity. WithMetadataForwardTLSInfo replaces outgoing metadata with a copy of the incoming metadata, discarding the redirect guard's changes when built with grpc-go 1.39 or later. During a short window after a leader change, two proxy hops through managers with inconsistent views of the leader can allow an attacker possessing a valid worker node TLS certificate and private key to obtain a manager node certificate for the attacker's own key, escalating privileges from worker to manager. Applications built with an affected SwarmKit version and grpc-go 1.39 or later are impacted. | ||||
| CVE-2026-105150 | 2 Woobewoo, Wordpress-extensions | 2 Product Filter For Woocommerce By Wbw, Product Filter For Woocommerce By Wbw | 2026-11-12 | 6.1 Medium |
| The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'text_no_products' parameter in all versions up to, and including, 3.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | ||||
| CVE-2026-64477 | 1 Linux | 1 Linux Kernel | 2026-11-12 | 7.1 High |
| In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpu_mask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty the architecture initiates offline of the domain that includes calling on resctrl fs to offline the domain. If it is a monitoring domain in which LLC occupancy is tracked resctrl fs forces the limbo handler to clear all busy RMID state associated with the domain. The limbo handler always reads the current event value associated with a busy RMID irrespective of it being checked as part of regular "is it still busy" check or whether it will be forced released anyway. When reading an RMID on a system with SNC enabled the "logical RMID" is converted to the "physical RMID" and this conversion requires the NUMA node ID of the resctrl monitoring domain that is in turn determined by querying the NUMA node ID of any CPU belonging to the monitoring domain. When the monitoring domain is going offline its cpu_mask is empty causing the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as argument resulting in an out-of-bounds access. Refactor the limbo handler to skip reading the RMID when the RMID will just be forced to no longer be dirty in the domain anyway. Add a safety check to the architecture's RMID reader to protect against this scenario. | ||||