Export limit exceeded: 421008 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421008 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421008 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421008 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90965 | 2026-11-06 | 5.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in two of its AJAX actions, allowing unauthenticated users to retrieve the images attached to property listings that have not been published. | ||||
| CVE-2026-90966 | 2026-11-06 | 4.3 Medium | ||
| The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing package selected for free activation is genuinely free or that the requesting user is entitled to it, allowing a self-registered customer to activate a paid package without payment and cause the site to record a paid invoice at the package's full price. | ||||
| CVE-2026-107773 | 2026-11-06 | 6.5 Medium | ||
| The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for a subset of orders. | ||||
| CVE-2026-123492 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-11-06 | 4.9 Medium |
| SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows authenticated attackers to crash the kernel by reading nonexistent MCP resources. Attackers with a valid API token can send a resources/read request in an initialized MCP session, causing a panic that terminates the kernel process and interrupts service. | ||||
| CVE-2026-118575 | 1 Drupal | 1 Signature Pad Widget | 2026-11-06 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature pad widget allows Stored XSS. This issue affects Signature pad widget versions: from 0.0.0 to 1.15.0. | ||||
| CVE-2026-118551 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 3.1 Low |
| Insecure Storage of Sensitive Information vulnerability in Drupal AI (Artificial Intelligence) allows Retrieve Embedded Sensitive Data. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118549 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118542 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 2.7 Low |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-114548 | 1 Drupal | 1 Imageapi Optimize Webp | 2026-11-06 | 3.7 Low |
| Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal ImageAPI Optimize WebP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ImageAPI Optimize WebP versions: from 0.0.0 to 2.1.2. | ||||
| CVE-2026-114547 | 1 Drupal | 1 Tinypng | 2026-11-06 | 3.7 Low |
| Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2. | ||||
| CVE-2026-114546 | 1 Drupal | 1 Media Alias Display | 2026-11-06 | 3.7 Low |
| Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Media Alias Display allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Media Alias Display versions: from 0.0.0 to 2.1.2, from 3.0.0 to 3.0.2. | ||||
| CVE-2026-114544 | 1 Drupal | 1 Media Bulk Upload | 2026-11-06 | 5.4 Medium |
| Incorrect Authorization vulnerability in Drupal Media Bulk Upload allows Forceful Browsing. This issue affects Media Bulk Upload versions: from 0.0.0 to 3.0.6. | ||||
| CVE-2026-114541 | 1 Drupal | 1 Frontend Editing | 2026-11-06 | 4.8 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Frontend Editing allows Cross Site Request Forgery. This issue affects Frontend Editing versions: from 0.0.0 to 1.9.3. | ||||
| CVE-2026-114540 | 1 Drupal | 1 Domain | 2026-11-06 | 6.3 Medium |
| Incorrect Authorization vulnerability in Drupal Domain allows Forceful Browsing. This issue affects Domain versions: from 3.0.0 to 3.0.2. | ||||
| CVE-2026-114539 | 1 Drupal | 1 Doccheck Basic | 2026-11-06 | 6.3 Medium |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal DocCheck Basic allows Authentication Bypass. This issue affects DocCheck Basic versions: 7.x. | ||||
| CVE-2026-114425 | 1 Seppmail | 1 Seppmail Secure Email Gateway | 2026-11-06 | N/A |
| SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root. | ||||
| CVE-2026-123782 | 1 Zhimaai | 1 Chatwiki | 2026-11-06 | 4.3 Medium |
| ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and UpdateFormRequired that allows authenticated users to modify other tenants' form fields. Attackers can pass their own form_id to satisfy the ownership check alongside another tenant's sequential form_field id to alter field names, descriptions, types and required flags, disrupting how submitted entries are stored. | ||||
| CVE-2026-58865 | 1 Google | 1 Android | 2026-11-06 | 7.5 High |
| In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58854 | 1 Google | 1 Android | 2026-11-06 | 7.8 High |
| In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-58835 | 1 Google | 1 Android | 2026-11-06 | 8.8 High |
| In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||