Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425863 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125435 | 2026-11-12 | 5.3 Medium | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Retrieve Embedded Sensitive Data.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.3. | ||||
| CVE-2026-56712 | 1 Replicate | 1 Cog | 2026-11-12 | 9.3 Critical |
| Replicate Cog through 0.23.1 contains a server-side request forgery vulnerability that allows attackers to cause the Cog process to make server-side HTTP requests by submitting prediction inputs with attacker-controlled URLs that are not validated against the resolved destination host or IP before fetching. Attackers can supply malicious URLs or exploit HTTP redirects in cog.File and cog.Path predictor inputs to force requests to internal addresses, potentially exposing sensitive internal services or credentials. | ||||
| CVE-2026-63984 | 1 Linux | 1 Linux Kernel | 2026-11-12 | 9.8 Critical |
| In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() ipv6_rpl_srh_decompress() computes: outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); hdrlen is __u8. For n >= 127 the result exceeds 255 and silently truncates. With n=127 (cmpri=15, cmpre=15, pad=0, hdrlen=16): (128 * 16) >> 3 = 256, truncated to 0 as __u8 The caller in ipv6_rpl_srh_rcv() then places the compressed header at buf + ((ohdr->hdrlen + 1) << 3). With hdrlen=0 this is buf + 8, but the decompressed region occupies buf[0..2055] (8-byte header plus 128 full addresses). The compressed header overlaps the decompressed data, and ipv6_rpl_srh_compress() writes into this overlap, corrupting the routing header of the forwarded packet. The existing guard at exthdrs.c:546 checks (n + 1) > 255, which prevents n+1 from overflowing unsigned char (the segments_left field), but does not prevent the computed hdrlen from overflowing __u8. n=127 passes because 128 <= 255, yet hdrlen=256 does not fit. Tighten the bound to (n + 1) > 127. This caps n at 126, giving hdrlen = (127 * 16) >> 3 = 254, which fits in __u8. The compressed header then lands at buf + ((254 + 1) << 3) = buf + 2040, exactly past the decompressed region (buf[0..2039]). No overlap. 127 segments is well beyond any realistic RPL deployment. | ||||
| CVE-2026-121497 | 1 Wordpress-extensions | 1 Askany | 2026-11-12 | 9.8 Critical |
| The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled. | ||||
| CVE-2025-15714 | 1 Wordpress-extensions | 1 Live Composer | 2026-11-12 | 3.5 Low |
| The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its Button module settings before outputting them on the front end, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in multisite setups). | ||||
| CVE-2026-119531 | 1 Wordpress-extensions | 1 Live Composer | 2026-11-12 | 6.8 Medium |
| The Live Composer WordPress plugin before 2.1.24 does not escape several attributes of one of its page-builder shortcodes before outputting them inside HTML tag attributes, allowing users with the Contributor role and above to store a payload that executes in the browser of anyone who views the post, including an administrator reviewing the pending submission. | ||||
| CVE-2026-104718 | 2026-11-12 | 6.8 Medium | ||
| The Elementor Website Builder WordPress plugin before 4.3.6 does not validate or escape an element identifier before rendering it into a client-side framework attribute that is evaluated as JavaScript, allowing users with the Contributor role to store scripts that execute in the browser of anyone viewing the affected content, including an administrator reviewing the submission for publication. | ||||
| CVE-2025-15713 | 1 Wordpress-extensions | 1 Live Composer | 2026-11-12 | 3.5 Low |
| The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its page-builder module settings before outputting them, allowing users with access to the builder (Administrator by default) to inject arbitrary JavaScript that executes when the affected page is viewed by any visitor; this has impact even on administrators where the unfiltered_html capability is disallowed, e.g. in multisite setups. | ||||
| CVE-2026-115735 | 1 Wordpress-extensions | 1 Somatic Framework | 2026-11-12 | 9.6 Critical |
| The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover. | ||||
| CVE-2026-119529 | 1 Wordpress-extensions | 1 Gravity Forms | 2026-11-12 | 5.9 Medium |
| The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled. | ||||
| CVE-2026-119303 | 1 Wordpress-extensions | 1 Notificationx | 2026-11-12 | 5.3 Medium |
| The NotificationX WordPress plugin before 3.3.7 does not perform any capability or nonce check on one of its REST routes, allowing unauthenticated users to update a NotificationX WordPress plugin before 3.3.7 option and to repeatedly trigger emails sent through the site's own mail server. | ||||
| CVE-2026-119035 | 2026-11-12 | 6.4 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to a custom field. | ||||
| CVE-2026-118439 | 1 Wordpress-extensions | 1 Limit Login Attempts Reloaded | 2026-11-12 | 4.1 Medium |
| The Limit Login Attempts Security WordPress plugin before 3.4.2 does not validate the destination of a server-side request built from a user-supplied setup value, allowing users with administrator privileges to make the site issue requests to arbitrary hosts, including internal ones (SSRF). | ||||
| CVE-2026-118241 | 1 Wordpress-extensions | 1 Smush | 2026-11-12 | 2.7 Low |
| The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup. | ||||
| CVE-2026-119171 | 2026-11-12 | 5.3 Medium | ||
| The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate that a submitted value for a required paid product option matches one of the configured choices, only that it is not empty, allowing unauthenticated users to add a product to the cart and complete an order while skipping the required option's surcharge and paying only the base product price. | ||||
| CVE-2026-119034 | 2026-11-12 | 5.3 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide. | ||||
| CVE-2026-119032 | 2026-11-12 | 5.3 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta. | ||||
| CVE-2026-118041 | 1 Wordpress-extensions | 1 Contest Gallery | 2026-11-12 | 8.8 High |
| The Contest Gallery WordPress plugin before 34.0.3 does not sanitise the name of files uploaded through its e-commerce sale file-replacement feature, allowing authenticated users with Author-level access and above to write files with an arbitrary name and extension to a web-accessible directory and, by overwriting the directory's protection file through the same flow, achieve Remote Code Execution. | ||||
| CVE-2026-117524 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 2.7 Low |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors. | ||||
| CVE-2026-117523 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 4.3 Medium |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a capability or nonce check on an AJAX action that saves its module configuration, allowing any authenticated user, including Subscribers, to enable or disable the Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1's modules site-wide. | ||||