Export limit exceeded: 387163 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (387163 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84754 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. | ||||
| CVE-2026-84755 | 2 Getwpfunnels, Wordpress | 2 Mail Mint, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. | ||||
| CVE-2026-84758 | 2 Strategy11team, Wordpress | 2 Business Directory Plugin, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | ||||
| CVE-2026-84766 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Booking | 2026-09-07 | 5.9 Medium |
| Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. | ||||
| CVE-2026-84769 | 2 Strategy11team, Wordpress | 2 Business Directory Plugin, Wordpress | 2026-09-07 | 6.5 Medium |
| Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions. | ||||
| CVE-2026-84812 | 2 Wordplus, Wordpress | 2 Better Messages, Wordpress | 2026-09-07 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | ||||
| CVE-2026-85302 | 2 Wordpress, Wpkoi | 2 Wordpress, Wpkoi Templates For Elementor | 2026-09-07 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2. | ||||
| CVE-2026-85303 | 2 Magepeople, Wordpress | 2 Booking & Rental Manager, Wordpress | 2026-09-07 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Manager allows Stored XSS. This issue affects Booking and Rental Manager: from n/a through 2.7.7. | ||||
| CVE-2026-75160 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | 9.1 Critical |
| An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi-bin/ugwdownload.cgi. | ||||
| CVE-2026-75161 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | N/A |
| An issue in the ugw-restart method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to inject arbitrary code into the dpcheck system utility executed as root. | ||||
| CVE-2026-75162 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | N/A |
| An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response. | ||||
| CVE-2026-79418 | 1 Emxtecnologia | 1 Gestao X Business Suite | 2026-09-07 | N/A |
| EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other authenticated users, potentially resulting in session hijacking, account takeover, and unauthorized actions. | ||||
| CVE-2026-79419 | 1 Emxtecnologia | 1 Gestao X Business Suite | 2026-09-07 | N/A |
| A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser. | ||||
| CVE-2026-31020 | 1 Arc53 | 1 Docsgpt | 2026-09-07 | 9.8 Critical |
| In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE). | ||||
| CVE-2026-75430 | 1 Powerjob | 1 Powerjob | 2026-09-07 | 9.8 Critical |
| PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code. | ||||
| CVE-2026-75165 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | N/A |
| An issue in /cgi-bin/wwwugw.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to invoke hidden network diagnostic methods (ugw-ping, ugw-traceroute) that are not exposed in the web UI, allowing attackers to obtain sensitive information. | ||||
| CVE-2026-75169 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | N/A |
| An arbitrary file upload vulnerability in /cgi-bin/ugwupload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with Admin role to upload files with arbitrary content to hardcoded paths. | ||||
| CVE-2021-44319 | 1 Parrot | 1 Ar.drone | 2026-09-07 | N/A |
| Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight. | ||||
| CVE-2021-44320 | 1 Parrot | 1 Ar.drone | 2026-09-07 | 7.5 High |
| Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., video streaming and control) by using tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding and UDP flooding. | ||||
| CVE-2026-75431 | 1 Powerjob | 1 Powerjob | 2026-09-07 | 9.1 Critical |
| PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code. | ||||