Export limit exceeded: 13748 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (13748 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15148 | 2 Wordpress, Wp-eventmanager | 2 Wordpress, Wp Event Manager | 2026-08-07 | 5.3 Medium |
| The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings. | ||||
| CVE-2026-19168 | 1 Google | 1 Chrome | 2026-08-07 | 8.8 High |
| Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-19150 | 1 Google | 1 Chrome | 2026-08-07 | 8.8 High |
| Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-19064 | 1 Sourcecodester | 2 Online Examination Learning Management System, Onlne Examination Learning Management System | 2026-08-07 | 4.3 Medium |
| A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0. This vulnerability affects unknown code of the file /view.php. The manipulation of the argument ID results in authorization bypass. The attack can be launched remotely. | ||||
| CVE-2026-14842 | 2026-08-07 | 5.3 Medium | ||
| The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid. | ||||
| CVE-2026-9130 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-07 | 7.1 High |
| IBM Langflow OSS 1.0.0 through 1.10.3 contain an authorization bypass vulnerability in the MemoryComponent that allows authenticated users to access chat history of other users via session_id collision. The MemoryComponent.retrieve_messages and store_message methods filter on session_id without validating flow_id or user_id ownership, enabling cross-user information disclosure through multiple authenticated API endpoints including /api/v1/run/*, /api/v1/responses, and /api/v2/workflow/*. This vulnerability only affects multi-user deployments with LANGFLOW_AUTO_LOGIN=False. | ||||
| CVE-2026-49875 | 1 Apache | 1 Cxf | 2026-08-07 | 6.5 Medium |
| Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this issue. | ||||
| CVE-2026-67552 | 1 Apache | 2 Qpid Proton-dotnet, Qpid Proton Dotnet | 2026-08-07 | 7.5 High |
| A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-Dotnet through 1.0.0. Users are recommended to upgrade to version 1.1.0, which fixes the issue | ||||
| CVE-2026-14304 | 2 Eclipse, Soumu | 3 Accessibility Tools Framework, Eclipse Accessibility Tools Framework, Michecker | 2026-08-07 | 5.5 Medium |
| In Eclipse Accessibility Tools Framework (ACTF) versions up to 1.6.0 (including source code versions up to v20260630 and ACTF based application miChecker versions up to 3.1.0), it has been identified that an XML External Entity (XXE) vulnerability exists. If this vulnerability is exploited, a malicious third party could gain access to local resources or internal network resources via computer running applications that use Eclipse ACTF, including miChecker. | ||||
| CVE-2026-46581 | 1 Eclipse | 2 Eclipse Mojarra, Mojarra | 2026-08-07 | 7.5 High |
| In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`. | ||||
| CVE-2026-60053 | 1 Apache | 1 Answer | 2026-08-07 | 9.1 Critical |
| Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allowing continued access until the keys were explicitly removed. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||
| CVE-2026-70444 | 1 Jenkins Project | 1 Jenkins Violation Comments To Gitlab Plugin | 2026-08-07 | 4.3 Medium |
| A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-70448 | 1 Jenkins Project | 1 Jenkins Ivy Report Plugin | 2026-08-07 | 7.1 High |
| Jenkins Ivy Report Plugin 1.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks when processing Ivy report files. | ||||
| CVE-2024-6832 | 1 Wso2 | 18 Api Control Plane, Api Manager, Identity Server and 15 more | 2026-08-07 | 5.9 Medium |
| The account locking mechanism fails to trigger when secondary user stores are inaccessible. The software does not maintain a consistent state for account locking if it cannot reach all configured user stores, allowing an attacker to repeatedly attempt authentication with invalid credentials without triggering the lockout mechanism for users within active stores. When the account locking mechanism is bypassed due to the inaccessibility of secondary user stores, users in accessible user stores are left vulnerable to brute force attacks. A malicious actor can exploit this by attempting numerous invalid password combinations against a user account without the expected account lockout consequence. | ||||
| CVE-2025-11850 | 1 Wso2 | 3 Identity Server, Token Exchange Grant Type For Oauth, Wso2 Identity Server | 2026-08-07 | 4.3 Medium |
| When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique. | ||||
| CVE-2026-65432 | 1 Apache | 1 Cxf | 2026-08-07 | 7.5 High |
| Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. | ||||
| CVE-2026-65523 | 2 Approveme, Wordpress | 2 Formidable Forms Signature Online Contract Automation, Wordpress | 2026-08-07 | 7.5 High |
| Unauthenticated Insecure Direct Object References (IDOR) in Formidable Forms Signature Online Contract Automation <= 2.0.1 versions. | ||||
| CVE-2026-15209 | 2 Jshelpdesk, Wordpress | 2 Jshelpdesk, Wordpress | 2026-08-07 | 6.5 Medium |
| The JS Help Desk WordPress plugin before 3.1.5 does not verify that the requesting user owns the ticket being loaded: a low-privileged authenticated user can supply another user's ticket ID and read that ticket's contents, including the reporter's PII and message body. | ||||
| CVE-2026-58045 | 1 Nodejs | 1 Nodejs | 2026-08-07 | 6.2 Medium |
| A flaw in Node.js allows a spoofed `TypedArray` `byteLength` to trigger a reachable assertion in the synchronous `node:zlib` APIs, causing the entire process to crash. All 11 synchronous zlib functions are affected. Repeated exploitation of this condition can result in a denial of service. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | ||||
| CVE-2026-20301 | 1 Cisco | 2 Ios, Ios Xe Software | 2026-08-07 | 8.6 High |
| A vulnerability in the Extensible Messaging Client Protocol (XMCP), also referred to as the External Client protocol, of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of malformed XMCP packets. An attacker could exploit this vulnerability by sending a malformed XMCP packet to an affected device. A successful exploit could allow the attacker to cause the affected device to reload unexpectedly, resulting in a DoS condition. The attacker does not need the XMCP client username to exploit this vulnerability. | ||||