Export limit exceeded: 27799 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (27799 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-2916 | 2 Jegtheme, Wordpress | 2 Jeg Kit For Elementor – Powerful Addons For Elementor, Widgets & Templates For Wordpress, Wordpress | 2026-08-03 | 4.3 Medium |
| The Jeg Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.1 via the `enqueue_scripts()` method in `class/dashboard/class-dashboard.php`. The plugin injects a `JkitDashboardOption` JavaScript object containing full plugin inventory (names, versions, paths, active status), system environment details (WordPress version, PHP version, site URLs, server capabilities), and potentially third-party API credentials (Mailchimp API key via `jkit_user_data`) as an inline script on the `post.php` admin page. Because this data is output without any capability check beyond post editing access, any authenticated user with Contributor-level access or above can view this sensitive configuration data by inspecting the page source. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive site configuration data, installed plugin details, and potentially third-party API keys. | ||||
| CVE-2026-69153 | 1 Postcss | 1 Postcss | 2026-08-03 | 5.3 Medium |
| PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map’s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19. | ||||
| CVE-2026-18059 | 2 Pixelyoursite, Wordpress | 3 Pixelyoursite Pro – Your Smart Pixel (tag) Manager, Pixelyoursite – Your Smart Pixel (tag) & Api Manager, Wordpress | 2026-08-03 | 5.3 Medium |
| The PixelYourSite – Your smart PIXEL (TAG) & API Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.2.1 via the getWooPurchaseEventParams. This makes it possible for unauthenticated attackers to extract WooCommerce purchase metadata — including product names, product IDs, quantities, per-item prices, order totals, currency, and order/transaction IDs — for any existing order by supplying an invalid or arbitrary order key. This is exploitable against any known or enumerated order ID, as the plugin resolves the order from the URL path variable alone and emits the full woo_purchase tracking payload into the page HTML via the pysOptions JavaScript object across its Facebook, Google Analytics, and Google Tag Manager integrations regardless of key validity. | ||||
| CVE-2026-67354 | 1 Guzzlephp | 1 Guzzle | 2026-08-03 | 5.9 Medium |
| guzzlehttp/guzzle versions before 7.15.1 contain an information disclosure vulnerability in RedirectMiddleware. When the optional allow_redirects.referer setting is enabled, the middleware copies the URI fragment (the portion after '#') from the referring request into the generated Referer header when following a same-scheme redirect (e.g., HTTPS to HTTPS). An attacker who controls the redirect destination can read this fragment from the incoming Referer header, potentially disclosing one-time login secrets, access tokens, state values, or other sensitive client data to a server never meant to receive it. The referer setting is disabled by default. Fixed in 7.15.1, which strips the fragment before generating the Referer value. | ||||
| CVE-2026-67339 | 1 Guzzlephp | 1 Guzzle | 2026-08-03 | 5.3 Medium |
| guzzlehttp/guzzle versions before 7.14.2 fail to properly isolate Proxy-Authorization headers from origin servers in cURL handlers. Attackers can capture proxy credentials through origin server access logs when requests are redirected, bypassed, or sent through SOCKS proxies that Guzzle misclassifies as direct connections. | ||||
| CVE-2026-67296 | 1 Freerdp | 1 Freerdp | 2026-08-03 | 7.5 High |
| FreeRDP before 3.29.0 contains a denial of service vulnerability in the RDPEI server channel handler that fails to validate maximum PDU body length before stream allocation. A malicious RDP client can send a header-only RDPEI message with a large declared body length to force excessive memory allocation on the server. | ||||
| CVE-2026-54909 | 1 Pion | 1 Stun | 2026-08-03 | 5.3 Medium |
| pion/stun is a Go implementation of STUN. Prior to 3.1.3, XORMappedAddress.GetFromAs can panic while parsing a malformed short XOR-MAPPED-ADDRESS attribute in STUN or ICE Binding-response parsing paths, allowing remote denial of service. This issue is fixed in version 3.1.3. | ||||
| CVE-2026-43759 | 1 Apple | 2 Macos, Watchos | 2026-08-03 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Tahoe 26.6, watchOS 26.6. An app may be able to access sensitive user data. | ||||
| CVE-2026-53551 | 1 Free5gc | 2 Ausf, Free5gc | 2026-08-03 | N/A |
| free5GC is an open-source implementation of the 5G core network. Prior to 1.4.5, the free5GC AUSF (Authentication Server Function) does not validate the supiOrSuci field in UE authentication requests. Null bytes (\x00) and other control characters pass through JSON parsing unchanged and are forwarded to the UDM in an unescaped URL path. This causes Go's net/url.Parse() to fail, returning HTTP 500 "System failure" and leaking internal stack traces. An unauthenticated attacker can trigger this at scale causing denial of service for all subscribers attempting authentication through the affected AUSF. This vulnerability is fixed in 1.4.5. | ||||
| CVE-2026-54785 | 1 Elyin | 1 Gemini-bridge | 2026-08-03 | 6.2 Medium |
| gemini-bridge is a lightweight MCP server bridging AI agents to Google's Gemini AI via the official CLI. From 1.0.0 until 1.3.1, consult_gemini_with_files in inline mode read any file path supplied in the files argument without confining it to the working directory, then forwarded the contents to the Gemini CLI. Because the caller also controls query, the file contents are echoed back through the Gemini round-trip (and sent to Google), making this an arbitrary local file read. This issue is fixed in version 1.3.1. | ||||
| CVE-2026-43753 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-08-03 | 4.6 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An attacker with physical access to a locked device may be able to view sensitive user information. | ||||
| CVE-2026-64733 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-08-03 | 9.8 Critical |
| This issue was addressed with improved data protection. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to fingerprint the user. | ||||
| CVE-2026-17738 | 1 Google | 1 Chrome | 2026-08-03 | 9.6 Critical |
| Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17749 | 1 Google | 1 Chrome | 2026-08-03 | 9.6 Critical |
| Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. (Chromium security severity: Medium) | ||||
| CVE-2026-43793 | 1 Apple | 1 Macos | 2026-08-03 | 9.8 Critical |
| An issue existed in the handling of environment variables. This issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-43756 | 1 Apple | 1 Macos | 2026-08-03 | 5.5 Medium |
| A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to access user-sensitive data. | ||||
| CVE-2026-48001 | 1 Adobe | 8 Adobe Commerce, Adobe Commerce B2b, Adobe Commerce Webhooks Plugin and 5 more | 2026-08-03 | 3.7 Low |
| Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. | ||||
| CVE-2025-71399 | 1 Better-auth | 2 Better-auth\/oauth-provider, Better Auth | 2026-08-03 | 8.6 High |
| Better Auth relies on better-call, which uses the rou3 router library. In affected versions of rou3, paths are normalized by removing empty segments, so /path, //path, and ///path resolve to the same route. In Better Auth versions prior to 1.4.5 (which bundles the fixed rou3), this can allow attackers to bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply in deployments where the proxy or platform normalizes URLs by collapsing multiple slashes. | ||||
| CVE-2026-28144 | 2 Flippercode, Wordpress | 2 Wp Maps Pro, Wordpress | 2026-08-03 | 4.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6. | ||||
| CVE-2026-67330 | 1 Better-auth | 1 Scim | 2026-08-03 | 9.9 Critical |
| @better-auth/scim (a better-auth plugin) versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0). | ||||