Export limit exceeded: 415092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415092 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415092 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112634 | 1 Apple | 3 Ios And Ipados, Macos, Visionos | 2026-10-27 | 6.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted image may lead to unexpected app termination. | ||||
| CVE-2026-102787 | 1 Phoca | 1 Phoca Download Extension For Joomla | 2026-10-27 | N/A |
| Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | ||||
| CVE-2026-102789 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-10-27 | N/A |
| Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check. | ||||
| CVE-2026-117541 | 1 Svg-sanitizer Project | 1 Svg-sanitizer | 2026-10-27 | 5.3 Medium |
| svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash callers by submitting well-formed XML without a top-level svg root. Attackers can supply documents with a non-svg root or nested svg element, causing Sanitizer::sanitize() to throw a LogicException instead of returning false, crashing workers or bypassing upload rejection. | ||||
| CVE-2026-117540 | 1 Svg-sanitizer Project | 1 Svg-sanitizer | 2026-10-27 | 7.5 High |
| svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that repeatedly rescans the whole input while stripping PHP tags. Unauthenticated attackers can upload SVGs with many overlapping PHP tag openers and closers, forcing quadratic preg_replace passes that exhaust worker CPU for minutes. | ||||
| CVE-2026-117539 | 1 Svg-sanitizer Project | 1 Svg-sanitizer | 2026-10-27 | 3.5 Low |
| darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow attackers to embed external resources by uploading crafted SVG files. Attackers can use unsanitized style content, unquoted url() values, or image href attributes to exfiltrate page data, track users, or disclose visitor IP addresses. | ||||
| CVE-2026-117538 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 4.1 Medium |
| REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data. | ||||
| CVE-2026-117537 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 4.1 Medium |
| REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session. | ||||
| CVE-2026-117536 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 8.8 High |
| REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not require it. Attackers can lure a logged-in backend user with the users[] permission to a crafted GET link to grant administrator rights, deactivate accounts, or lock out the sole administrator. | ||||
| CVE-2026-117535 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 6.1 Medium |
| REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator. | ||||
| CVE-2026-117534 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 5.4 Medium |
| REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states. | ||||
| CVE-2026-117533 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 4.4 Medium |
| REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions. | ||||
| CVE-2026-117532 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 9.8 Critical |
| REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin, gaining backend access and code execution outside live mode. | ||||
| CVE-2026-116900 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 5.4 Medium |
| REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts. | ||||
| CVE-2026-116899 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 6.5 Medium |
| REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices. | ||||
| CVE-2026-116898 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 7.1 High |
| REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then silently replace their contents site-wide. | ||||
| CVE-2026-116897 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 6.5 Medium |
| REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding history[article_rollback], can set rex_version or rex_history_date with arbitrary article_id values to read unpublished working versions and historic or deleted content. | ||||
| CVE-2026-116896 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 7.5 High |
| REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. Attackers can obtain plaintext session ids and stay-logged-in keys to take over admin accounts, or password hashes for offline cracking. | ||||
| CVE-2026-116895 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 5.4 Medium |
| REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons. | ||||
| CVE-2026-116894 | 1 Redaxo | 1 Redaxo | 2026-10-27 | 4.2 Medium |
| REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend access after the password change, via the cookie for up to three months. | ||||