Export limit exceeded: 423988 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 94958 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94958 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72872 | 1 Dokploy | 1 Dokploy | 2026-08-13 | 9.9 Critical |
| Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, application.saveBitbucketProvider stores bitbucketOwner and bitbucketRepository without validation and cloneBitbucketRepository in packages/server/src/utils/providers/bitbucket.ts interpolates those values into git clone commands executed through execAsync or execAsyncRemote, allowing a member with service deployment permission to execute arbitrary operating system commands on the Dokploy host or target server. This issue is fixed in version 0.29.13. | ||||
| CVE-2026-72727 | 1 Discourse | 1 Discourse | 2026-08-13 | N/A |
| Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored cross-site scripting when a moderator viewed it on a site with a modified or disabled default Content Security Policy. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. | ||||
| CVE-2026-48362 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 10 Critical |
| ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48385 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 7.7 High |
| ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-73357 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-08-13 | 6.5 Medium |
| Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | ||||
| CVE-2026-66460 | 2 Aftership & Automizely, Wordpress | 2 Aftership Tracking, Wordpress | 2026-08-13 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions. | ||||
| CVE-2026-66449 | 2 Dylan Kuhn, Wordpress | 2 Geo Mashup, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.18 versions. | ||||
| CVE-2026-73295 | 1 Squidfunk | 1 Mkdocs-material | 2026-08-13 | 5.4 Medium |
| Material for MkDocs is a powerful documentation framework built on top of MkDocs. From 7.2.0 until 9.7.7, the mountSearchSuggest function in src/templates/assets/javascripts/components/search/suggest/index.ts contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature that allows a crafted q URL parameter to execute JavaScript in a documentation site's origin after user interaction. This issue is fixed in version 9.7.7. | ||||
| CVE-2026-64607 | 1 Apache | 2 Httpclient, Httpcomponents Client | 2026-08-13 | 5.3 Medium |
| HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-Encoding` header value in the response message. Please note this defect does not affect HttpClient based on the async i/o model. This issue affects Apache HttpComponents Client: from 5.0-alpha1 through 5.6.2. | ||||
| CVE-2026-66655 | 2 Multiparcels, Wordpress | 2 Multiparcels Shipping For Woocommerce, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. | ||||
| CVE-2026-66687 | 2 Magepeopleteam, Wordpress | 2 Wpbookingly, Wordpress | 2026-08-13 | 6.5 Medium |
| Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions. | ||||
| CVE-2026-66700 | 2 Wordpress, Zaytech | 2 Wordpress, Smart Online Order For Clover | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions. | ||||
| CVE-2026-47299 | 1 Microsoft | 2 Azure Monitor Agent, Azure Monitor Agent Linux Extension | 2026-08-13 | 7.2 High |
| Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-16956 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-13 | 9.8 Critical |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-28175 | 2 Wordpress, Wp-buy | 2 Wordpress, Visitor Traffic Real Time Statistics | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions. | ||||
| CVE-2026-17218 | 1 Ibm | 1 I | 2026-08-13 | 9.8 Critical |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to execute arbitrary code due to an out-of-bounds write. | ||||
| CVE-2026-17248 | 1 Ibm | 1 I | 2026-08-13 | 7.1 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to improper neutralization of special elements in an OS command. | ||||
| CVE-2026-61960 | 2 Themeisle, Wordpress | 2 Wp Full Stripe Free, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Full Stripe Free <= 8.5.0 versions. | ||||
| CVE-2026-61974 | 2 Kitae-park, Wordpress | 2 Mang Board Wp, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.3.4 versions. | ||||
| CVE-2026-18235 | 1 Ibm | 1 I | 2026-08-13 | 8.3 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary Control Language commands due to insufficient input validation. | ||||