Export limit exceeded: 416879 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 45783 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (45783 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-98444 | 1 Linux | 1 Linux Kernel | 2026-10-19 | 4.7 Medium |
| In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfs_qm_flush_one fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is going to drop the dqflock, so we need to do it ourselves. | ||||
| CVE-2026-96653 | 2 Wordpress-extensions, Wpdirectorykit | 2 Wp Directory Kit, Wp Directory Kit | 2026-10-19 | 6.5 Medium |
| The WP Directory Kit plugin for WordPress is vulnerable to time-based SQL Injection via 'display_name' Profile Field (Second-Order) in all versions up to, and including, 1.5.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order injection: a Subscriber stores a display_name containing a single quote via their own profile, which WordPress preserves verbatim; the payload is then triggered when WdkCachedUserEditor::update_listings_user_editor() re-reads that stored value and passes it unsanitized to the SQL sink. | ||||
| CVE-2026-57727 | 2 Themeum, Wordpress | 2 Kirki, Wordpress | 2026-10-19 | 7.5 High |
| Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: from n/a through 6.2.0. | ||||
| CVE-2026-112087 | 1 Itsourcecode | 1 Online Cake Ordering System | 2026-10-19 | 6.3 Medium |
| A weakness has been identified in itsourcecode Online Cake Ordering System 1.0. This issue affects some unknown processing of the file confirm.php. This manipulation of the argument cancel causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-89302 | 1 Wordpress-extensions | 1 Post Voting System | 2026-10-19 | 8.6 High |
| The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks. | ||||
| CVE-2026-107418 | 2 Arraytics, Wordpress-extensions | 2 Booktics, Booktics | 2026-10-18 | 5.4 Medium |
| Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28. | ||||
| CVE-2026-109703 | 2 Wordpress-extensions, Wpgraphql | 2 Wpgraphql, Wpgraphql | 2026-10-18 | 5.3 Medium |
| Missing Authorization vulnerability in WPGraphQL WPGraphQL wp-graphql allows Retrieve Embedded Sensitive Data.This issue affects WPGraphQL: from n/a through 2.23.1. | ||||
| CVE-2026-15399 | 2 Wordpress-extensions, Wpmart | 2 Animated Number Counters, Animated Number Counters | 2026-10-18 | 4.9 Medium |
| The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to, and including, 3.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This is a second-order SQL injection: the write path correctly uses $wpdb->prepare(), but that protection is not carried forward to the read path, where the retrieved value is concatenated unsanitized into unprepared queries in both a single-quoted string context and a bare numeric context. | ||||
| CVE-2026-97370 | 1 Junrar | 1 Junrar | 2026-10-18 | 7.5 High |
| Junrar is an open source Java RAR archive library. Prior to 7.6.1, RarVM.ExecuteCode in src/main/java/com/github/junrar/unpack/vm/RarVM.java can repeatedly execute a VM_JMP instruction whose target is greater than or equal to the prepared program's codeSize. The setIP() function returns success without changing the instruction pointer or decrementing maxOpCount, and the jump handler continues before loop-end accounting, leaving both values unchanged. A crafted RAR4 archive can therefore keep an extraction thread in an infinite CPU loop and exhaust archive-processing worker capacity. The RAR virtual machine does not expose native process execution, so the supported impact is availability loss rather than code execution. This issue is fixed in version 7.6.1. | ||||
| CVE-2026-92817 | 1 Inductiveautomation | 1 Ignition | 2026-10-18 | 8.8 High |
| The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user with access to a Vision project could provide their valid Vision session identifier and gain Designer-level privileges. An attacker could exploit these elevated privileges to execute arbitrary code in the context of the Ignition Gateway process. | ||||
| CVE-2026-78433 | 1 Gitea | 1 Gitea | 2026-10-18 | 5.9 Medium |
| Gitea's web attachment handler skips its cross-repository ownership check for attachments created before 16 January 2026 and checks permissions against the repository named in the request URL instead. An unauthenticated attacker who knows a private attachment's UUID can request it through a public repository's attachment path and retrieve its contents. This can expose issue and pull request attachments or release assets; the random attachment UUID must already be known to the attacker. | ||||
| CVE-2026-73804 | 1 Gitea | 1 Gitea | 2026-10-18 | 8.1 High |
| Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scope checks to be skipped. This converts a user-scoped token into an unscoped API authentication method while retaining the account's normal role and repository permissions. | ||||
| CVE-2026-73800 | 1 Gitea | 1 Gitea | 2026-10-18 | 8.8 High |
| Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code. | ||||
| CVE-2026-70396 | 1 Gitea | 1 Gitea | 2026-10-18 | 5.4 Medium |
| Gitea's organization repository-creation API requires write:organization but omits the write:repository token scope enforced by other repository-creation routes. A personal access token or OAuth application token without repository-write scope can therefore create organization-owned repositories if the authorizing user has permission to do so. This bypasses the token's delegated scope boundary while remaining subject to the user's organization permissions. | ||||
| CVE-2026-91074 | 2026-10-18 | 6.8 Medium | ||
| The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator password hashes from the database. | ||||
| CVE-2026-86022 | 1 Vnotex | 1 Vnote | 2026-10-18 | 7 High |
| VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0. | ||||
| CVE-2026-109665 | 1 Frappe | 1 Erpnext | 2026-10-18 | 4.3 Medium |
| Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to deactivate master records, modifying data beyond their permitted role. | ||||
| CVE-2026-109660 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond what their assigned role permits. | ||||
| CVE-2026-109655 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory records beyond their permitted role. | ||||
| CVE-2026-109650 | 1 Frappe | 1 Erpnext | 2026-10-18 | 6.5 Medium |
| Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what their assigned role permits. | ||||