Export limit exceeded: 424258 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424258 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112855 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. | ||||
| CVE-2026-112854 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. | ||||
| CVE-2026-112852 | 2026-10-24 | 8.1 High | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. | ||||
| CVE-2026-112851 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. | ||||
| CVE-2026-112850 | 2026-10-24 | 8.1 High | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1. | ||||
| CVE-2026-112848 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. | ||||
| CVE-2026-112847 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. | ||||
| CVE-2026-112846 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. | ||||
| CVE-2026-112844 | 2 Arraytics, Wordpress-extensions | 2 Wp Event Solution, Wp Event Solution | 2026-10-24 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26. | ||||
| CVE-2026-112207 | 1 Wordpress-extensions | 1 Download Monitor | 2026-10-24 | 7.1 High |
| The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link. | ||||
| CVE-2026-111402 | 2 Tribulant, Wordpress-extensions | 2 Newsletters, Newsletters | 2026-10-24 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1. | ||||
| CVE-2026-110956 | 2026-10-24 | 9.8 Critical | ||
| The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator. | ||||
| CVE-2026-110892 | 3 Brainstorm Force, Brainstormforce, Wordpress-extensions | 3 Suredash, Suredash, Suredash | 2026-10-24 | 6.5 Medium |
| Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2. | ||||
| CVE-2026-72797 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-10-24 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous readers and publish-mode accounts can enumerate all encrypted notebooks and their current unlock status, revealing sensitive notebook names and decryption state in memory. | ||||
| CVE-2026-71965 | 2 Cyberpanel, Usmannasir | 2 Cyberpanel, Cyberpanel | 2026-10-24 | 8.8 High |
| CyberPanel 2.4.3, fixed in commit eca0c3c, contains an authenticated remote code execution vulnerability in the remote backup feature that allows authenticated attackers to gain root-level SSH access by supplying a malicious remote server address. Attackers can exploit the unverified SSH public key retrieval process to write an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access to the host system. | ||||
| CVE-2026-71958 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-10-24 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash. | ||||
| CVE-2026-71956 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-10-24 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges. | ||||
| CVE-2026-71953 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-10-24 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with root privileges. | ||||
| CVE-2026-71559 | 1 Apache | 1 Fory | 2026-10-24 | 7.5 High |
| Deserialization of Untrusted Data vulnerability in the Go implementation of Apache Fory allows an attacker to cause a denial of service by supplying crafted data containing malformed type metadata, which triggers an uncaught panic. This issue affects Apache Fory: from 0.16.0 before 1.5.0. Users of other language implementations are not affected. Users are recommended to upgrade to version 1.5.0, which fixes the issue. | ||||
| CVE-2026-71394 | 1 Gnu | 1 Emacs | 2026-10-24 | 6.6 Medium |
| GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file that claims to contain more table directory entries than actually present causes the parser to return a struct with uninitialized heap memory in the table directory entries. An attacker can deliver a malicious font file via email, EWW (Emacs Web Wowser), or documents with custom faces, causing Emacs to load it. This leads to the use of uninitialized heap data in subsequent table lookups, potentially resulting in information disclosure, crashes, or arbitrary memory access on 32-bit targets. This issue is fixed after commit 7621ee1d01229d50e5c0cddea6bf0b01095a62cf | ||||