Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425863 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425863 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116615 | 2 Marketingfire, Wordpress-extensions | 2 Widget-options – Advanced Conditional Visibility For Gutenberg Blocks & Classic Widgets, Widget Options | 2026-11-14 | 8.8 High |
| The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 4.2.6.1 via the `post_content` parameter. This is due to asymmetric parsing between the save-time strip filter (`widgetopts_strip_logic_from_blocks()`) and the render-time parser (`blockopts_filter_before_display()`): embedding an inner `<!--start_widgetopts` literal inside a JSON key causes the write-side `json_decode` to see a non-`class` key and skip stripping — persisting the payload verbatim to the database — while the render-side `str_replace` reconstitutes the key to `class`, feeding the attacker-controlled `logic` value directly into `@eval`. This makes it possible for authenticated attackers, with Author-level access and above, to inject PHP expressions that execute on every front-end page view, enabling boolean-oracle exfiltration of WordPress site configuration data — including admin email address, default role, and arbitrary `get_option`, `get_user_meta`, and `get_post_meta` values — via the plugin's allowlisted-function sandbox, which escalates to unrestricted code execution if any installed plugin extends the `widgetopts_allowed_php_functions` filter. Contributors can also exploit this vulnerability when their submitted post is later published by an administrator; notably, the injected payload executes for all site visitors, including unauthenticated users, because a trust-flag mechanism introduced in version 4.2.6 causes `widgetopts_safe_eval_trusted()` to bypass its non-admin short-circuit at every legacy render callsite. Exploitation by attackers with contributor-level access and above requires that an administrator (or editor) later publishes the contributor's submission. On a default installation, where that is not configured, the vulnerability requires attackers with author-level access and above. | ||||
| CVE-2026-126173 | 2026-11-14 | 9.8 Critical | ||
| The AutomatorWP Pro plugin for WordPress' webhook addon is vulnerable to authorization bypass in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to reset the password of any WordPress account, including administrators, resulting in full account takeover. This is only exploitable when an administrator has configured an automation pairing a Receive Webhook trigger — with an 'Is the user ID' field — to an Update-User action whose User ID field is left blank and whose Password field is mapped to the webhook password tag, which is a documented, supported plugin configuration. | ||||
| CVE-2026-107408 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory corruption in DNS / DNS-over-HTTPS (DoH) can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-107410 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in NetScaler Push can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-107411 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in RTSP ALG can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler | ||||
| CVE-2026-107412 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Multiple Memory overflow vulnerabilities can lead to unpredictable or erroneous behavior and Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-107413 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in SAML authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-111342 | 1 Citrix | 3 Gateway, Netscaler Adc, Netscaler Gateway | 2026-11-14 | N/A |
| Memory overflow in LDAP authentication can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway. | ||||
| CVE-2026-126347 | 1 Tornadoweb | 1 Tornado | 2026-11-14 | 3.1 Low |
| Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1. | ||||
| CVE-2026-126348 | 1 Sporkmonger | 1 Addressable | 2026-11-14 | 4.3 Medium |
| Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, the pure-Ruby Addressable::IDNA.to_unicode implementation decodes invalid Punycode A-labels instead of returning them unchanged. Labels that decode to ASCII text or fail to convert back to the same A-label can therefore make Addressable::URI#display_uri show a trusted-looking host while host, normalized_host, and the connection target retain the attacker-controlled encoded host. A trusted-name comparison using Addressable::IDNA.to_unicode output can also treat two different hosts as the same without displaying the URI. The native libidn implementation, to_ascii, and normalized_host are unaffected. This issue is fixed in version 2.9.1. | ||||
| CVE-2026-126349 | 1 Sporkmonger | 1 Addressable | 2026-11-14 | 3.1 Low |
| Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.0.0 until 2.9.1, Addressable::IDNA.to_unicode can decode Punycode labels that contain bidirectional controls, zero-width characters, control characters, or other default-ignorable format characters. Addressable::URI#display_uri can consequently show a reordered or visually indistinguishable hostname even though host, normalized_host, and network connections use the original encoded hostname. The pure-Ruby backend accepts the full prohibited set, while the native libidn backend is affected from 2.5.2 for characters added after Unicode 3.2. This issue is fixed in version 2.9.1. | ||||
| CVE-2026-126351 | 1 Sporkmonger | 1 Addressable | 2026-11-14 | 5.9 Medium |
| Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. Prior to 2.9.1, Addressable::URI.normalize_path repeatedly scans and rewrites paths while removing only one nested dot segment per pass, producing quadratic work. URI#normalize, URI#normalized_path, URI#join, URI#==, and URI#=== inherit the behavior, so processing a sufficiently long attacker-controlled URI can consume a worker thread and cause denial of service on every Ruby implementation. URI.parse alone and code that never normalizes, compares, or joins untrusted URIs are unaffected. This issue is fixed in version 2.9.1. | ||||
| CVE-2026-126353 | 1 Sporkmonger | 1 Addressable | 2026-11-14 | 5.9 Medium |
| Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.3.0 until 2.9.1, URI template expressions containing several exploded variables generate ambiguous regular expressions that can divide a run of members among the variables in polynomially many ways. Template#match or Template#extract processing of an attacker-controlled URI can therefore consume a thread and cause denial of service. The flaw affects MRI Ruby before 3.2 and JRuby, TruffleRuby 40.0, and plus or number-sign expressions on MRI Ruby 3.2. MRI Ruby 3.3 and later, URI parsing, and Template#expand are unaffected. This issue is fixed in version 2.9.1. | ||||
| CVE-2026-126354 | 1 Sporkmonger | 1 Addressable | 2026-11-14 | 4.8 Medium |
| Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1. | ||||
| CVE-2026-126355 | 1 Hono | 1 Hono | 2026-11-14 | 5.3 Medium |
| Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, csrf() limits origin validation to the content types normally sent by HTML forms and therefore does not validate text/ping requests generated by Chromium hyperlink auditing. Chrome and Edge can send a cross-origin credentialed POST without a CORS preflight through an <a ping> action, and the middleware then skips both Origin and Sec-Fetch-Site checks. The fixed request body limits exploitation to state-changing endpoints whose effect is selected by the path or query string and does not depend on submitted body data. The user's cookie must accompany the request, which generally requires a same-site origin or a cookie configured with SameSite=None, and Firefox does not send hyperlink-auditing pings by default. This issue is fixed in version 4.13.16. | ||||
| CVE-2026-126356 | 1 Hono | 1 Hono | 2026-11-14 | 5.3 Medium |
| Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16. | ||||
| CVE-2026-126357 | 1 Hono | 1 Hono | 2026-11-14 | 5.3 Medium |
| Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.16, mount() and app.mount() can remove a dynamic mount prefix using the route-pattern length rather than the matched-prefix length, allowing a crafted path to be forwarded as a protected inner route while the outer application routes the original path. Since 4.12.21, rebuilding the forwarded URL from the decoded pathname can also convert a decoded backslash to a slash and collapse parent-directory segments, again causing the mounted application to receive a protected path. An unauthenticated client can use either applicable path transformation to reach a mounted route without authentication or authorization middleware scoped to a subpath inside the mount prefix. This issue is fixed in version 4.13.16. | ||||
| CVE-2026-127212 | 1 Dokploy | 1 Dokploy | 2026-11-14 | 4.3 Medium |
| Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed "dokploy" control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances. | ||||
| CVE-2026-126358 | 1 Hono | 1 Hono | 2026-11-14 | 5.3 Medium |
| Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant{[^/]+}/admin/* is not applied to a route written as /api/:tenant/admin/:id; since 4.1.4, middleware on /admin/* is not applied to a route registered as /admin* for paths under /admin/; and since 4.4.0, a request path containing an encoded line terminator can reach the not-found handler without wildcard middleware. The default SmartRouter selects RegExpRouter for most applications, and the router's registration-time coverage calculation treated the first two matching pattern pairs as different while its compiled wildcard did not match line terminators in the third case. An unauthenticated client can reach a route handler or the not-found handler without authentication or authorization middleware registered on the wildcard path. TrieRouter, LinearRouter, and PatternRouter apply the middleware in the three described cases. This issue is fixed in version 4.13.16. | ||||
| CVE-2026-126359 | 1 Hono | 1 Hono | 2026-11-14 | 3.4 Low |
| Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when < ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the <Style /> element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after < in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16. | ||||