Export limit exceeded: 395673 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395673 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395673 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93338 | 1 Grandstream Networks | 1 Gwn7660elr | 2026-09-19 | 5.3 Medium |
| Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote attackers to obtain sensitive system information by querying the SNMP v2c service configured with the default community string 'public'. Attackers can query standard MIBs over the SNMP port to retrieve operating system and kernel version, running process names and command-line arguments, network interface configuration, routing table entries, ARP table mappings, active TCP connection details, and file system paths, enabling detailed reconnaissance of the device and adjacent network infrastructure. | ||||
| CVE-2026-81321 | 1 Carecam | 1 Hmt.cm2507 Firmware | 2026-09-19 | 9.8 Critical |
| CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesystem access through physical access, a debugging interface, or another vulnerability could recover the configured network identifier and pre-shared key. | ||||
| CVE-2026-93762 | 1 Mongodb | 1 Mongoid | 2026-09-19 | 9.8 Critical |
| Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanently remove stored records. | ||||
| CVE-2026-91127 | 1 Flyfish-dev | 2 File-viewer, Msdoc-viewer | 2026-09-19 | 8.2 High |
| File Viewer is a browser-native viewer for Office, PDF, CAD, archive, and other files in private and internal web applications. Prior to @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2, the legacy DOC renderer emitted document-controlled hyperlink targets into generated HTML after character escaping but without restricting URL schemes. A crafted legacy DOC file could place javascript:, vbscript:, data:, or another unsafe scheme in a rendered link, and script could execute in the embedding application's origin when a user clicked the link. The fix blocks external document links by default, allows only HTTP(S), mail, telephone, safe relative URLs, and internal bookmarks when external links are explicitly enabled, and applies mount-boundary sanitization as defense in depth. This issue is fixed in @file-viewer/doc 2.3.1 and msdoc-viewer 0.2.2. | ||||
| CVE-2026-93760 | 1 Mongodb | 1 Mongoid | 2026-09-19 | 8.2 High |
| Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-building methods. In an application that forwards externally supplied filter parameters in this way, a party with no credentials may influence how the database evaluates the query. This may result in unintended disclosure of stored field values and in reduced database performance. | ||||
| CVE-2026-93852 | 1 Openstack | 1 Blazar | 2026-09-19 | N/A |
| In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an administrator-only policy. Any authenticated user with access to the Blazar REST API can enumerate leases belonging to other tenants, exposing lease IDs, reservation IDs, resource IDs, and reservation metadata. The exposed lease IDs also enable the object-level authorization bypass tracked in the companion request, allowing an attacker to then modify or delete the enumerated leases. | ||||
| CVE-2026-93854 | 1 Openstack | 1 Blazar | 2026-09-19 | N/A |
| In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check. | ||||
| CVE-2026-93031 | 3 Deleeuw , Wordpress, Wp Cloud Plugins/ Deleeuw | 5 Share-one-drive | Onedrive & Sharepoint Plugin For Wordpress, Wp Cloud Plugins - Box (lets-box), Wp Cloud Plugins - Dropbox (out-of-the-box) and 2 more | 2026-09-19 | 8.8 High |
| The WP Cloud Plugins Use-your-Drive, Out-of-the-Box, Share-one-Drive, and Lets-Box plugins for WordPress are vulnerable to Arbitrary File Upload in all versions from 2.0 up to, and including, 3.8.3 via the download_file_to_uploads function. This is due to the import action being registered for unauthenticated users via wp_ajax_nopriv_, a missing capability check in can_import(), and the imported file's extension and contents not being validated against get_allowed_mime_types() before it is written to the uploads directory. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. | ||||
| CVE-2026-77528 | 1 Crossbario | 1 Autobahn-python | 2026-09-19 | 5.3 Medium |
| Autobahn Python is a WebSocket and WAMP implementation for Python that supports Twisted and asyncio. Prior to 26.7.1, WebSocket endpoints that accept permessage-deflate and rely on maxMessagePayloadSize enforce that limit against the compressed frame length before inflation but do not recheck the decompressed message size before delivery. A remote unauthenticated client can send a valid compressed frame below the configured wire-size limit that expands beyond the application message limit, causing oversized data to be allocated, joined, validated, and passed to application callbacks. This can create resource-exhaustion pressure, but the advisory does not establish confidentiality or integrity impact. This issue is fixed in version 26.7.1. | ||||
| CVE-2026-77820 | 2 Stellarwp, Wordpress | 2 Wpcomplete, Wordpress | 2026-09-19 | 6.4 Medium |
| The WPComplete plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'empty' Shortcode Attribute in all versions up to, and including, 2.9.9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the premium version of the software in order to exploit. Please note this only affects the pro version. | ||||
| CVE-2026-89333 | 2 Themeum, Wordpress | 2 Tutor Lms – Elearning And Online Course Solution, Wordpress | 2026-09-19 | 6.5 Medium |
| The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.0.8 via the 'student_id' parameter due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with subscriber-level access and above, to disclose the email address and Tutor profile phone number of arbitrary WordPress users, including Administrators, by iterating over user IDs via the student_id parameter. | ||||
| CVE-2026-11608 | 2 Bompus, Wordpress | 2 Wp Customer Reviews, Wordpress | 2026-09-19 | 6.1 Medium |
| The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. | ||||
| CVE-2026-13770 | 2 Appmysite, Wordpress | 2 Appmysite – Wordpress & Woocommerce Mobile App Builder (no-code Android & Ios App Maker), Wordpress | 2026-09-19 | 6.4 Medium |
| The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload. | ||||
| CVE-2026-13191 | 2 Mischiefmarmot, Wordpress | 2 Create, Wordpress | 2026-09-19 | 6.5 Medium |
| The Create plugin for WordPress is vulnerable to generic SQL Injection via the 'order_by' parameter in all versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The REST endpoint permission callback defaults to the publish_posts capability, meaning any Author-level user or above can reach the vulnerable code path without any additional preconditions. | ||||
| CVE-2026-1255 | 2 Wordpress, Ysinnovations | 2 Wordpress, Ys Leadgen – Popup Builder, Popup Maker & Form Builder For Wordpress | Lead Generation, Email Marketing, Sales, Conversions, Opt-ins & Subscribers | 2026-09-19 | 7.5 High |
| The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users. This makes it possible for unauthenticated attackers to retrieve all captured form submission data, including personally identifiable information (PII) such as names, email addresses, and message content submitted through YS LeadGen forms. | ||||
| CVE-2026-89155 | 2026-09-19 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-93955 | 1 Grimmory-tools | 1 Grimmory | 2026-09-19 | 4.3 Medium |
| A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argument bookId results in authorization bypass. The attack may be initiated remotely. The exploit is now public and may be used. Issue #2431 is closed as completed, but its only comment states that the issue “has already been reported elsewhere.” No fixing commit or pull request is identified there. | ||||
| CVE-2026-13639 | 1 Synology | 1 Diskstation Manager | 2026-09-19 | 9.8 Critical |
| An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks. | ||||
| CVE-2026-13635 | 1 Synology | 1 Diskstation Manager | 2026-09-19 | 5.3 Medium |
| An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote attackers to obtain non-sensitive information. | ||||
| CVE-2026-13673 | 1 Synology | 1 Diskstation Manager | 2026-09-19 | 8.8 High |
| An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to read or write arbitrary files and conduct denial-of-service attacks. | ||||