Export limit exceeded: 399237 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (399237 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79079 | 1 Crosswire | 1 Xiphos | 2026-09-28 | 7.8 High |
| An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components | ||||
| CVE-2026-88406 | 1 Falkordb | 1 Falkordb | 2026-09-28 | 7.5 High |
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-88407 | 1 Falkordb | 1 Falkordb | 2026-09-28 | 7.5 High |
| An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-88409 | 1 Falkordb | 1 Falkordb | 2026-09-28 | 8.8 High |
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-88410 | 1 Falkordb | 1 Falkordb | 2026-09-28 | 7.1 High |
| The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application. | ||||
| CVE-2026-88411 | 1 Falkordb | 1 Falkordb | 2026-09-28 | 7.5 High |
| Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Service (DoS) within the application. | ||||
| CVE-2026-88412 | 1 Falkordb | 1 Falkordb | 2026-09-28 | 5.3 Medium |
| An integer overflow in the _BulkInsert_ReadProperty component (/bulk_insert.c) of FalkorDB (Redis module) v4.20.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-88624 | 1 Opencode | 1 Opencode | 2026-09-28 | 9.1 Critical |
| Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload. | ||||
| CVE-2026-93709 | 1 Perldancer | 1 Dancer2 | 2026-09-28 | 5.3 Medium |
| Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot segment, a percent-encoded slash, or a different capitalisation on a case-insensitive filesystem therefore misses the guard. The handler is off by default, enabled with auto_page. The layout wrapping every page is already public, so this discloses one of the application's other layouts. | ||||
| CVE-2026-93710 | 1 Perldancer | 1 Dancer2 | 2026-09-28 | 7.5 High |
| Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks. A hook that dies fires core.app.hook_exception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does not stop that cleanup, which discards the request, response and session the dispatcher has yet to read, so the refused route runs. The handler has to halt the response object by calling its halt method or setting is_halted: the halt keyword unwinds through with_return before cleanup runs. A check in a before hook is not enforced: the caller gets the refusal, while the route body runs and its writes land. | ||||
| CVE-2026-93711 | 1 Perldancer | 1 Dancer2 | 2026-09-28 | 6.5 Medium |
| Dancer2 versions before 2.2.0 for Perl do not strip CR and LF from response header names in headers_to_array. The routine removes CR and LF from each header value but not from the name. A name carrying them therefore reaches the PSGI server intact. A server that does not validate keys writes it to the wire, so the bytes after the CRLF arrive as their own header line. The application has to derive the header name from request data, not just the value. An attacker who controls that data adds their own headers and splits the response. | ||||
| CVE-2026-93712 | 1 Perldancer | 1 Dancer2 | 2026-09-28 | 7.5 High |
| Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler. The handler joins the request path onto public_dir without collapsing relative segments, and checks only that the result is a readable regular file. A request for `/../outside.txt` escapes public_dir, and percent-encoding the dots reaches the same file. The handler is off by default. An application is affected once it names File in route_handlers and sets static_handler to 0, which otherwise refuses a dot segment before the route runs. Any file the worker process can read is served to an unauthenticated request, including the application's config.yml above public_dir. | ||||
| CVE-2026-85653 | 2 Ajaydsouza, Wordpress-extensions | 2 Contextual Related Posts, Contextual Related Posts | 2026-09-28 | 6.4 Medium |
| The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'other_attributes' Block Parameter in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-88788 | 1 Wordpress-extensions | 1 Text Styler | 2026-09-28 | 6.8 Medium |
| The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a front-end style block, and does not verify that a user may edit the target post, allowing users with contributor-level access or above to store JavaScript that executes in the browser of anyone viewing the affected post, including administrators. | ||||
| CVE-2026-88815 | 1 Perl5-dbi | 1 Dbi | 2026-09-28 | 7.5 High |
| DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault. This is reachable in Perl using the sql_type_cast function: my $num = 42; DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 ); | ||||
| CVE-2026-101905 | 1 Axios | 1 Axios | 2026-09-28 | 7.4 High |
| Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request headers and bodies, including credentials, and return attacker-controlled responses while the URL appears legitimate. This issue is fixed in version 1.20.0. | ||||
| CVE-2026-77765 | 1 Wordpress-extensions | 1 Better Payment | 2026-09-28 | 5.3 Medium |
| The Better Payment WordPress plugin before 2.3.4 does not validate the submitted payment amount server-side against the merchant's configured fixed price before building the gateway charge, allowing unauthenticated users to pay an arbitrary reduced amount for a fixed-price item. | ||||
| CVE-2026-77766 | 1 Wordpress-extensions | 1 Directorist | 2026-09-28 | 4.3 Medium |
| The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not scope one of its REST collection endpoints to the requesting user, allowing users with a subscriber-level account to read every customer's order and payment records. Versions 8.8.1 to 8.9 are not affected. The endpoint was scoped correctly in 8.8.1 and the unscoped behaviour was reintroduced in 8.9.1. | ||||
| CVE-2026-80342 | 1 Wordpress-extensions | 1 Payment Plugins For Paypal Woocommerce | 2026-09-28 | 6.5 Medium |
| The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.27 does not verify that a PayPal order supplied in a payment request belongs to the WooCommerce order being paid unless that PayPal order has already been completed, allowing unauthenticated attackers to have another buyer's approved but uncaptured payment captured against an order of their own. | ||||
| CVE-2026-81338 | 1 Wordpress-extensions | 1 Masterstudy Lms | 2026-09-28 | 4.6 Medium |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding iframes, that can be leveraged for phishing and content spoofing against other users viewing the content. | ||||