Export limit exceeded: 376157 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376157 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15229 | 2 Pinpoint, Wordpress | 2 Pinpoint Booking System, Wordpress | 2026-08-11 | N/A |
| The Pinpoint Booking System WordPress plugin through 2.9.9.6.9 does not validate the booking price on the server side, allowing unauthenticated users to create bookings at an arbitrary price (including zero) and, by selecting a specific payment method, obtain an instantly-approved reservation. | ||||
| CVE-2026-19089 | 2 Tychesoftwares, Wordpress | 2 Product Input Fields For Woocommerce, Wordpress | 2026-08-11 | N/A |
| The Product Input Fields for WooCommerce WordPress plugin before 2.0.2 does not validate uploaded file types when its accepted-types setting is left empty, which its own documentation advertises as accepting all files, allowing unauthenticated attackers to upload arbitrary files and achieve remote code execution on servers that do not honour the directory's access rules. | ||||
| CVE-2026-57279 | 1 Cybozu | 1 Cybozu Garoon | 2026-08-11 | N/A |
| Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product. | ||||
| CVE-2026-21078 | 1 Samsung | 1 Smart Switch | 2026-08-11 | N/A |
| Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity. | ||||
| CVE-2026-21079 | 1 Samsung | 1 Smart Switch | 2026-08-11 | N/A |
| Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data. | ||||
| CVE-2026-21080 | 1 Samsung | 1 Smart Switch | 2026-08-11 | N/A |
| Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | ||||
| CVE-2026-21083 | 1 Samsung | 1 Smart Switch | 2026-08-11 | N/A |
| Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data. | ||||
| CVE-2026-21084 | 1 Samsung | 1 Smartthings | 2026-08-11 | N/A |
| Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information. | ||||
| CVE-2026-72577 | 1 Nasa | 1 Fprime | 2026-08-11 | 9.8 Critical |
| Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprime_gds/flask/app.py applies no authentication to any endpoint. | ||||
| CVE-2026-72585 | 1 Grafana | 1 Grafana | 2026-08-11 | 6.5 Medium |
| An authorization bypass vulnerability in Grafana through 13.2.0 allows an Editor-role user to delete protected contact points (receivers) without the required alert.notifications.receivers.protected:write permission. | ||||
| CVE-2026-59686 | 1 Progress | 6 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 3 more | 2026-08-11 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise. | ||||
| CVE-2026-59687 | 1 Progress | 6 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 3 more | 2026-08-11 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise. | ||||
| CVE-2026-59688 | 1 Progress | 6 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 3 more | 2026-08-11 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise. | ||||
| CVE-2026-72598 | 2026-08-11 | 6.5 Medium | ||
| A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal network addresses by registering a webhook URL pointing to an internal host. The webhook registration endpoint validates URL syntax via FILTER_VALIDATE_URL but applies no IP or host denylist. When the registered event fires, the server issues an HTTP POST to the attacker-supplied internal URL. | ||||
| CVE-2026-59689 | 1 Progress | 6 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 3 more | 2026-08-11 | 8 High |
| An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise. | ||||
| CVE-2026-72748 | 1 Wwbn | 1 Avideo | 2026-08-11 | 9.1 Critical |
| AVideo contains an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint that allows remote attackers to write up to 4 GB of arbitrary content to the server filesystem via HTTP PUT requests without authentication. Attackers can exhaust disk space causing denial of service, poison the video encoding pipeline, or chain this with local file inclusion to achieve remote code execution. | ||||
| CVE-2026-59690 | 2 Process Software, Progress | 8 Multi Tenant, Connection Manager For Objectscale, Ecs Connection Manager and 5 more | 2026-08-11 | 8 High |
| A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise. | ||||
| CVE-2026-2299 | 1 Mattermost | 2 Google Drive, Mattermost Google Drive Plugin | 2026-08-11 | 4.2 Medium |
| The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose private channel membership. | ||||
| CVE-2026-72764 | 1 N8n | 1 N8n | 2026-08-11 | N/A |
| n8n's JavaScript task runner shared a single module cache across all users' Code-node executions. In affected versions (before 1.123.67, 2.31.5, and 2.32.1), a user able to run a Code node could poison a cached module and thereby alter other users' Code-node executions on the same runner, affecting their confidentiality, integrity, or availability. This is a cross-user isolation break within a single n8n instance and does not constitute a sandbox escape or remote code execution. Only multi-user instances running the JS task runner with built-in or external modules enabled are affected. | ||||
| CVE-2026-72769 | 1 N8n | 1 N8n | 2026-08-11 | N/A |
| n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the VM expression engine. An authenticated user able to create or edit a workflow expression can abuse the engine's array-element access to obtain a reference to a host built-in and pollute its prototype in the main n8n process (a sandbox escape), leading to a denial of service. Both self-hosted and cloud instances running the VM expression engine are affected. | ||||