Export limit exceeded: 417693 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417693 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109215 | 2 Litespeedtech, Wordpress-extensions | 2 Litespeed Cache, Litespeed Cache | 2026-10-30 | 6.4 Medium |
| The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags. | ||||
| CVE-2026-104727 | 2 Berocket, Wordpress-extensions | 2 Sequential Order Numbers For Woocommerce, Sequential Order Numbers For Woocommerce | 2026-10-30 | 6.4 Medium |
| The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-116763 | 2 Litespeedtech, Wordpress-extensions | 2 Litespeed Cache, Litespeed Cache | 2026-10-30 | 5.4 Medium |
| The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page. | ||||
| CVE-2026-107743 | 2 Mapster, Wordpress-extensions | 2 Mapster Wp Maps, Mapster Wp Maps | 2026-10-30 | 7.2 High |
| The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-111419 | 1 Foxitsoftware | 1 Foxit.com | 2026-10-30 | 8.6 High |
| A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains third-party authorization information. This may allow unauthorized parties to obtain or misuse the exposed credentials. | ||||
| CVE-2026-111418 | 1 Foxitsoftware | 1 Foxit.com | 2026-10-30 | 7.5 High |
| A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service. Support for ZIP-formatted input can bypass restrictions on requests to internal IP addresses, potentially allowing discovery of internal network resources. | ||||
| CVE-2026-111417 | 1 Foxitsoftware | 1 Foxit.com | 2026-10-30 | 7.5 High |
| A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users. | ||||
| CVE-2026-115965 | 2 Buddypress, Wordpress-extensions | 2 Buddypress, Buddypress | 2026-10-30 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allows Blind SQL Injection.This issue affects BuddyPress: from n/a through 14.5.2. | ||||
| CVE-2026-114193 | 2 Eyal Fitoussi, Wordpress-extensions | 2 Geo My Wordpress, Geo My Wordpress | 2026-10-30 | 7.5 High |
| Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through 4.5.5.5. | ||||
| CVE-2026-97860 | 1 Yamaha | 2 Yms-vpn8, Yms-vpn8-cp | 2026-10-30 | N/A |
| YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges. | ||||
| CVE-2026-103665 | 1 Yamaha | 1 Yamaha Lan Monitor For Windows | 2026-10-30 | N/A |
| The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, resulting in arbitrary code execution with administrative privileges. | ||||
| CVE-2026-97854 | 1 Yamaha | 1 Nwr100 | 2026-10-30 | 9.8 Critical |
| Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product. | ||||
| CVE-2026-109822 | 1 Yamaha | 1 Nwr100 | 2026-10-30 | 6.5 Medium |
| Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker. | ||||
| CVE-2026-119027 | 1 Oapi-codegen | 1 Oapi-codegen | 2026-10-30 | 7.5 High |
| oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package. | ||||
| CVE-2026-119028 | 1 Oapi-codegen | 1 Oapi-codegen | 2026-10-30 | 8.8 High |
| oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enum entries in integer, number, or boolean schemas. Attackers controlling an OpenAPI document can craft an enum entry that closes the const block in constants.tmpl and injects a func init(), executing code when the generated package is built and imported. | ||||
| CVE-2026-93008 | 3 Dnsmasq, Red Hat, Redhat | 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more | 2026-10-30 | 6.8 Medium |
| A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names. | ||||
| CVE-2026-93011 | 3 Dnsmasq, Red Hat, Redhat | 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more | 2026-10-30 | 5.3 Medium |
| A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime. | ||||
| CVE-2026-93007 | 3 Dnsmasq, Red Hat, Redhat | 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more | 2026-10-30 | 5.3 Medium |
| A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime. | ||||
| CVE-2026-93006 | 3 Dnsmasq, Red Hat, Redhat | 8 Dnsmasq, Enterprise Linux, Ceph Storage and 5 more | 2026-10-30 | 6.8 Medium |
| A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine. | ||||
| CVE-2026-113688 | 1 Bmc | 1 Bmc It Service Management Suite | 2026-10-30 | N/A |
| Server-side request forgery in the SmartIT URL-based attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated users to make server-side requests to internal services and observe response information. | ||||