Export limit exceeded: 402797 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (8512 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19245 | 2 Hkuds, Nanobot | 2 Nanobot, Nanobot | 2026-08-10 | 3.3 Low |
| A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool._prepare_command of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access. The exploit has been published and may be used. Upgrading to version 0.3.0 is sufficient to resolve this issue. This patch is called 4525. The affected component should be upgraded. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "The report concerns shell startup files reintroducing environment variables when command execution defaults to a login shell. The default was changed so exec does not use a login shell unless explicitly requested". | ||||
| CVE-2026-14221 | 2 Easy-appointments, Wordpress | 2 Easy Appointments, Wordpress | 2026-08-10 | 3.8 Low |
| The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to create, modify, and delete bookings. | ||||
| CVE-2026-14222 | 2 Easy-appointments, Wordpress | 2 Easy Appointments, Wordpress | 2026-08-10 | 3.8 Low |
| The Easy Appointments WordPress plugin before 3.12.28 does not perform any capability or nonce check in one of its connection-deletion actions, allowing users with contributor-level access to delete the booking configuration and disable the booking system. | ||||
| CVE-2026-71204 | 1 Dgtlmoon | 1 Changedetection.io | 2026-08-10 | 6.3 Medium |
| changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update. | ||||
| CVE-2026-31843 | 1 Goodoneuz | 1 Pay-uz | 2026-08-10 | 9.8 Critical |
| The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endpoint is exposed via Route::any without authentication middleware, enabling remote access without credentials. | ||||
| CVE-2026-66494 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-08 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically.. | ||||
| CVE-2026-19192 | 1 Deepcool | 1 Displayservice | 2026-08-08 | 7.8 High |
| A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit is now public and may be used. | ||||
| CVE-2026-67687 | 2026-08-07 | 8.8 High | ||
| Insecure Permissions vulnerability in ics-park v.2.0 allows a remote attacker to escalate privileges via the /system/role/save endpoint in RoleController.java and system/user/update endpoint in UserController.java | ||||
| CVE-2026-19244 | 1 Nanobot | 1 Nanobot | 2026-08-07 | 4.7 Medium |
| A vulnerability was detected in HKUDS nanobot up to 0.2.1. The affected element is the function connect_mcp_servers of the file nanobot/agent/tools/mcp.py of the component MCP enabledTools Scope Handler. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used. Upgrading to version 0.3.0 is sufficient to fix this issue. The patch is named 4436. You should upgrade the affected component. Multiple issues were reported to the project. They reacted with a high level of professionalism and kindness: "Both reports describe the same root cause: MCP resource and prompt wrappers could be registered outside the intended enabledTools scope. The registration boundary was corrected". | ||||
| CVE-2026-19210 | 1 Sourcecodester | 1 Photo Share Website | 2026-08-07 | 6.3 Medium |
| A vulnerability has been found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=save_upload. Such manipulation of the argument img[]/imgName[] leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-14943 | 2026-08-07 | 7.5 High | ||
| The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict REST API access to authenticated users when a specific option is enabled, allowing unauthenticated visitors to bypass the sitewide password gate and read otherwise-protected content and account identifiers via the REST API. This re-introduces a previously-fixed issue (CVE-2024-0437), which was patched in 2.6.7 and regressed in 2.6.8. | ||||
| CVE-2026-19065 | 1 Sourcecodester | 1 Online Examination Learning Management System | 2026-08-07 | 6.3 Medium |
| A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file upload_files.php. This manipulation causes unrestricted upload. The attack may be initiated remotely. | ||||
| CVE-2025-14561 | 1 Wso2 | 6 Wso2 Api Control Plane, Wso2 Api Manager, Wso2 Carbon Api Management Implementation and 3 more | 2026-08-07 | 9 Critical |
| In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments. | ||||
| CVE-2026-12584 | 2026-08-07 | 7.5 High | ||
| The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provider notifications for one of its payment methods before marking orders as paid, allowing unauthenticated attackers to forge a payment-confirmation callback and complete their own orders without paying. | ||||
| CVE-2026-15148 | 2 Wordpress, Wp-eventmanager | 2 Wordpress, Wp Event Manager | 2026-08-07 | 5.3 Medium |
| The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate payment reaching the merchant, including other users' bookings. | ||||
| CVE-2025-70962 | 1 Zositech | 1 Zosi C519m | 2026-08-07 | 7.5 High |
| Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials in the RTSP authentication mechanism. An attacker with network access can use the unchangeable default credentials to access the RTSP video stream, resulting in unauthorized viewing of camera footage. | ||||
| CVE-2026-15230 | 2 Wordpress, Yaycommerce | 2 Wordpress, Yaypricing | 2026-08-07 | 8.1 High |
| The YayPricing WordPress plugin before 3.5.7 does not perform capability checks on several of its REST API routes, relying only on a shared nonce, allowing any authenticated user such as a subscriber to overwrite the store's pricing configuration and to disclose private coupon codes. | ||||
| CVE-2026-56157 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 5.4 Medium |
| Improper access control in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-70447 | 1 Jenkins Project | 1 Jenkins Aws Codebuild Plugin | 2026-08-07 | 4.3 Medium |
| Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-57088 | 1 Microsoft | 6 Windows 10 1809, Windows Server 2019, Windows Server 2019 (server Core Installation) and 3 more | 2026-08-07 | 7.8 High |
| Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally. | ||||