Export limit exceeded: 419920 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (108704 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-58378 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-09-01 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-74835 | 1 Erlang | 3 Erlang/otp, Erlang\/otp, Otp | 2026-09-01 | 7.5 High |
| The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown. | ||||
| CVE-2026-73812 | 1 Erlang | 3 Erlang/otp, Erlang\/otp, Otp | 2026-09-01 | 8.2 High |
| httpd function check_header/3 rejects duplicate Content-Length (per CVE-2026-23941) but never checks for the TE+CL co-presence that RFC 9112 §6.3 identifies as a probable smuggling attempt. handle_body/3 frames by chunked and silently discards Content-Length. A CL-preferring front-end paired with chunked-preferring inets creates a classic CL.TE front-end/back-end desync. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Whether OTP before OTP 17.0, corresponding to inets before 5.10, is affected is unknown. | ||||
| CVE-2026-75418 | 2026-09-01 | 7.5 High | ||
| A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials. | ||||
| CVE-2026-81287 | 2 Syed Balkhi, Wordpress | 2 Charitable, Wordpress | 2026-09-01 | 8.5 High |
| Subscriber SQL Injection in Charitable <= 1.8.12.1 versions. | ||||
| CVE-2026-81768 | 2 Highwarden, Wordpress | 2 Super Store Finder, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. | ||||
| CVE-2026-81297 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Forms Pro Add On Pack | 2026-09-01 | 7.5 High |
| Subscriber Privilege Escalation in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | ||||
| CVE-2026-82228 | 2 Siteground, Wordpress | 2 Siteground Security, Wordpress | 2026-09-01 | 8.1 High |
| Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. | ||||
| CVE-2026-82225 | 2 Metagauss, Wordpress | 2 Registrationmagic, Wordpress | 2026-09-01 | 7.4 High |
| Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions. | ||||
| CVE-2026-82921 | 1 Shopex | 1 Ecshop | 2026-09-01 | 7.3 High |
| A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-75921 | 2 Pixarlabs, Wordpress | 2 Master Addons For Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits, Wordpress | 2026-09-01 | 7.2 High |
| The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.9 via the upload_template_kit function. This is due to incorrect authorization on the upload_template_kit() AJAX handler, which requires only upload_files capability instead of the manage_options required by all sibling handlers, combined with missing per-entry file type filtering after ZIP extraction. This makes it possible for authenticated attackers, with editor-level access and above, to upload files that may be executable, which makes remote code execution possible. Editors can satisfy the nonce requirement because the required nonces are localized on the standard Pages list screen, which is accessible to any user with the edit_pages capability. | ||||
| CVE-2026-19573 | 2 Wordpress, Worschtebrot | 2 Wordpress, Affiliate Super Assistent | 2026-09-01 | 7.2 High |
| The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-19513 | 2 Gravityforms, Wordpress | 2 Gravity Forms, Wordpress | 2026-09-01 | 8.1 High |
| The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.0.2. This is due to insufficient validation of multi-file upload chunk state in the `GFAsyncUpload::upload()` function, where public form state URL hashes can be reused as chunk continuation hashes and attacker-controlled temporary filenames are accepted before sanitization. This makes it possible for unauthenticated attackers, when a public form contains a File Upload field with Multiple Files enabled, to upload a valid PNG/PDF polyglot to an attacker-selected public `.php` or `.html` filename in the Gravity Forms temporary upload directory. This can lead to remote code execution on WordPress systems that use NGINX or other non `.htaccess` respecting web servers. NOTE: During installation and activation, the Gravity Forms plugin places a `.htaccess` file in this directory, which prevents this vulnerability from being exploited despite the PHP file being written to the temporary upload directory. In these cases where PHP execution is blocked, attacker-written HTML can result in stored same-origin cross-site scripting if a victim visits the generated file URL. | ||||
| CVE-2026-84059 | 1 Icp Das | 2 Ua-2200, Ua-5200 | 2026-09-01 | 7.4 High |
| A flaw has been found in ICP DAS UA-2200 and UA-5200 up to 20260704. The affected element is the function ArmAngstromInstructionSet of the file /CGI?RestApi=SetHostname. Executing a manipulation of the argument ParameterArray can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84111 | 1 Chanjet | 1 Crm | 2026-09-01 | 7.3 High |
| A flaw has been found in Chanjet CRM up to 20260707. This issue affects some unknown processing of the file jxf_dump_table.php. This manipulation of the argument gblOrgID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84115 | 1 Cleo | 1 Harmony | 2026-09-01 | 8.3 High |
| A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Upgrading to version 5.8.1.11 is sufficient to fix this issue. It is recommended to upgrade the affected component. | ||||
| CVE-2026-19914 | 2 Uscnanbu, Wordpress | 2 Welcart E-commerce, Wordpress | 2026-09-01 | 7.2 High |
| The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_order' parameter in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is delivered via the guest checkout form, requiring no authentication, and executes when an administrator views the affected order in the WordPress admin panel. | ||||
| CVE-2026-19952 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-09-01 | 7.5 High |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the move_folders function in all versions up to, and including, 3.29.12. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This is exploitable without authentication when a form is configured with public visibility (who_can_see='all'), as the required nonce is publicly obtainable from the rendered form. | ||||
| CVE-2026-19796 | 2 Webilia, Wordpress | 2 Listdom: Ai-powered Business Directory With Classifieds Ads Listings, Wordpress | 2026-09-01 | 7.2 High |
| The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter in all versions up to, and including, 5.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Listdom Pro add-on to be active and the 'Display Options Per Listing' displ setting to be enabled, both of which are non-default configurations. | ||||
| CVE-2026-64773 | 1 Apple | 1 Container | 2026-09-01 | 7.5 High |
| An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0. | ||||