Export limit exceeded: 414342 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414342 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 414342 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414342 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-27371 | 2 Getwpfunnels, Wordpress-extensions | 2 Wpfunnels, Wpfunnels | 2026-11-10 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | ||||
| CVE-2026-97271 | 2 Getwpfunnels, Wordpress-extensions | 2 Wpfunnels, Wpfunnels | 2026-11-10 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | ||||
| CVE-2026-97286 | 2 Wordpress-extensions, Wpchill | 2 Strong Testimonials, Strong Testimonials | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11. | ||||
| CVE-2026-97287 | 2 Nexcess, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-11-10 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5. | ||||
| CVE-2026-97289 | 2 Expresstech, Wordpress-extensions | 2 Quiz And Survey Master, Quiz And Survey Master | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6. | ||||
| CVE-2026-103079 | 2 Ahmad, Wordpress-extensions | 2 Js Help Desk, Js Help Desk | 2026-11-10 | 5.4 Medium |
| Authorization Bypass Through User-Controlled Key vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JS Help Desk: from n/a through 4.0.0. | ||||
| CVE-2026-105891 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-11-10 | 4.3 Medium |
| Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | ||||
| CVE-2026-105893 | 2 Liquid Web / Stellarwp, Wordpress-extensions | 2 Event Tickets, Event Tickets | 2026-11-10 | 5.3 Medium |
| Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1. | ||||
| CVE-2026-95127 | 1 Libass | 1 Libass | 2026-11-10 | 7.5 High |
| An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c | ||||
| CVE-2026-75826 | 1 Teltonika-networks | 14 Atrm, Cap, Dap and 11 more | 2026-11-10 | N/A |
| Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands. | ||||
| CVE-2026-109697 | 2 Brainstormforce, Wordpress-extensions | 2 Surecart, Surecart | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4. | ||||
| CVE-2026-20183 | 2026-11-10 | 4.3 Medium | ||
| A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An attacker could exploit this vulnerability by submitting a crafted HTTP request to an affected system. A successful exploit could allow the attacker to modify descriptions of files on a specific page. To exploit this vulnerability, an attacker would need valid Administrator credentials. | ||||
| CVE-2026-57084 | 1 Microsoft | 29 Office, Office 365, Office Macos 2021 and 26 more | 2026-11-10 | 5.5 Medium |
| Use of uninitialized resource in Windows File Explorer allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-57083 | 1 Microsoft | 28 Office, Office 365, Office Macos 2021 and 25 more | 2026-11-10 | 5.5 Medium |
| Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-92091 | 1 Redhat | 5 Ansible Automation Platform, Enterprise Linux, Openshift Ai and 2 more | 2026-11-10 | 5.9 Medium |
| A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service. | ||||
| CVE-2026-50301 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-11-10 | 8.4 High |
| Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-45489 | 1 Microsoft | 1 Edge Chromium | 2026-11-10 | 6.5 Medium |
| Exposed dangerous method or function in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-126187 | 2026-11-10 | N/A | ||
| React is a JavaScript library for building user interfaces. From 19.0.0 until 19.0.9, 19.1.10, 19.2.9, and 19.3.1, the react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages are vulnerable to unauthenticated remote code execution through crafted payloads targeting frameworks that support React Server Components. The vulnerability only affects extremely rare cases where responses transport multiple typed arrays and an attacker-controlled value. Applications whose React code does not use a server are not affected. Applications that do not use a framework, bundler, or bundler plugin that supports React Server Components are not affected. This issue is fixed in versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1. | ||||
| CVE-2024-36309 | 2026-11-10 | N/A | ||
| Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally disabled device as part of a remapping attack potentially impacting data confidentiality, integrity, or availability. | ||||
| CVE-2026-126261 | 1 Fortinet | 1 Fortimanager | 2026-11-10 | 9 Critical |
| A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets. | ||||