Export limit exceeded: 411202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 411202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 411202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 411202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 411202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 411202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (411202 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-52713 | 2 Thimpress, Wordpress-extensions | 2 Learnpress, Learnpress | 2026-11-07 | 5.4 Medium |
| Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.12. | ||||
| CVE-2026-121724 | 2 Webberzone, Wordpress-extensions | 2 Contextual Related Posts, Contextual Related Posts | 2026-11-07 | 4.3 Medium |
| Missing Authorization vulnerability in WebberZone Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contextual Related Posts: from n/a through 4.5.3. | ||||
| CVE-2026-123861 | 2026-11-07 | 5.3 Medium | ||
| Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select jet-form-builder-hierarchical-select allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder – Hierarchical Select: from n/a through 1.0.10. | ||||
| CVE-2026-123964 | 1 Openbmb | 1 Internet Of Agents | 2026-11-07 | 4.3 Medium |
| A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function launch_goal of the file im_client/communication/communication_layer.py of the component Collaboration Layer. Performing a manipulation of the argument max_turns results in infinite loop. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-120839 | 2026-11-07 | 8.8 High | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8. | ||||
| CVE-2026-120841 | 2026-11-07 | 8.8 High | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows PHP Local File Inclusion.This issue affects WpTravelly: from n/a through 2.3.8. | ||||
| CVE-2026-123467 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.128. | ||||
| CVE-2026-121777 | 2026-11-07 | 5.3 Medium | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool Formkit Lite extensions-for-elementor-form allows Code Injection.This issue affects Cool Formkit Lite: from n/a through 2.7.10. | ||||
| CVE-2026-122659 | 2026-11-07 | 5.4 Medium | ||
| Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0. | ||||
| CVE-2026-121579 | 2026-11-07 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Stored XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26. | ||||
| CVE-2026-121575 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4. | ||||
| CVE-2026-122660 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5. | ||||
| CVE-2026-123183 | 2026-11-07 | 5.3 Medium | ||
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active Products Tables for WooCommerce profit-products-tables-for-woocommerce allows Code Injection.This issue affects Active Products Tables for WooCommerce: from n/a through 2.1.6. | ||||
| CVE-2026-123474 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress premium-blocks-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Blocks – Gutenberg Blocks for WordPress: from n/a through 2.3.18. | ||||
| CVE-2026-121775 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20. | ||||
| CVE-2026-123462 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-122669 | 2026-11-07 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.3. | ||||
| CVE-2026-122663 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20. | ||||
| CVE-2026-121784 | 2026-11-07 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. WpBookingly service-booking-manager allows Stored XSS.This issue affects WpBookingly: from n/a through 1.4.3. | ||||
| CVE-2026-123959 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-07 | 9.1 Critical |
| A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.884. The impacted element is the function setLanguageCfg of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument langType results in buffer overflow. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. | ||||