Export limit exceeded: 37187 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (37187 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-60033 | 1 Themexpert.com | 1 Jmedia Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses. | ||||
| CVE-2026-60030 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions. | ||||
| CVE-2026-60034 | 1 Themexpert.com | 1 Jmedia Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS. | ||||
| CVE-2026-60026 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default). | ||||
| CVE-2026-60029 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users. | ||||
| CVE-2026-60031 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses. | ||||
| CVE-2026-60027 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element. | ||||
| CVE-2026-61901 | 1 Hikashop.com | 1 Hikashop Extension For Joomla | 2026-07-23 | 6.1 Medium |
| Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect. | ||||
| CVE-2026-61900 | 1 Dj-extensions.com | 1 Jdownloads Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE. | ||||
| CVE-2026-61424 | 1 Dj-extensions.com | 1 Dj-classifieds Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE. | ||||
| CVE-2026-61425 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access. | ||||
| CVE-2026-13380 | 1 Vsee | 1 Clinic | 2026-07-23 | N/A |
| VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server. | ||||
| CVE-2026-47128 | 1 Always-further | 1 Nono | 2026-07-23 | 6.1 Medium |
| nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue. | ||||
| CVE-2026-57852 | 1 Trilby Media | 1 Grav Cms Scheduler-webhook Plugin | 2026-07-23 | 5.6 Medium |
| Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user. | ||||
| CVE-2023-37507 | 1 Hclsoftware | 1 Devops Plan | 2026-07-23 | N/A |
| HCL DevOps Plan is susceptible to an information disclosure that can allow an attacker to focus their attacks based upon the information revealed. | ||||
| CVE-2026-62415 | 1 Joomdonation.com | 1 Membership Pro Extension For Joomla | 2026-07-23 | 9.1 Critical |
| Joomla Extension - joomdonation.com - Insecure default configuration Membership Pro < 4.6.2 - The Joomla extension Membership Pro prior version 4.6.2 did by default allow unauthenticated users to upload media assets. | ||||
| CVE-2026-56577 | 1 Hclsoftware | 1 Mycloud | 2026-07-23 | 3.1 Low |
| HCL MyCloud was affected with Weak Password Policy. It may increase the risk of account compromise through brute-force or credential-based attacks. | ||||
| CVE-2026-56578 | 1 Hclsoftware | 1 Mycloud | 2026-07-23 | 2.2 Low |
| HCL MyCloud was affected by Server Version Disclosure. It may help attackers identify and exploit known vulnerabilities affecting the disclosed software versions. | ||||
| CVE-2026-56580 | 1 Hclsoftware | 1 Mycloud | 2026-07-23 | 2.2 Low |
| HCL MyCloud was affected by Using Components with Known Vulnerability ( IIS Server ). It may allow attackers to exploit publicly disclosed weaknesses and compromise the system. | ||||
| CVE-2026-44880 | 1 Hpe | 1 Aos-cx | 2026-07-23 | 8.8 High |
| A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation of these vulnerabilities could allow an remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system. | ||||