Export limit exceeded: 364042 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (364042 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76372 | 1 Splunk | 1 Nmap Scanner | 2026-08-20 | 6.6 Medium |
| In Nmap Scanner versions below 3.0.15, a user who holds a role that can edit, create, or run playbooks in Splunk SOAR could run the scan network action in a Safe Mode playbook while that action is listed as read-only, which could allow for command execution or other changes on a target system through Nmap Scripting Engine scripts. The vulnerability is possible because the Nmap Scanner connector action manifest classifies the scan network action as read-only even though the action accepts script parameters that can perform write operations. For more information see Manage settings for a playbook in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-cloud/build-playbooks/manage-playbooks-and-playbook-settings/manage-settings-for-a-playbook-in-splunk-soar-cloud) in the Splunk documentation. | ||||
| CVE-2026-74011 | 2 Revmakx, Wordpress | 2 Infinitewp Client, Wordpress | 2026-08-20 | 7.6 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in revmakx InfiniteWP Client allows Blind SQL Injection. This issue affects InfiniteWP Client: from n/a through 1.13.9. | ||||
| CVE-2026-73993 | 2 Roxnor, Wordpress | 2 Fundengine, Wordpress | 2026-08-20 | 9.8 Critical |
| Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions. | ||||
| CVE-2026-73992 | 2 Jonathan Daggerhart, Wordpress | 2 Query Wrangler, Wordpress | 2026-08-20 | 9.9 Critical |
| Subscriber Remote Code Execution (RCE) in Query Wrangler <= 1.5.57 versions. | ||||
| CVE-2026-68566 | 2 Repute Infosystems, Wordpress | 2 Bookingpress Appointment Booking Pro, Wordpress | 2026-08-20 | 9.3 Critical |
| Unauthenticated SQL Injection in BookingPress Appointment Booking Pro <= 6.0.2 versions. | ||||
| CVE-2026-66682 | 2 Tychesoftwares, Wordpress | 2 Abandoned Cart Pro For Woocommerce, Wordpress | 2026-08-20 | 9.8 Critical |
| Unauthenticated Privilege Escalation in Abandoned Cart Pro for WooCommerce <= 10.4.0 versions. | ||||
| CVE-2026-66649 | 2 E-plugins, Wordpress | 2 Directory Pro, Wordpress | 2026-08-20 | 9.3 Critical |
| Unauthenticated SQL Injection in Directory Pro <= 2.5.8 versions. | ||||
| CVE-2026-66615 | 2 Eric Teubert, Wordpress | 2 Podlove Podcast Publisher, Wordpress | 2026-08-20 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Podlove Podcast Publisher <= 4.5.4 versions. | ||||
| CVE-2026-66600 | 2 Davidlingren, Wordpress | 2 Media Library Assistant, Wordpress | 2026-08-20 | 9.1 Critical |
| Author Arbitrary File Upload in Media LIbrary Assistant <= 3.39 versions. | ||||
| CVE-2026-66597 | 2 Melograno Venture Studio, Wordpress | 2 Wpdatatables, Wordpress | 2026-08-20 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in wpDataTables <= 6.5.1.4 versions. | ||||
| CVE-2026-66582 | 2 Cozmoslabs, Wordpress | 2 Translatepress, Wordpress | 2026-08-20 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in TranslatePress <= 3.3.2 versions. | ||||
| CVE-2026-63016 | 1 Apache | 1 Inlong | 2026-08-20 | 5.3 Medium |
| Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12095 https://github.com/apache/inlong/pull/11732 | ||||
| CVE-2026-28150 | 2 Uxper, Wordpress | 2 Golo Framework, Wordpress | 2026-08-20 | 8.1 High |
| Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions. | ||||
| CVE-2026-17015 | 1 Ibm | 1 I | 2026-08-20 | 5.4 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service and obtain sensitive information due to an out-of-bounds read. | ||||
| CVE-2026-14951 | 1 Frauscher Sensortechnik | 1 Fds 102 | 2026-08-20 | 8 High |
| An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages. | ||||
| CVE-2025-15688 | 2 Themegoods, Wordpress | 2 Capella, Wordpress | 2026-08-20 | 9.3 Critical |
| Unauthenticated SQL Injection in Capella <= 2.5.5 versions. | ||||
| CVE-2026-76233 | 1 Renovatebot | 1 Renovate | 2026-08-20 | 6.7 Medium |
| Renovate versions from 39.53.0 before 40.33.0 contain a command injection vulnerability in the gleam manager where the depName parameter is appended to gleam deps update commands without proper sanitization. Attackers with repository write access can craft malicious gleam.toml files to execute arbitrary commands on the machine running Renovate. | ||||
| CVE-2026-76244 | 1 Eidetic-labs | 1 Stigmem | 2026-08-20 | N/A |
| stigmem-node contains an insecure default configuration vulnerability that allows federation traffic to traverse networks without mTLS protection when non-loopback endpoints are enabled. Operators who explicitly disabled mTLS while binding federation to non-loopback addresses expose federation traffic to cleartext interception and man-in-the-middle attacks. | ||||
| CVE-2026-54117 | 1 Microsoft | 7 Microsoft Sql Server 2025 (cu 2), Microsoft Sql Server 2025 For X64-based Systems (gdr), Sql Server 2016 and 4 more | 2026-08-20 | 9.8 Critical |
| Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-54118 | 1 Microsoft | 15 Microsoft Sql Server 2016 Service Pack 3 (gdr), Microsoft Sql Server 2016 Service Pack 3 Azure Connect Feature Pack, Microsoft Sql Server 2017 (cu 31) and 12 more | 2026-08-20 | 9.8 Critical |
| Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | ||||