Export limit exceeded: 413959 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10925 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102317 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-30 | 8.6 High |
| Improper privilege management in Mojo in Google Chrome on on Windows prior to 154.0.8037.92 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | ||||
| CVE-2025-13807 | 1 Orionsec | 2 Orion-ops, Orion Ops | 2026-09-30 | 4.3 Medium |
| A vulnerability was detected in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected is the function MachineKeyController of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/MachineKeyController.java of the component API. The manipulation results in improper authorization. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-13808 | 1 Orionsec | 2 Orion-ops, Orion Ops | 2026-09-30 | 7.3 High |
| A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Handler. This manipulation of the argument ID causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-97245 | 2026-09-30 | 7.2 High | ||
| Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. | ||||
| CVE-2026-96821 | 2026-09-30 | 6.3 Medium | ||
| Subscriber Privilege Escalation in FluentBoards <= 2.0.12 versions. | ||||
| CVE-2026-96815 | 2026-09-30 | 7.2 High | ||
| Custom role Privilege Escalation in Vitepos <= 3.5.0 versions. | ||||
| CVE-2026-96350 | 2026-09-30 | 9.8 Critical | ||
| Subscriber Privilege Escalation in Estatik <= 4.3.5 versions. | ||||
| CVE-2026-94178 | 2026-09-30 | 7.5 High | ||
| Subscriber Privilege Escalation in Import and export users and customers <= 2.5.2 versions. | ||||
| CVE-2026-19915 | 1 Hp Inc. | 1 Hp Support Assistant | 2026-09-29 | N/A |
| A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.55.10.0. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls. | ||||
| CVE-2026-81810 | 2 Wordpress-extensions, Yaniiliev | 2 All In One Wp Migration And Backup, All In One Wp Migration And Backup | 2026-09-29 | 7.2 High |
| The All-in-One WP Migration and Backup WordPress plugin before 7.111 does not perform any capability check on several of its AJAX actions, gating them only on an installation-wide secret which it discloses to any user permitted to export the site, allowing such a user to import an arbitrary site archive and gain administrator access. Exploitation requires an administrator to have granted the export capability to a role that does not hold the All-in-One WP Migration and Backup WordPress plugin before 7.111's own import capability, which is not a default configuration. | ||||
| CVE-2026-101860 | 1 Raspap | 1 Raspap-webgui | 2026-09-29 | 8.8 High |
| A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-96882 | 1 Talelin | 1 Lin-cms-spring-boot | 2026-09-29 | 5.3 Medium |
| A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. The manipulation leads to improper authorization. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-96763 | 1 Kvcache-ai | 1 Mooncake | 2026-09-29 | 5.4 Medium |
| A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegmentAccess::MountSegment of the file segment.cpp of the component MountSegment Request Processing. Performing a manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-100586 | 1 Openclaw | 1 Openclaw | 2026-09-28 | 8.8 High |
| OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel senders with command access can create bindings to the native Codex runtime and execute host-capable turns with access to files, tools, and processes. | ||||
| CVE-2026-100578 | 1 Openclaw | 1 Openclaw | 2026-09-28 | 7.6 High |
| OpenClaw (npm package `openclaw`) before 2026.7.1 fails to restrict owner-only infrastructure tools exposed through the chat.send endpoint. In Gateway deployments using authentication modes that honor caller identity and narrower operator scopes, a write-scoped non-owner caller can start a chat turn whose tool inventory includes the `gateway` and `cron` tools, causing the agent to invoke owner-only configuration or scheduling operations, including persistent state changes. Practical impact depends on the tools selected by the model and the caller's ability to steer the turn. Shared-secret token and password callers are treated as fully trusted operators under OpenClaw's security model and are outside the scope of this issue. The issue is fixed in 2026.7.1; as a workaround, restrict chat.send to administrators in identity-bearing deployments and remove `gateway` and `cron` from affected agent tool policies. | ||||
| CVE-2026-76554 | 1 Wordpress-extensions | 1 Wp Import Export Lite | 2026-09-28 | 7.2 High |
| The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage users, to create administrator accounts and to overwrite the credentials and role of existing accounts, including administrators. | ||||
| CVE-2026-82842 | 1 Wordpress-extensions | 1 Saml Single Sign On | 2026-09-28 | 8.1 High |
| The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identity to a WordPress account, always resolving the identity by login name whatever the site has chosen, which allows an attacker who can have the site's identity provider assert a login name of their choosing to authenticate as any account, including an administrator, without proving ownership of that account. | ||||
| CVE-2026-87068 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-09-28 | 6.6 Medium |
| The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is nested inside an imported quiz, allowing a user who may import quizzes to publish a live, publicly reachable form that grants any role, including administrator, to anyone who submits it. The same user is refused an identical form through both the ordinary form editor and the ordinary form import. | ||||
| CVE-2026-92540 | 1 Wordpress-extensions | 1 Import And Export Users And Customers | 2026-09-28 | 7.2 High |
| The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigning roles during a CSV import, allowing users with only the create_users capability to create new administrator accounts or promote existing users to administrator. | ||||
| CVE-2026-92541 | 1 Wordpress-extensions | 1 Import And Export Users And Customers | 2026-09-28 | 7.2 High |
| The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end import functionality, allowing users with only the create_users capability to change the role of existing users, including promoting them to administrator. | ||||