Export limit exceeded: 414160 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414160 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112863 | 2026-10-24 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0. | ||||
| CVE-2026-112859 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. | ||||
| CVE-2026-112858 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. | ||||
| CVE-2026-112856 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. | ||||
| CVE-2026-112855 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. | ||||
| CVE-2026-112854 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. | ||||
| CVE-2026-112852 | 2026-10-24 | 8.1 High | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. | ||||
| CVE-2026-112851 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. | ||||
| CVE-2026-112850 | 2026-10-24 | 8.1 High | ||
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1. | ||||
| CVE-2026-112848 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. | ||||
| CVE-2026-112847 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. | ||||
| CVE-2026-112846 | 2026-10-24 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. | ||||
| CVE-2026-112844 | 2 Arraytics, Wordpress-extensions | 2 Wp Event Solution, Wp Event Solution | 2026-10-24 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26. | ||||
| CVE-2026-112207 | 1 Wordpress-extensions | 1 Download Monitor | 2026-10-24 | 7.1 High |
| The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link. | ||||
| CVE-2026-111402 | 2 Tribulant, Wordpress-extensions | 2 Newsletters, Newsletters | 2026-10-24 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Software Newsletters newsletters-lite allows SQL Injection.This issue affects Newsletters: from n/a through 4.18.1. | ||||
| CVE-2026-110956 | 2026-10-24 | 9.8 Critical | ||
| The asVereinbase WordPress plugin before 1.1.8 does not require a valid password or a genuine second factor before authenticating a user, treating an empty stored value as a match, so an unauthenticated attacker can log in as any user, including an administrator. | ||||
| CVE-2026-110892 | 3 Brainstorm Force, Brainstormforce, Wordpress-extensions | 3 Suredash, Suredash, Suredash | 2026-10-24 | 6.5 Medium |
| Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureDash: from n/a through 1.12.2. | ||||
| CVE-2026-116010 | 2 Francoisjacquet, Rosariosis | 2 Rosariosis, Rosariosis | 2026-10-24 | 4.3 Medium |
| RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school. | ||||
| CVE-2026-83897 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-24 | 4.7 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Win32 Kernel Subsystem allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-85872 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-24 | 7.8 High |
| Use after free in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. | ||||