Export limit exceeded: 425803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95359 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-77263 | 2 Iubenda, Wordpress | 2 Iubenda | All-in-one Compliance For Gdpr / Ccpa Cookie Consent + More, Wordpress | 2026-09-08 | 7.2 High |
| The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit works by embedding KSES-allowed markup such as abbr title attributes and HTML comments in a submitted comment so that the global strtr() substitution strips substrings from an inert tag, mutating it into an executable element such as an img onerror handler that runs in the WordPress origin for any visitor, including logged-in administrators. | ||||
| CVE-2026-86711 | 2 Electerm, Electerm Project | 2 Electerm, Electerm | 2026-09-08 | 7.4 High |
| electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sender validation. Renderer-side script execution can invoke openFileWithEditor and other functions with arbitrary arguments to execute system commands in the main process. | ||||
| CVE-2026-86518 | 1 Code-projects | 1 Student Crud Operation | 2026-09-08 | 6.3 Medium |
| A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-86513 | 1 Java-json-tools | 1 Jackson-coreutils | 2026-09-08 | 5.3 Medium |
| A security flaw has been discovered in java-json-tools jackson-coreutils 2.0. This vulnerability affects the function TreePointer.tokensFromInput of the file src/main/java/com/github/fge/jackson/jsonpointer/TreePointer.java of the component JSON Pointer parser. The manipulation results in allocation of resources. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-86309 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-08 | 6.3 Medium |
| A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. | ||||
| CVE-2026-71376 | 1 Hitachi | 1 Cosminexus Component Container | 2026-09-08 | 9.8 Critical |
| OS command injection vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 before 11-00-13, from 09-87 before 09-87-10, from 09-80 before 09-80-05, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18. | ||||
| CVE-2026-2390 | 2 Codesupplyco, Wordpress | 2 Powerkit – Supercharge Your Wordpress Site, Wordpress | 2026-09-08 | 6.4 Medium |
| The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-86491 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads | ||||
| CVE-2026-86484 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 4.6 Medium |
| In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS | ||||
| CVE-2026-86483 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 5.4 Medium |
| In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible | ||||
| CVE-2026-86206 | 1 N-able | 1 N-central | 2026-09-08 | N/A |
| A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4 | ||||
| CVE-2026-84820 | 2 Unlimited-elements, Wordpress | 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Wordpress | 2026-09-08 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.17 versions. | ||||
| CVE-2026-84818 | 2 100plugins, Wordpress | 2 Open User Map, Wordpress | 2026-09-08 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions. | ||||
| CVE-2026-84817 | 2 Crocoblock, Wordpress | 2 Jetformbuilder, Wordpress | 2026-09-08 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions. | ||||
| CVE-2026-81798 | 2 Easy-appointments, Wordpress | 2 Easy Appointments, Wordpress | 2026-09-08 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1. | ||||
| CVE-2026-48888 | 2 Automattic, Wordpress | 2 Woocommerce, Wordpress | 2026-09-08 | 7.5 High |
| Allocation of Resources Without Limits or Throttling vulnerability in Automattic WooCommerce allows HTTP DoS. This issue affects WooCommerce: from n/a before 11.1.0. | ||||
| CVE-2025-40582 | 1 Siemens | 2 Scalance Lpe9403, Scalance Lpe9403 Firmware | 2026-09-08 | 7.8 High |
| A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V2.1 HF0 with SINEMA Remote Connect Edge Client installed). Affected devices do not properly sanitize configuration parameters. This could allow a non-privileged local attacker to execute root commands on the device. | ||||
| CVE-2026-54216 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-09-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting (XSS) vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the payload to execute in the victim’s browser when they click the link. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. | ||||
| CVE-2026-54212 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-09-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application implements an API endpoint that is vulnerable to a buffer overflow condition. By submitting a specially crafted JSON body, such as one that is at least 8 characters long and begins with a number, an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially lead to remote code execution and full compromise of the server. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. | ||||
| CVE-2026-54211 | 1 Tobit Laboratories Ag | 1 Teamdavid | 2026-09-07 | N/A |
| Tobit Laboratories AG TeamDavid's Webbox application’s endpoint “//serverClient_close.html” is vulnerable to a buffer overflow vulnerability in multiple form data parameters. By submitting excessively long values in these parameters, an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on the stack state or if a stack canary can be disclosed through another vulnerability, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server. This issue affects TeamDavid before Rollout 528. Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality. | ||||