Export limit exceeded: 47608 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47608 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-57717 | 2 Knit Pay, Wordpress | 2 Knit Pay, Wordpress | 2026-08-02 | 6.5 Medium |
| Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. | ||||
| CVE-2026-59525 | 2 Rolandbarkerxnauwebdesign, Wordpress | 2 Participants Database, Wordpress | 2026-08-02 | 9.3 Critical |
| Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. | ||||
| CVE-2026-61943 | 2 Shahjada, Wordpress | 2 Wpdm Premium Packages, Wordpress | 2026-08-02 | 7.5 High |
| Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. | ||||
| CVE-2026-61948 | 2 Shahjada, Wordpress | 2 Wpdm Premium Packages, Wordpress | 2026-08-02 | 9.3 Critical |
| Unauthenticated SQL Injection in WPDM – Premium Packages <= 6.2.0 versions. | ||||
| CVE-2026-65454 | 2 Expresstech, Wordpress | 2 Quiz And Survey Master, Wordpress | 2026-08-02 | 8.5 High |
| Contributor SQL Injection in Quiz And Survey Master <= 11.2.0 versions. | ||||
| CVE-2026-65468 | 2 Crocoblock, Wordpress | 2 Jetbooking, Wordpress | 2026-08-02 | 5.3 Medium |
| Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. | ||||
| CVE-2026-65469 | 2 Strategy11, Wordpress | 2 Awp Classifieds, Wordpress | 2026-08-02 | 5.3 Medium |
| Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. | ||||
| CVE-2026-65478 | 2 Cridio, Wordpress | 2 Listingpro, Wordpress | 2026-08-02 | 5.4 Medium |
| Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. | ||||
| CVE-2026-65494 | 2 Dokan, Wordpress | 2 Dokan, Wordpress | 2026-08-02 | 7.1 High |
| Subscriber SQL Injection in Dokan Pro <= 5.0.2 versions. | ||||
| CVE-2026-65499 | 2 Peprodev, Wordpress | 2 Peprodev Ultimate Invoice, Wordpress | 2026-08-02 | 6.5 Medium |
| Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions. | ||||
| CVE-2026-65506 | 2 Sonaar, Wordpress | 2 Mp3 Audio Player For Music, Radio & Podcast, Wordpress | 2026-08-02 | 5.3 Medium |
| Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions. | ||||
| CVE-2026-63221 | 1 Codeigniter | 1 Codeigniter | 2026-08-02 | 9.4 Critical |
| CodeIgniter is a PHP full-stack web framework. From 4.3.0 through 4.7.3, Query Builder deleteBatch() substitutes bound values from where() conditions into generated SQL while ignoring their escape flags, allowing user-controlled condition values to be interpreted as SQL. This affects only the deleteBatch() code path. Regular delete() operations escape where() binds correctly. This issue is fixed in version 4.7.4. | ||||
| CVE-2026-17347 | 1 Pgadmin | 1 Pgadmin 4 | 2026-08-02 | 7.5 High |
| The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the command string and executed the result with subprocess.Popen(..., shell=True). Because the username can originate from an external authentication source (OAuth/OIDC claims, Kerberos, webserver auth) rather than a value pgAdmin fully controls, a username containing shell metacharacters (';', '$()', backticks, pipes, '&&', newlines) allowed an authenticated user to execute arbitrary commands as the pgAdmin service account in any deployment where the configured hook string uses %u. Fix tokenises the trusted, administrator-configured hook string into an argument vector first (using shlex in POSIX-quoting mode, with backslash-escaping disabled so Windows-style paths are not mis-parsed), substitutes the untrusted username into the individual argv elements, and executes with shell=False. The username is therefore always confined to a single argv element; any shell metacharacters it contains are inert. Administrators whose MASTER_PASSWORD_HOOK previously relied on shell features (pipes, redirection, environment-variable expansion, globbing) within the hook string itself must move that logic into the invoked script, since it is no longer interpreted by a shell. This issue affects pgAdmin 4: from 7.2 before 9.17. | ||||
| CVE-2026-17351 | 1 Pgadmin | 1 Pgadmin 4 | 2026-08-02 | 9 Critical |
| The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing can disagree with PostgreSQL's own parser: under standard_conforming_strings = on (PostgreSQL's default since 9.1), a backslash immediately before a quote is an ordinary character to PostgreSQL, but sqlparse treats it as escaping the quote. A payload such as SELECT '\';COMMIT;CREATE TABLE pwn(x int);SELECT 1 --' therefore parses as a single SELECT to sqlparse's validator, while PostgreSQL executes it as four statements: the smuggled COMMIT ends the wrapping read-only transaction, and the trailing ROLLBACK becomes a no-op. This reintroduces the same write/RCE bypass CVE-2026-12045 was meant to close, reachable via the same indirect prompt-injection delivery (an attacker plants the payload in any object the AI Assistant may read; the LLM emits it as a tool call). An initial candidate fix ran the query with psycopg's execute(..., prepare=True), intending to force PostgreSQL's own Parse step (extended query protocol) to reject multi-statement text regardless of sqlparse's classification. This candidate fix does not work as submitted: psycopg3's PrepareManager silently ignores the prepare argument whenever the connection's prepare_threshold is None, which is pgAdmin's default for every server connection (the per-server "Prepare threshold" field is blank unless an administrator explicitly sets it) -- psycopg3 falls back to the simple query protocol, the same multi-statement-capable path the bypass exploits, so the candidate fix closes nothing on any real-world default configuration. The corrected fix sets conn.prepare_threshold = 0 directly on the dedicated, single-use read-only connection the AI Assistant tool opens, structurally forcing the extended query protocol independent of any server-level configuration. Verified against a live PostgreSQL 18 instance: the payload executes successfully under the prepare_threshold=None (default) behavior, and is rejected with "cannot insert multiple commands into a prepared statement" once prepare_threshold=0 is set on that connection. This issue affects pgAdmin 4: from 9.13 before 9.17. | ||||
| CVE-2026-16420 | 1 Google | 1 Chrome | 2026-08-02 | 8.8 High |
| Type Confusion in WebAudio in Google Chrome prior to 150.0.7871.182 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-65908 | 1 Jetbrains | 1 Pycharm | 2026-08-02 | 8.6 High |
| In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open | ||||
| CVE-2026-64491 | 1 Linux | 1 Linux Kernel | 2026-08-02 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: ALSA: usx2y: us144mkii: fix work UAF on disconnect tascam_disconnect() cancels capture_work and midi_in_work before usb_kill_anchored_urbs() kills the capture/MIDI-in URBs. Those URBs self-resubmit, and their completion handlers reschedule the work. A URB that completes in the small window between cancel_work_sync() and usb_kill_anchored_urbs() therefore re-arms the work after its only cancel. Nothing cancels it again before snd_card_free() frees the card-private tascam structure, so the work handler then runs on freed memory. Kill the anchored URBs before cancelling the work; once the work is cancelled no remaining URB can complete to re-arm it. | ||||
| CVE-2025-69945 | 1 Hospital Management System | 1 Hospital Management System | 2026-08-02 | 7.3 High |
| kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1. | ||||
| CVE-2025-69942 | 1 Campcodes | 1 Hospital Management System | 2026-08-02 | 9.8 Critical |
| kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1. | ||||
| CVE-2026-58046 | 1 Webpros | 1 Plesk | 2026-08-02 | 9.9 Critical |
| Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel. | ||||