Export limit exceeded: 409359 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409359 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109208 | 2026-10-17 | 7.2 High | ||
| The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout. | ||||
| CVE-2026-111601 | 2026-10-17 | 6.1 Medium | ||
| The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The URL path regex constrains the path segment to word characters, but WP_REST_Request's query-string parameter precedence allows a ?token_id= value to override it and reach the handler verbatim, bypassing the regex constraint entirely. | ||||
| CVE-2026-104734 | 2026-10-17 | 7.2 High | ||
| The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.3.2 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. By default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint via the KIRKI_USERS_DEFAULT_FULL_ACCESS configuration, meaning exploitation is possible at Editor privilege level rather than being restricted to administrators alone. | ||||
| CVE-2026-107762 | 2026-10-17 | 7.5 High | ||
| The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.3.2 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to expose arbitrary users' sensitive profile data — including email address, display name, nicename, registration date, profile image URL, and any string-valued user meta fields such as first name, last name, nickname, description, and custom meta keys — via the REST response. Exploitation requires a published page that uses a Kirki template containing at least one user-type dynamic content block; target user IDs are enumerable via standard WordPress REST endpoints, making the only prerequisite the presence of such a template on the site. | ||||
| CVE-2026-107763 | 2026-10-17 | 4.3 Medium | ||
| The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to add or remove the plugin's page-cache rewrite rules in the site's root .htaccess file. | ||||
| CVE-2026-96915 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 7.8 High |
| Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-96924 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 9.8 Critical |
| Untrusted pointer dereference in Windows OLE allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96926 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-17 | 5.5 Medium |
| Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-102201 | 1 Microsoft | 17 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 14 more | 2026-10-17 | 7.8 High |
| Use after free in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103380 | 2 Latepoint, Wordpress-extensions | 2 Appointment Booking Plugin – Latepoint | Calendar & Scheduling For Wordpress, Appointment Booking Plugin | 2026-10-17 | 4.3 Medium |
| The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'params[customer][first_name]' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract privileged booking data including the administrator-only admin_notes field, assigned agent internal contact details, transaction tokens, and payment request URLs delivered via rendered notification emails. A LatePoint customer can exploit this by storing a template placeholder such as {{customer_admin_notes}} in their own first_name field via the customer_cabinet__update route, then triggering the password-reset email flow to receive the expanded value in the resulting notification. | ||||
| CVE-2026-103414 | 1 Eclipse | 1 Guix | 2026-10-17 | N/A |
| The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with independent cursor arithmetic. Because `gx_page_header_data_size` is never validated against the glyph data a page actually contains, the two passes can read different page headers for the same font page, derive different glyph counts, and reserve less than the load pass writes. The excess is written past the end of the arena, with content taken verbatim from the file. The overflowed buffer is allocated by GUIX itself, through `_gx_system_memory_allocator`, rather than supplied by the caller. The public API `gx_binres_theme_load()` takes no size parameter, so no amount of caller diligence prevents this. Reproduces in the shipped default configuration; `GX_BINARY_RESOURCE_SUPPORT` is enabled by default. | ||||
| CVE-2026-103415 | 1 Eclipse | 1 Netx Duo | 2026-10-17 | N/A |
| When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the cookie fits in the outgoing packet. Both the length and the contents of that cookie come from the peer, and the write happens before certificate authentication completes, so a malicious or compromised server can overwrite memory past the caller supplied TLS packet buffer without presenting a certificate. Only the client path is affected. | ||||
| CVE-2026-85371 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 8.1 High |
| Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96865 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-10-17 | 5.6 Medium |
| Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-96909 | 1 Microsoft | 13 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 10 more | 2026-10-17 | 9.8 Critical |
| Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-102354 | 1 Alam00000 | 1 Bentopdf | 2026-10-17 | 6.8 Medium |
| BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DNS-over-HTTPS safety check in hostnameResolvesToPrivate(), as used by isValidCertificateUrl() and isValidTsaUrl(), separately from the outbound fetch(targetUrl, ...). In deployments where PROXY_SECRET validation is not enabled, a direct client that controls authoritative DNS can forge the Origin header, supply a certificate, OCSP, CRL, or TSA URL that passes the proxy's accepted path checks, return a public address during validation, and return a private or link-local address during the later fetch. The endpoint can return allowed response bodies to the attacker, but exploitation requires precise timing, redirects and IP-literal obfuscation are blocked, and network reachability limits the target. This vulnerability is fixed in 2.8.7. | ||||
| CVE-2026-85792 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-17 | 9.8 Critical |
| Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine | ||||
| CVE-2026-102682 | 1 Pipecat-ai | 1 Pipecat | 2026-10-17 | 5.6 Medium |
| Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot sessions and Daily rooms. The runner binds to localhost by default and is intended only for local development, so exploitation requires an operator to expose it to untrusted traffic through --host 0.0.0.0, a published port, or a tunnel without access controls. An unauthenticated caller can consume local resources and third-party quotas and, depending on configuration, receive a room URL and join token. Version 1.6.0 adds a prominent development-runner banner and documentation that clarifies the unauthenticated boundary and directs production deployments to an authenticated dispatcher or managed runtime, while the endpoint behavior remains by design. This issue is fixed in version 1.6.0. | ||||
| CVE-2026-102756 | 1 Dataease | 1 Dataease | 2026-10-17 | N/A |
| DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users who can edit dataset fields and chart configuration can store an HTML-bearing dimension value in a bar-horizontal chart. When lengthLimit truncates the category axis label, configAxisLabelLengthLimit in core/core-frontend/src/views/chart/components/js/panel/common/common_antv.ts retrieves the full label and assigns it to the g2-tooltip-title element through innerHTML. A victim who opens the dashboard and hovers the truncated label can execute attacker-controlled JavaScript in the victim's DataEase session. This issue is fixed in version 2.10.26. | ||||
| CVE-2026-102755 | 1 Dataease | 1 Dataease | 2026-10-17 | N/A |
| DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users with folder creation permission can store HTML-bearing names through datasource/createFolder or datasetTree/save. The datasource and dataset Move to dialogs in core/core-frontend/src/views/visualized/data/datasource/form/CreatDsGroup.vue and core/core-frontend/src/views/visualized/data/dataset/form/CreatDsGroup.vue read the stored name from a node title attribute and assign search-highlighted content to innerHTML. When another user opens a Move to dialog and types in its search box, attacker-controlled JavaScript can execute in the victim's DataEase session. This issue is fixed in version 2.10.26. | ||||