Export limit exceeded: 422349 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 422349 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422349 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121780 | 2 Gijo Varghese, Wordpress-extensions | 2 Flying Images, Flying Images | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese Flying Images nazy-load allows Stored XSS.This issue affects Flying Images: from n/a through 2.4.15. | ||||
| CVE-2026-123465 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-10 | 7.5 High |
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows Retrieve Embedded Sensitive Data.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-121764 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212. | ||||
| CVE-2026-119514 | 2 Webful Creations, Wordpress-extensions | 2 Repairbuddy, Repairbuddy | 2026-11-10 | 6.3 Medium |
| Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234. | ||||
| CVE-2026-82436 | 1 Apache | 1 Storm Client | 2026-11-10 | N/A |
| Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class registration disabled and an instantiation strategy that constructs objects without invoking their constructors, then deserialized whatever bytes the state store returned. A party able to write to the topology's keyspace in the state store, for example a co-tenant of a shared Redis instance or anyone with network access to it, could therefore place a serialized object graph that executes code inside the worker JVM when the state is restored. This requires the Redis-backed state provider, which is not the default. Write access to a state-store key is a data-plane privilege; code execution in the worker JVM is not, so the two are not equivalent. Mitigation Upgrade to 3.1.0, where the state serializer requires registered classes. Note that this is a behaviour change for existing state: checkpoints written by an affected version may fail to restore, and a migration step may be required. Users who cannot upgrade immediately should restrict network and credential access to the state store to the cluster itself. Credit The ASF -- found using Claude agents to study the security of open-source projects, validated and reported by Apache Storm. | ||||
| CVE-2026-106466 | 1 Wordpress-extensions | 1 Jwt Auth | 2026-11-10 | 7.5 High |
| The JWT Auth WordPress plugin through 3.0.2 does not invalidate previously issued refresh tokens when a user changes or resets their password or removes a connected device, allowing an attacker who obtained a refresh token before such an event to keep issuing valid access tokens and retain authenticated access to the account, up to Administrator. | ||||
| CVE-2026-115252 | 1 Wordpress-extensions | 1 Confection | 2026-11-10 | 10 Critical |
| The Confection WordPress Cable WordPress plugin from 0.4.0 to 0.4.7 does not perform any capability or nonce checks before saving its settings and writing one of them, unmodified, into a standalone PHP file that it then serves, allowing unauthenticated users to execute arbitrary PHP code on the server. | ||||
| CVE-2026-106008 | 1 Wordpress-extensions | 1 Fraudlabs Pro Sms Verification | 2026-11-10 | 5.3 Medium |
| The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control. | ||||
| CVE-2026-121570 | 2 Wordpress-extensions, Wpchill | 2 Rsvp And Event Management, Rsvp And Event Management | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and Event Management rsvp allows Stored XSS.This issue affects RSVP and Event Management: from n/a through 2.7.17. | ||||
| CVE-2026-120855 | 2 Templateinvaders, Wordpress-extensions | 2 Ti Woocommerce Wishlist, Ti Woocommerce Wishlist | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Stored XSS.This issue affects TI WooCommerce Wishlist: from n/a through 2.14.0. | ||||
| CVE-2026-119524 | 2 Aguilatechnologies, Wordpress-extensions | 2 Wp Customer Area, Wp Customer Area | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Stored XSS.This issue affects WP Customer Area: from n/a through 8.4.3. | ||||
| CVE-2026-120856 | 2 Rymera Web Co, Wordpress-extensions | 2 Invoice Gateway For Woocommerce – Invoice Payment Gateway, Invoice Gateway For Woocommerce – Invoice Payment Gateway | 2026-11-10 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6. | ||||
| CVE-2026-120854 | 2 Iubenda, Wordpress-extensions | 2 Iubenda, Iubenda | 2026-11-10 | 7.5 High |
| Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution allows HTTP DoS.This issue affects iubenda: from n/a through 3.13.6. | ||||
| CVE-2026-122673 | 2 Wordpress-extensions, Wpmet | 2 Shopengine, Shopengine | 2026-11-10 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8. | ||||
| CVE-2026-103906 | 1 Am Automatic Machines | 1 Am Club | 2026-11-10 | N/A |
| Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the MQTT broker and access data or perform actions across tenant boundaries. | ||||
| CVE-2026-112164 | 1 Laservideo | 1 Lasergest | 2026-11-10 | N/A |
| The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV, allowing an attacker with access to the application package to recover them in cleartext. | ||||
| CVE-2026-121685 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-10 | N/A |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentials. These include fleet‑wide credentials, including BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. These credentials are embedded directly in frodobot.bin and are accessible through static analysis of the publicly downloadable firmware. Extraction requires no special privileges. | ||||
| CVE-2026-121686 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-10 | N/A |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code execution via MQTT. A firmware method accepts arbitrary shell commands delivered via Amazon Web Services Internet of Things Message Queuing Telemetry Transport (AWS IoT MQTT) messages and executes them as root. Access is gated only by shared Internet of Things (IoT) credentials, with no per‑device authentication, enabling remote code execution as root across the fleet. | ||||
| CVE-2026-121687 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-10 | N/A |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/status), join-arbitrary-WiFi, diagnostic export. 2. ADB (Android Debug Bridge, port 5555) access to root shell 3. SSH (port 22) | ||||
| CVE-2026-121688 | 1 Frodobots | 1 Frodobots Earthrover Mini+ Firmware | 2026-11-10 | N/A |
| FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided in the same unprotected response. No code‑signing mechanism is implemented, allowing firmware to be replaced with potentially malicious code. | ||||