Search
30,217 CVEs
CVEs (30,217, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 301–325 of 30,217 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-8921 | NONE | Patched | — | 2026-07-03 | External Control of File Name or Path vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message… |
| CVE-2026-8920 | NONE | — | 2026-07-15 | Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file o… | |
| CVE-2026-8919 | NONE | — | 2026-07-15 | Permissive Cross-domain Security Policy with Untrusted Domains in ASUS GameSDK allows a remote user to obtain a local user’s NTLM hash by convincing the user to visit a cra… | |
| CVE-2026-8918 | NONE | Patched | — | 2026-06-22 | A permissive list of allowed inputs in ASUS Armoury Crate allows a local administrator to perform arbitrary memory read/write operations or cause a system crash (BSOD) by b… |
| CVE-2026-8917 | NONE | — | 2026-08-11 | Untrusted Pointer Dereference in ASUS GPU Tweak III, GPUTweakII, AI Suite3, and VGAdll: An IOCTL vulnerability allows a local attacker to write a specific value to an arbit… | |
| CVE-2026-8905 | MEDIUM | 6.1 | 2026-06-24 | The Osiris Signature Banner plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect … | |
| CVE-2026-8896 | MEDIUM | 6.4 | 2026-06-24 | The MIR blocks and shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' attribute (and other attributes such as 'ready_animation_tex… | |
| CVE-2026-8892 | MEDIUM | 6.4 | 2026-07-03 | The CM Business Directory – Optimise and showcase local business plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Business Address Meta Fields in all v… | |
| CVE-2026-8865 | MEDIUM | 6.4 | 2026-06-24 | The Avalon23 Products Filter for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'avalon23_qr' shortcode in all versions up to, and in… | |
| CVE-2026-8864 | NONE | — | 2026-06-30 | The HP Fan Control App might allow local escalation of privileges. An updated version of HP Fan Control App has been released to mitigate this potential vuln… | |
| CVE-2026-8862 | HIGH | 7.5 | 2026-09-03 | IBM Netezza Software 11.3.0.3 through Interim Fix 002 has credentials that are hardcoded in the application source code, allowing unauthorized access to the container regis… | |
| CVE-2026-8861 | MEDIUM | Patched | 5.3 | 2026-07-17 | IBM Security Verify could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information coul… |
| CVE-2026-8859 | CRITICAL | Patched | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the APIRequest c… |
| CVE-2026-8858 | HIGH | Patched | 7.5 | 2026-06-22 | IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug… |
| CVE-2026-8857 | HIGH | Patched | 8.8 | 2026-07-01 | A vulnerability in Wikimedia Foundation timeline. This vulnerability is associated with program files scripts/EasyTimeline.Pl, includes/Timeline.Php. This issue affect… |
| CVE-2026-8853 | MEDIUM | 4.4 | 2026-06-10 | The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient in… | |
| CVE-2026-8848 | HIGH | 7.2 | 2026-07-09 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass in all version… | |
| CVE-2026-8840 | MEDIUM | 5.3 | 2026-08-15 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the… | |
| CVE-2026-8828 | NONE | — | 2026-06-12 | A lack of authorization validation in version 1.0.0 or later of the ChromaDB Rust project allows any authenticated users to arbitrarily read, write, update, or delete data … | |
| CVE-2026-8825 | MEDIUM | Patched | 4.9 | 2026-07-20 | The Elementor Website Builder WordPress plugin before 4.1.4 does not properly check user permissions before returning post data through one of its REST endpoints, allowing… |
| CVE-2026-8823 | LOW | Patched | 3.8 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 10.11.x <= 10.11.17 fail to validate bot targets when demoting users to guests which allows a lower-privileged administrator to degrad… |
| CVE-2026-8811 | NONE | Patched | — | 2026-06-18 | SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside th… |
| CVE-2026-8810 | MEDIUM | 6.9 | 2026-08-19 | On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables. | |
| CVE-2026-8806 | NONE | — | 2026-06-19 | Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP all versions allows a remote attacker to cause a… | |
| CVE-2026-8805 | NONE | — | 2026-06-19 | Integer Overflow or Wraparound vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP EtherNet/IP module FX5-EIP versions 1.000 and pri… |