Search
43,411 CVEs
CVEs (43,411, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 26–50 of 43,411 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-13332 | CRITICAL | Patched | 9.1 | 2026-07-27 | The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthentic… |
| CVE-2026-13390 | MEDIUM | Patched | 5.3 | 2026-07-27 | The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity ch… |
| CVE-2026-13400 | MEDIUM | Patched | 6.1 | 2026-07-27 | Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ord… |
| CVE-2026-13597 | CRITICAL | 9.1 | 2026-07-27 | The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated log… | |
| CVE-2026-13714 | CRITICAL | Patched | 9.8 | 2026-07-27 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated onl… |
| CVE-2026-13726 | HIGH | Patched | 7.1 | 2026-07-27 | The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Ref… |
| CVE-2026-14189 | LOW | Patched | 3.8 | 2026-07-27 | The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator ac… |
| CVE-2026-14190 | MEDIUM | Patched | 6.1 | 2026-07-27 | The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before … |
| CVE-2026-14203 | MEDIUM | Patched | 4.8 | 2026-07-27 | The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users wi… |
| CVE-2026-14235 | HIGH | Patched | 7.5 | 2026-07-27 | The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-liv… |
| CVE-2026-14236 | MEDIUM | Patched | 4.7 | 2026-07-27 | The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Str… |
| CVE-2026-14289 | CRITICAL | Patched | 9.0 | 2026-07-27 | The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a crypto… |
| CVE-2026-14568 | MEDIUM | Patched | 6.5 | 2026-07-27 | The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify… |
| CVE-2026-14820 | MEDIUM | Patched | 5.3 | 2026-07-27 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functi… |
| CVE-2026-14827 | MEDIUM | Patched | 6.8 | 2026-07-27 | The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, allo… |
| CVE-2026-66412 | MEDIUM | 6.5 | 2026-07-27 | Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to by sup… | |
| CVE-2026-9830 | HIGH | Patched | 8.2 | 2026-07-27 | The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespa… |
| CVE-2026-14837 | HIGH | 7.8 | 2026-07-27 | Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verific… | |
| CVE-2026-64531 | HIGH | 7.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as n… | |
| CVE-2026-64532 | HIGH | 7.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateReco… | |
| CVE-2026-64533 | HIGH | 7.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 record… | |
| CVE-2026-64534 | CRITICAL | 9.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(… | |
| CVE-2026-64535 | CRITICAL | 9.8 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: Fix potential UAF when ddgst mismatch Shivam Kumar found via vulnerability testing: When da… | |
| CVE-2026-64536 | HIGH | 8.1 | 2026-07-27 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop The loop in is_ap_in_tkip() iterates over… | |
| CVE-2026-65893 | NONE | — | 2026-07-27 | This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnera… |