Search
172,839 CVEs · Medium severity
CVEs (172,839, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 201–225 of 172,839 (capped at 500)
| CVE ID ↓ | Severity | Patch | CVSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-97324 | MEDIUM | 7.3 | 2026-09-24 | A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/… | |
| CVE-2026-97323 | MEDIUM | 6.3 | 2026-09-24 | A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the file yudao-module-mp/src/main/java/… | |
| CVE-2026-97322 | MEDIUM | 4.3 | 2026-09-24 | A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This affects an unknown function of the file yudao-module-infra/src/main/java/cn/iocoder/yuda… | |
| CVE-2026-97321 | MEDIUM | 6.3 | 2026-09-24 | A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceImpl.getDataBySQL of the file yuda… | |
| CVE-2026-97320 | MEDIUM | 6.3 | 2026-09-24 | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The affected element is the function AiKnowledgeDocumentServiceImpl.readUrl of the file AiKnowled… | |
| CVE-2026-9732 | MEDIUM | 4.3 | 2026-06-03 | The EmergencyWP – Dead Man's switch & legacy deliverance plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This … | |
| CVE-2026-97319 | MEDIUM | Patched | 6.8 | 2026-09-27 | The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow… |
| CVE-2026-97318 | MEDIUM | Patched | 6.1 | 2026-10-02 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting vi… |
| CVE-2026-97317 | MEDIUM | Patched | 5.3 | 2026-10-02 | The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway … |
| CVE-2026-97316 | MEDIUM | Patched | 5.8 | 2026-09-30 | The Broken Link Notifier WordPress plugin before 2.0.0.1 does not re-validate the destination of redirects when checking links, allowing unauthenticated attackers to bypass… |
| CVE-2026-97315 | MEDIUM | Patched | 5.4 | 2026-10-14 | The Responsive Blocks WordPress plugin before 2.3.0 does not sanitise or escape some of the values submitted with its Form block before adding them to the HTML notification… |
| CVE-2026-97314 | MEDIUM | Patched | 6.5 | 2026-10-17 | The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its link redirect tracking handler, allowing unauthentica… |
| CVE-2026-97311 | MEDIUM | 4.3 | 2026-09-24 | A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not… | |
| CVE-2026-9731 | MEDIUM | 4.3 | 2026-07-08 | The Wp Js Detect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.9. This is due to missing or incorrect nonce val… | |
| CVE-2026-97308 | MEDIUM | 4.8 | 2026-10-06 | Unauthenticated Bypass Vulnerability in Login Lockdown <= 2.17 versions. | |
| CVE-2026-97305 | MEDIUM | — | 2026-10-05 | Authorization Bypass Through User-Controlled Key vulnerability in Themeisle AI Chatbot for WordPress – Hyve Lite hyve-lite allows Exploiting Incorrectly Configured Access C… | |
| CVE-2026-97304 | MEDIUM | 6.5 | 2026-10-05 | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from… | |
| CVE-2026-97302 | MEDIUM | 5.3 | 2026-09-30 | Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. | |
| CVE-2026-97301 | MEDIUM | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | |
| CVE-2026-97300 | MEDIUM | 6.5 | 2026-10-06 | Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions. | |
| CVE-2026-9730 | MEDIUM | 4.3 | 2026-06-02 | The Remove NoFollow Commenter URL plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or inco… | |
| CVE-2026-97299 | MEDIUM | 5.4 | 2026-09-30 | Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. | |
| CVE-2026-97298 | MEDIUM | 6.5 | 2026-09-30 | Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. | |
| CVE-2026-97294 | MEDIUM | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows S… | |
| CVE-2026-97292 | MEDIUM | 6.5 | 2026-09-30 | Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. |