Export limit exceeded: 378430 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (9195 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59522 | 2 Wedevs, Wordpress | 2 Wp Erp, Wordpress | 2026-07-23 | 6.5 Medium |
| Subscriber Broken Access Control in WP ERP <= 1.17.5 versions. | ||||
| CVE-2026-65489 | 2 Lastudio, Wordpress | 2 La-studio Element Kit For Elementor, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions. | ||||
| CVE-2026-65495 | 2 Dokan Multivendor Plugin, Wordpress | 2 Dokan Pro, Wordpress | 2026-07-23 | 7.5 High |
| Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. | ||||
| CVE-2026-65529 | 2 Iqonicdesign, Wordpress | 2 Graphina, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions. | ||||
| CVE-2026-65531 | 2 Themeum, Wordpress | 2 Qubely, Wordpress | 2026-07-23 | 4.8 Medium |
| Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | ||||
| CVE-2026-59547 | 2 Easy Payment, Wordpress | 2 Payment Gateway For Paypal On Woo Commerce, Wordpress | 2026-07-23 | 7.5 High |
| Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. | ||||
| CVE-2026-65484 | 2 Analogwp, Wordpress | 2 Style Kits, Wordpress | 2026-07-23 | 6.3 Medium |
| Contributor Broken Access Control in Style Kits <= 2.6.5 versions. | ||||
| CVE-2026-57830 | 2026-07-23 | N/A | ||
| Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion. | ||||
| CVE-2026-25424 | 2 Mediavine, Wordpress | 2 Mediavine Control Panel, Wordpress | 2026-07-23 | 4.3 Medium |
| Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. | ||||
| CVE-2026-65487 | 2 Themegoods, Wordpress | 2 Photography, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. | ||||
| CVE-2026-65453 | 2 Motovnet, Wordpress | 2 Ebook Store, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. | ||||
| CVE-2026-27355 | 2 Metaphorcreations, Wordpress | 2 Ditty, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | ||||
| CVE-2026-65530 | 2 Templatespare, Wordpress | 2 Templatespare, Wordpress | 2026-07-23 | 4.3 Medium |
| Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions. | ||||
| CVE-2026-65007 | 1 Getgrav | 1 Grav | 2026-07-23 | 9.6 Critical |
| The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission (the baseline permission held by every panel user). This allows any user with admin.login to mint a persistent API key bound to any account, and the forged key inherits the target account's API permissions. On installs where an API-enabled account holds broader permissions, this enables account impersonation and privilege escalation up to account takeover. | ||||
| CVE-2026-65476 | 2 Uxper, Wordpress | 2 Civi, Wordpress | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. | ||||
| CVE-2026-57703 | 2 Sunshinephotocart, Wordpress | 2 Sunshine Photo Cart, Wordpress | 2026-07-23 | 6.3 Medium |
| Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. | ||||
| CVE-2026-25466 | 2 Wordpress, Wpgmaps | 2 Wordpress, Wp Go Maps | 2026-07-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. | ||||
| CVE-2026-65895 | 1 Getgrav | 1 Grav | 2026-07-23 | 8.5 High |
| Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled. | ||||
| CVE-2026-7328 | 1 Caliptra | 1 Core Runtime Firmware | 2026-07-23 | N/A |
| Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0. | ||||
| CVE-2026-47688 | 1 Fogproject | 1 Fogproject | 2026-07-23 | 8.2 High |
| FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via a single HTTP GET request through the public `client` node endpoint. This allows remote wiping of host AES encryption credentials and deletion of all power management scheduled tasks, with no login, session, or CSRF token required. Versions 1.5.10.1832 and 1.6.0-beta.2313 fix the issue. | ||||