Export limit exceeded: 424998 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10783 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10783 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-10859 | 1 Ibm | 1 Mq | 2026-11-12 | 7.5 High |
| IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD could allow an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads. | ||||
| CVE-2026-118074 | 2 Daman Jeet, Wordpress-extensions | 2 Finale Lite, Finale Lite | 2026-11-12 | 7.2 High |
| Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | ||||
| CVE-2026-118075 | 2 Dbarrere, Wordpress-extensions | 2 Wp Media Folders, Wp Media Folders | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | ||||
| CVE-2026-118076 | 2 Frisbii, Wordpress-extensions | 2 Frisbii Pay, Frisbii Pay | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | ||||
| CVE-2026-118077 | 2 Fast Themes, Wordpress-extensions | 2 Sastra Essential Addons For Elementor, Sastra Essential Addons For Elementor | 2026-11-12 | 7.2 High |
| Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. | ||||
| CVE-2026-118079 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-12 | 7.2 High |
| Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212. | ||||
| CVE-2026-118080 | 2 Social Snap, Wordpress-extensions | 2 Social Snap, Social Snap | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | ||||
| CVE-2026-78527 | 2 Gsplugins, Wordpress-extensions | 2 Gs Testimonial Slider, Gs Testimonial Slider | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. | ||||
| CVE-2026-90888 | 2 Leadsnap, Wordpress-extensions | 2 Leadsnap, Leadsnap | 2026-11-12 | 9.8 Critical |
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | ||||
| CVE-2026-118089 | 2 Rextheme, Wordpress-extensions | 2 Product Feed Manager, Product Feed Manager | 2026-11-12 | 7.2 High |
| Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions. | ||||
| CVE-2026-109220 | 2 Addonsorg, Wordpress-extensions | 2 Pdf Invoice For Woocommerce + Drag And Drop Template Builder, Pdf Invoice For Woocommerce + Drag And Drop Template Builder | 2026-11-12 | 9.8 Critical |
| The PDF Invoice for WooCommerce + Drag and Drop Template Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.1.1 via the 'customer_note' parameter parameter. This is due to insufficient sanitization of the customer_note checkout field, which is inlined verbatim into invoice HTML, entity-decoded back into a live tag by simplehtmldom, reassembled into raw bytes by mPDF, and passed to unserialize() in _getObjAttr without validation. This makes it possible for unauthenticated attackers to execute code on the server. An unauthenticated attacker can trigger the vulnerable code path on a default install by placing an anonymous WooCommerce checkout via the public Store API (POST /wc/store/v1/checkout) using a Direct Bank Transfer or cheque payment method, which automatically transitions the order to 'on-hold' status and fires the plugin's invoice-generation hook. | ||||
| CVE-2026-111464 | 2 Emrevona, Wordpress-extensions | 2 Wp Fastest Cache – Wordpress Cache Plugin, Wp Fastest Cache | 2026-11-12 | 5.9 Medium |
| The WP Fastest Cache plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.5.3. The plugin caches the response of Core’s wp-activate.php without honoring its no-store/no-cache headers, the wp-activate-* cookie, or the WP_INSTALLING state, writing the credential-bearing activation response to a publicly accessible cache file. This makes it possible for unauthenticated attackers to retrieve the plaintext username and twelve-character password of the most recently activated Multisite registrant from that cached wp-activate.php response. Exploitation requires a Multisite subdirectory installation with public user and site registration enabled, and the credentials are only exposed after a genuine registrant follows their activation link. | ||||
| CVE-2026-17128 | 1 Ibm | 1 Api Connect | 2026-11-12 | 6.8 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files. | ||||
| CVE-2026-124744 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more | 2026-11-12 | 6.3 Medium |
| A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations. | ||||
| CVE-2026-56065 | 2 Doofinder, Wordpress-extensions | 2 Doofinder For Woocommerce, Doofinder For Woocommerce | 2026-11-12 | 7.5 High |
| Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2. | ||||
| CVE-2026-124495 | 1 Apache | 1 Storm | 2026-11-12 | N/A |
| When workers run as the topology owner, the Logviewer serves files that a worker has placed in its own log directory as links to other files. A user who is allowed to submit topologies can read the worker logs of other users' topologies, and other files the Logviewer process can read. Users are recommended to upgrade to version 3.2.0, which fixes the issue. | ||||
| CVE-2026-123836 | 1 Jetbrains | 1 Datalore | 2026-11-12 | 8.8 High |
| In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup | ||||
| CVE-2026-119946 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 5.9 Medium |
| Improper access control in Windows HTTP.sys allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-124701 | 1 Progress | 1 Telerik Ui For Winforms | 2026-11-12 | 7.8 High |
| In Telerik UI for WinForms, versions prior to 2026.4.1111, a deserialization of untrusted data vulnerability exists that allows an attacker to perform unauthorized actions in the context of the affected application. | ||||
| CVE-2026-86829 | 1 Apache | 1 Airflow | 2026-11-12 | 8.8 High |
| Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependencies. A Dag author, who controls what a task writes to XCom, therefore controls data that is deserialized inside the scheduler process - a context the Airflow security model reserves for code installed by the Deployment Manager, above the worker-scoped execution capability a Dag author is documented to have. Deployments that treat Dag authors as less trusted than Deployment Managers are affected, and the scheduler must be evaluating a task dependency that reads a task-written XCom value. Users of apache-airflow are recommended to upgrade to version 3.4.0 or later, which restricts dependency evaluation to primitive XCom values. | ||||