Export limit exceeded: 14117 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14117 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70447 | 1 Jenkins Project | 1 Jenkins Aws Codebuild Plugin | 2026-08-07 | 4.3 Medium |
| Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | ||||
| CVE-2026-15459 | 2 Wordpress, Wpmudev | 2 Wordpress, Wpmu Dev Dashboard | 2026-08-07 | 8.1 High |
| The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the signature verified by validate_hash() trivially forgeable; version 5.0.0 additionally removed the replay check in validate_nonce(), and the remote handler is bound to the public init hook with no capability check. This makes it possible for unauthenticated attackers to invoke privileged Hub actions — including installing and activating a plugin from an attacker-supplied URL (resulting in remote code execution), deleting plugins and themes, upgrading WordPress core, or logging in as an administrator via SSO. Sites connected to a WPMU DEV account, which have a non-empty 64-character API key, are not affected. | ||||
| CVE-2025-11850 | 1 Wso2 | 3 Identity Server, Token Exchange Grant Type For Oauth, Wso2 Identity Server | 2026-08-07 | 4.3 Medium |
| When secondary user stores are configured, the implicit-association resolver incorrectly initializes from a secondary user store and bypasses the primary user store during search and uniqueness checks. This allows a subject to be associated with an unintended local account if the same lookup claim (e.g., username or email) exists in both the primary and a secondary store. If duplicate claim values exist across user stores, this issue can lead to identity confusion due to incorrect implicit associations when using an external Identity Provider (IDP). Legitimate user accounts in the primary user store may fail to associate correctly with their corresponding external IDP accounts, potentially restricting access if the secondary account has fewer privileges. Deployments are not affected if no secondary user stores are configured, implicit association is disabled, or claim values are globally unique. | ||||
| CVE-2026-65542 | 2 Rajat Varlani, Wordpress | 2 Super Socializer, Wordpress | 2026-08-07 | 8.8 High |
| Unauthenticated Broken Authentication in Super Socializer <= 7.14.5 versions. | ||||
| CVE-2026-57088 | 1 Microsoft | 6 Windows 10 1809, Windows Server 2019, Windows Server 2019 (server Core Installation) and 3 more | 2026-08-07 | 7.8 High |
| Improper access control in Extensible Storage Engine (ESENT) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58540 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 7.8 High |
| Improper authorization in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-58545 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 5.5 Medium |
| Improper access control in Windows Kernel allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-47301 | 1 Microsoft | 4 Configuration Manager, Configuration Manager 2503, Configuration Manager 2509 and 1 more | 2026-08-07 | 8.8 High |
| Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-15210 | 2 Glboy, Wordpress | 2 Otp Login With Phone Number, Otp Verification, Wordpress | 2026-08-07 | 9.1 Critical |
| The OTP Login With Phone Number, OTP Verification WordPress plugin before 1.8.71 does not limit the number of OTP verification attempts or invalidate a one-time login code after a wrong guess, and an unauthenticated user can request a login code for any account. Because the code is a short numeric OTP, an attacker can brute-force it and take over any account, including an administrator's. | ||||
| CVE-2026-15372 | 2 Wordpress, Wp2fac | 2 Wordpress, Wp2fac | 2026-08-07 | 7.5 High |
| The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts. | ||||
| CVE-2026-15573 | 1 Redhat | 9 Build Keycloak, Build Of Keycloak, Data Grid and 6 more | 2026-08-07 | 8.1 High |
| A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see. | ||||
| CVE-2026-13703 | 2 Clogica, Wordpress | 2 Seo Redirection Plugin, Wordpress | 2026-08-07 | 5.4 Medium |
| The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs. | ||||
| CVE-2025-14779 | 1 Wso2 | 4 Identity Server, Wso2 Carbon Identity Api Server Secret Management Common, Wso2 Carbon Identity Api Server Secret Management V1 and 1 more | 2026-08-07 | 3.8 Low |
| The Secret Type Management REST API does not correctly isolate access controls when deleting a secret type. The on-delete cascade logic, when triggered, fails to enforce organizational boundaries, leading to the removal of secrets associated with that type across all organizations. Exploitation of this vulnerability can result in the unintended deletion of secrets across the entire deployment, potentially causing configuration failures, service interruptions, and a denial-of-service condition. This vulnerability requires delete permissions for the Secret Type Management REST API, which are by default only granted to administrators. | ||||
| CVE-2026-15599 | 1 Tubitak Bilgem Software Technologies Research Institute | 1 Pardus Domain Joiner | 2026-08-07 | 3.3 Low |
| Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse. This issue affects pardus-domain-joiner: before 0.5.5. | ||||
| CVE-2026-16527 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-08-07 | 7.3 High |
| An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. | ||||
| CVE-2026-65668 | 1 Microsoft | 2 Office Purview Ediscovery, Purview Ediscovery | 2026-08-07 | 8.8 High |
| Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-56161 | 1 Microsoft | 1 Azure Logic Apps | 2026-08-07 | 9.6 Critical |
| Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-62896 | 1 Microsoft | 1 Teams | 2026-08-07 | 9.6 Critical |
| Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66451 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-08-06 | 6.5 Medium |
| Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. | ||||
| CVE-2026-18974 | 1 Heshengtao | 1 Super-agent-party | 2026-08-06 | 5.3 Medium |
| A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulation of the argument tool_name/tool_params results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||