Export limit exceeded: 30194 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (30194 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126882 | 2026-11-11 | N/A | ||
| Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-126862 | 2026-11-11 | N/A | ||
| Improper input validation in Core in Google Chrome on on Android prior to 157.0.8103.78 allowed a local attacker to bypass web origin policy via a co-installed app. (Chromium security severity: High) | ||||
| CVE-2026-126878 | 2026-11-11 | N/A | ||
| Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-68512 | 2026-11-11 | N/A | ||
| Paaster is a pastebin application. Prior to version 3.3.0, Paaster's account login has no rate limiting, lockout, or CAPTCHA of any kind, and a companion endpoint openly discloses whether a username exists along with that account's password-hashing salts. Together these let an attacker enumerate real accounts and then brute-force their passwords with unlimited, unthrottled attempts. This issue has been patched in version 3.3.0. | ||||
| CVE-2026-119952 | 1 Microsoft | 13 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 10 more | 2026-11-11 | 8.1 High |
| Observable timing discrepancy in Windows Schannel allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-126331 | 2026-11-11 | N/A | ||
| Insertion of sensitive information into sent data in the user list endpoint in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with delegated user-viewing permissions to obtain users' API key secret hashes via the user list API response. | ||||
| CVE-2026-126327 | 2026-11-11 | N/A | ||
| Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API. | ||||
| CVE-2026-13736 | 1 Wordpress-extensions | 1 Newpath Wildapricotpress Add-on | 2026-11-11 | 5.3 Medium |
| The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only. | ||||
| CVE-2026-17517 | 1 Wordpress-extensions | 1 Content Views | 2026-11-11 | 5.3 Medium |
| The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them. | ||||
| CVE-2026-78149 | 1 Wordpress-extensions | 1 Smart Post | 2026-11-11 | 5.3 Medium |
| The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored password through an unauthenticated AJAX action, allowing unauthenticated users to read protected post content and the password that guards it. | ||||
| CVE-2026-81348 | 1 Wordpress-extensions | 1 My Private Site | 2026-11-11 | 3.7 Low |
| The My Private Site WordPress plugin before 4.2.3 does not apply its site-privacy access control to certain unauthenticated front-end read surfaces, allowing unauthenticated users to view post content, comments and post URLs from a site the administrator placed behind mandatory login. | ||||
| CVE-2026-84926 | 1 Wordpress-extensions | 1 Embedpress | 2026-11-11 | 2.7 Low |
| The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators, allowing any authenticated user with contributor-level access or above to read the site administrator's email address, a value WordPress core withholds from that role. | ||||
| CVE-2026-80339 | 1 Wordpress-extensions | 1 Payment Plugins For Stripe Woocommerce | 2026-11-11 | 5.3 Medium |
| The Payment Plugins for Stripe WooCommerce WordPress plugin before 4.0.12 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the billing details of any order, together with the secret that gates access to it, by iterating sequential order identifiers. | ||||
| CVE-2026-80340 | 1 Wordpress-extensions | 1 Payment Plugins For Paypal Woocommerce | 2026-11-11 | 5.3 Medium |
| The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.26 does not validate the order key before adding order data to the JavaScript configuration it outputs on the front end, allowing unauthenticated users to obtain the secret that gates access to any order and, through it, that customer's billing and shipping details, by iterating sequential order identifiers. | ||||
| CVE-2026-111597 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-11 | 5.3 Medium |
| The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying. | ||||
| CVE-2026-0331 | 1 Palo Alto Networks | 3 Cloud Ngfw, Pan-os, Prisma Access | 2026-11-11 | N/A |
| An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama is not affected by this vulnerability. | ||||
| CVE-2026-114156 | 1 Microsoft | 4 .net 11.0 Installed On Linux, .net 11.0 Installed On Mac Os, .net 11.0 Installed On Windows and 1 more | 2026-11-11 | 6.5 Medium |
| Improper input validation in ASP.NET Core allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-123871 | 2026-11-11 | 6.2 Medium | ||
| Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages. CVE-2026-48615 established that a proxy credential must not appear in a Node.js error message and redacted the username and password from ProxyConfig.href, but that fix missed four error paths in the same subsystem, one of them inside the same constructor, which interpolate the raw proxy URL, credentials included, into an ERR_PROXY_INVALID_CONFIG message. The proxy URL comes from the environment, but the defect is the sink: a secret that Node.js redacts everywhere else is emitted verbatim into a much wider audience than the process environment, such as stderr, container logs, log aggregation, and crash reporting services. This vulnerability affects Node.js 26.x, 24.x, and 22.x. | ||||
| CVE-2026-123829 | 2026-11-11 | 2.5 Low | ||
| A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x. | ||||
| CVE-2026-119618 | 1 Redhat | 4 Enterprise Linux, Enterprise Linux Eus, Rhel E4s and 1 more | 2026-11-11 | 9.8 Critical |
| Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42. | ||||