Export limit exceeded: 424950 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11134 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11134 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-9709 | 1 Adobe | 1 Photoshop | 2026-11-11 | 8.8 High |
| Adobe Photoshop versions Photoshop CC 2019, and Photoshop 2020 have a security bypass vulnerability. Successful exploitation could lead to privilege escalation. | ||||
| CVE-2026-13598 | 1 Wordpress-extensions | 1 Restrictmate | 2026-11-11 | 9.8 Critical |
| The RestrictMate WordPress plugin before 1.3.0 does not restrict the user role supplied during account registration, allowing unauthenticated attackers to create a new administrator account and gain a logged-in administrator session, leading to full site takeover. | ||||
| CVE-2026-32561 | 2 Liquidthemes, Wordpress-extensions | 2 Booking Hub, Booking Hub | 2026-11-11 | 8.8 High |
| Subscriber Privilege Escalation in Booking Hub <= 1.3.0 versions. | ||||
| CVE-2026-13415 | 1 Wordpress-extensions | 1 Cmp | 2026-11-11 | 7.2 High |
| The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator. | ||||
| CVE-2026-16259 | 1 Wordpress-extensions | 1 Uix Usercenter | 2026-11-11 | 9.8 Critical |
| The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account. | ||||
| CVE-2026-81583 | 1 Wordpress-extensions | 1 Theme My Login | 2026-11-11 | 5.4 Medium |
| The My Login WordPress plugin before 7.2.0 does not enforce the network's registration setting when processing site signups on multisite installations, allowing users with a subscriber account, and unauthenticated users on some networks, to create new sites and be granted administrator over them. | ||||
| CVE-2026-14242 | 2026-11-11 | 6.5 Medium | ||
| A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization). | ||||
| CVE-2026-84042 | 2 Containers, Redhat | 5 Crun, Enterprise Linux, Hardened Images and 2 more | 2026-11-11 | 7.8 High |
| A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29 | ||||
| CVE-2026-123695 | 2026-11-11 | 9.8 Critical | ||
| The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API routes, allowing unauthenticated users to generate login tokens for every user and then retrieve them, and so log in as any user, including administrators. | ||||
| CVE-2026-121870 | 2026-11-11 | 7.5 High | ||
| The Simpler Checkout WordPress plugin before 1.5.4 does not properly restrict who can create orders and checks its automatic login link with a key that stays empty until the store owner configures the Simpler Checkout WordPress plugin before 1.5.4, allowing subscribers on stores that have not completed setup to log in as an administrator. | ||||
| CVE-2026-109870 | 2026-11-11 | 8.1 High | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role. | ||||
| CVE-2026-16256 | 1 Wordpress-extensions | 1 Pouco Import Users | 2026-11-11 | 9.8 Critical |
| The POUCO Import Users WordPress plugin through 1.0.0 does not perform any capability or nonce checks on AJAX actions available to unauthenticated users that create and update WordPress accounts, and it trusts an attacker-supplied role value, allowing unauthenticated attackers to create a new administrator account and take over the site. | ||||
| CVE-2026-16298 | 1 Wordpress-extensions | 1 Foodboxbooker | 2026-11-11 | 9.8 Critical |
| The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover. | ||||
| CVE-2026-15368 | 1 Wordpress-extensions | 1 Profile Builder | 2026-11-11 | 8.1 High |
| The User Profile Builder WordPress plugin before 3.16.4 does not correctly bind the automatic login performed after user registration to the newly created account, allowing unauthenticated attackers to obtain an authenticated session for an arbitrary existing user, including administrators, on sites using a supported but non-default configuration. | ||||
| CVE-2026-49176 | 1 Microsoft | 19 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 16 more | 2026-11-11 | 7.8 High |
| Improper privilege management in Windows WalletService allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50295 | 1 Microsoft | 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more | 2026-11-11 | 5.5 Medium |
| Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-50343 | 1 Microsoft | 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more | 2026-11-11 | 7.8 High |
| Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50391 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-11-11 | 7.8 High |
| Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-19222 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-10 | 6.6 Medium |
| The Forminator Forms WordPress plugin before 1.57.0.7 does not consistently enforce the role restriction it applies to registration forms, allowing users who are permitted to build forms to configure one that assigns the administrator role to any visitor who registers through it. | ||||
| CVE-2026-19220 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-10 | 3.7 Low |
| The Forminator Forms WordPress plugin before 1.57.1 does not verify that site registration is enabled on the network before creating a site signup, allowing unauthenticated visitors to create a new site on a WordPress multisite network and gain administrator privileges on it. | ||||