Export limit exceeded: 418615 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418615 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-105967 | 2 Ghozylab, Wordpress-extensions | 2 Gallery For Social Photo, Gallery For Social Photo | 2026-11-03 | N/A |
| The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses. | ||||
| CVE-2026-105993 | 1 Wordpress-extensions | 1 Dt Directory Lite Addon | 2026-11-03 | N/A |
| The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options. | ||||
| CVE-2026-91075 | 2 Eupago, Wordpress-extensions | 2 Eupago Gateway Woocommerce, Eupago Gateway For Woocommerce | 2026-11-03 | 5.3 Medium |
| The Eupago Gateway For Woocommerce WordPress plugin from 4.5.0 through 4.7.5 does not verify the authenticity of incoming payment-confirmation webhook requests in some configurations, allowing unauthenticated attackers to forge a payment confirmation and mark a pending order as paid without paying for it. | ||||
| CVE-2026-120328 | 1 Typo3 | 1 Extension Mail | 2026-11-03 | N/A |
| The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can retrieve personal data of newsletter recipients, which is inserted into links of sent mails. | ||||
| CVE-2026-103379 | 1 Wordpress-extensions | 1 Wati Chat And Notification | 2026-11-03 | N/A |
| The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns its stored API token, which an unauthenticated attacker can then present to a second public endpoint to obtain the order-received URL of any WooCommerce order and read the customer's name, address, phone number and email address. The endpoints are reachable in the WATI Chat and Notification WordPress plugin through 1.1.8's default state and are closed only once a WATI account is connected. | ||||
| CVE-2026-106004 | 1 Wordpress-extensions | 1 Dt Lms | 2026-11-03 | N/A |
| The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated attackers to revoke any learner's course and class completion status. | ||||
| CVE-2026-120330 | 1 Typo3 | 1 Extension Mail | 2026-11-03 | N/A |
| Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or recipient group. Backend users with access to the mail module can view, change, send and export mails and recipient groups outside their web mounts, including the personal data of recipients. | ||||
| CVE-2026-120332 | 1 Typo3 | 1 Extension Mail | 2026-11-03 | N/A |
| The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report. | ||||
| CVE-2026-89229 | 1 Vivo | 1 Bluelm Copilot | 2026-11-03 | N/A |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences. | ||||
| CVE-2026-105770 | 1 Octo-sts | 1 App | 2026-11-03 | 5.3 Medium |
| Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust. An attacker who holds any validly signed OIDC token, such as a GitHub Actions token from a repository they own, and who knows or guesses a target owner/repo and identity name can read that policy's matching rules, even when the policy is stored in a private repository. These rules often name internal repositories, branches, environments or cloud account identifiers. The issue does not allow minting tokens or bypassing a trust policy. This issue is fixed in 0.11.2. | ||||
| CVE-2026-115205 | 1 Wordpress-extensions | 1 Azexo Store Locator | 2026-11-03 | N/A |
| The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, allowing any authenticated user, such as a subscriber, to delete arbitrary posts and pages. | ||||
| CVE-2026-120327 | 1 Typo3 | 1 Extension Mail | 2026-11-03 | N/A |
| The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect users to external sites. | ||||
| CVE-2026-120331 | 1 Typo3 | 1 Extension Mail | 2026-11-03 | N/A |
| Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network. | ||||
| CVE-2026-103327 | 1 Wordpress-extensions | 1 Cryptocloud | 2026-11-03 | 5.3 Medium |
| The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gateway callback, as the integrity check is skipped while the webhook secret is left at its empty default, allowing unauthenticated attackers to mark arbitrary orders as paid or failed without any payment being made. | ||||
| CVE-2026-104647 | 1 Wordpress-extensions | 1 Wemail | 2026-11-03 | N/A |
| The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user whose role is in the weMail WordPress plugin through 2.1.6's allowed-roles list (Editor and above by default) as authorised for every action, which allows such users to perform administrator-level actions including enumerating all registered users with their email addresses and modifying the weMail WordPress plugin through 2.1.6's own access-control configuration. | ||||
| CVE-2026-119737 | 2 Amlogic, Nexbox | 2 Amlogic Android Sdk, A95x | 2026-11-03 | 7.8 High |
| The pppoe_wrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X (Amlogic S905/S905X) TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /dev/socket/pppoe_wrapper. Attackers can send a message beginning with 'pppd pty' followed by shell metacharacters and arbitrary commands, which are passed unfiltered to system(3) and executed by /system/bin/sh -c as root, resulting in full privilege escalation. | ||||
| CVE-2026-119738 | 2 Amlogic, Nexbox | 2 Amlogic Android Sdk, A95x | 2026-11-03 | 5.3 Medium |
| The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an infinite loop vulnerability in get_vob_spu() that allows unauthenticated network attackers or local users loading malicious files to trigger an unreachable loop exit condition via mismatched length fields. Attackers can send crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file to cause the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service. | ||||
| CVE-2026-119739 | 2 Amlogic, Nexbox | 2 Amlogic Android Sdk, A95x | 2026-11-03 | 5.3 Medium |
| The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash. | ||||
| CVE-2026-119740 | 1 Nexbox | 1 A95x | 2026-11-03 | 6.8 Medium |
| Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 (system) without any credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device. | ||||
| CVE-2026-120329 | 1 Typo3 | 1 Extension Mail | 2026-11-03 | N/A |
| Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configuration options of the module. Backend users with access to the mail module can write arbitrary page TSconfig. | ||||