Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417953 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-10031 | 2 Drakkan, Sftpgo Project | 2 Sftpgo, Sftpgo | 2026-10-29 | 5.4 Medium |
| SFTPGo prior to 2.7.4 contains a permission bypass vulnerability that allows authenticated users to circumvent per-directory access controls by creating symbolic links in a permitted directory that point to files in directories where download, upload, or overwrite permissions are denied. Attackers can exploit the create_symlinks permission combined with read and write access in one directory to read or modify files in restricted directories, as operations are authorized against the link's directory permissions rather than the dereferenced target's directory permissions. | ||||
| CVE-2025-71381 | 1 Hono | 1 Hono | 2026-10-29 | 6.5 Medium |
| Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the incoming request into the response. Because Vary is a response header that should be managed by the server, an attacker can supply arbitrary Vary values that are reflected into the response, potentially causing cache key pollution and inconsistent CORS enforcement in environments that rely on shared caches or proxies. | ||||
| CVE-2025-71334 | 1 Flowiseai | 1 Flowise | 2026-10-29 | 9.8 Critical |
| Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are UUIDs or numbers in file handling operations. By supplying a path-traversal value (e.g., '../../../../../tmp') as the chatflow id, an unauthenticated attacker can use the /api/v1/chatflows endpoint (via addBase64FilesToStorage) to write arbitrary files, and the /api/v1/get-upload-file and /api/v1/openai-assistants-file/download endpoints (via streamStorageFile) to read arbitrary files. Arbitrary file write may lead to remote code execution. | ||||
| CVE-2024-58394 | 1 Retool | 1 Retool | 2026-10-29 | 6.1 Medium |
| Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15. | ||||
| CVE-2024-58366 | 2 Delskayn, Surrealdb | 2 Rquickjs, Surrealdb | 2026-10-29 | 8.5 High |
| SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs to read arbitrary memory or execute code with SurrealDB process privileges. | ||||
| CVE-2024-58363 | 1 Surrealdb | 1 Surrealdb | 2026-10-29 | 6.3 Medium |
| SurrealDB before 1.5.4 and 2.0.0-alpha.1 before 2.0.0-alpha.6 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter. | ||||
| CVE-2018-25308 | 3 Buddypress, Donmik, Wordpress | 3 Buddypress, Buddypress Xprofile Custom Fields Type, Wordpress | 2026-10-29 | 8.8 High |
| BuddyPress Xprofile Custom Fields Type 2.6.3 contains an arbitrary file deletion vulnerability that allows authenticated users to delete arbitrary files by manipulating unescaped POST parameters. Attackers can modify the field_hiddenfile and field_deleteimg parameters during profile editing to unlink files from the server. | ||||
| CVE-2017-20251 | 2 Cm-wp, Wordpress | 2 Woody Code Snippets, Wordpress | 2026-10-29 | 9.8 Critical |
| WordPress Insert PHP plugin versions before 3.3.1 contain a PHP code injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP code by injecting malicious shortcodes through the WordPress REST API. Attackers can send POST requests to the wp-json/wp/v2/posts endpoint with crafted content containing insert_php shortcodes to include and execute remote PHP files on the server. | ||||
| CVE-2026-62018 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions. | ||||
| CVE-2026-62008 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions. | ||||
| CVE-2026-62002 | 2026-10-29 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions. | ||||
| CVE-2026-61995 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. | ||||
| CVE-2026-61988 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions. | ||||
| CVE-2026-42692 | 2026-10-29 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | ||||
| CVE-2026-25448 | 2026-10-29 | 4.3 Medium | ||
| Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10. | ||||
| CVE-2026-118097 | 2026-10-29 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0. | ||||
| CVE-2026-118081 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | ||||
| CVE-2026-118076 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | ||||
| CVE-2026-116868 | 2026-10-29 | 8.8 High | ||
| Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. | ||||
| CVE-2026-116197 | 1 Edgelesssys | 1 Contrast | 2026-10-29 | 2.6 Low |
| Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata. | ||||