Export limit exceeded: 425740 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425740 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425740 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119495 | 2 Webberzone, Wordpress-extensions | 2 Better Search, Better Search | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2. | ||||
| CVE-2026-39743 | 2 Wclovers, Wordpress-extensions | 2 Wcfm Membership, Wcfm Membership | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0. | ||||
| CVE-2026-114183 | 2 Wordpress-extensions, Wpvibes | 2 Anywhere Elementor, Anywhere Elementor | 2026-11-12 | 6.5 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Retrieve Embedded Sensitive Data.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-120843 | 2 Barn2 Plugins, Wordpress-extensions | 2 Posts Table With Search & Sort, Posts Table With Search & Sort | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14. | ||||
| CVE-2026-119487 | 2 Wedevs, Wordpress-extensions | 2 Dokan, Dokan | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2. | ||||
| CVE-2026-39777 | 2 Wclovers, Wordpress-extensions | 2 Wcfm Membership, Wcfm Membership | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM Membership: from n/a through 2.12.0. | ||||
| CVE-2026-119485 | 2 Wedevs, Wordpress-extensions | 2 Dokan, Dokan | 2026-11-12 | 5.3 Medium |
| Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dokan: from n/a through 5.3.2. | ||||
| CVE-2026-114185 | 2 Wordpress-extensions, Wpvibes | 2 Anywhere Elementor, Anywhere Elementor | 2026-11-12 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0. | ||||
| CVE-2026-103077 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-12 | 4.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-105619 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-12 | 4.8 Medium |
| PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-105620 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-12 | 6.5 Medium |
| PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-110181 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-12 | 6.5 Medium |
| PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function bodies. PostgreSQL analyses such functions at declaration time, while Anonymizer only attempts to check them at execution time. This problem can be exploited by any user with the TEMPORARY privilege. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-110182 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-12 | 4.3 Medium |
| PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions. These function can reveal the while data if the data is small enough. The issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-110183 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-12 | 4.3 Medium |
| PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-17132 | 1 Ibm | 1 Api Connect | 2026-11-12 | 9.9 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command. | ||||
| CVE-2026-17131 | 1 Ibm | 1 Api Connect | 2026-11-12 | 9.3 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to server-side request forgery. Restrictions on outbound requests can be bypassed, so the server could be made to contact unintended destinations and return the response. | ||||
| CVE-2026-17129 | 1 Ibm | 1 Api Connect | 2026-11-12 | 7.6 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference. | ||||
| CVE-2026-127207 | 2026-11-12 | 5.4 Medium | ||
| Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760. | ||||
| CVE-2026-17128 | 1 Ibm | 1 Api Connect | 2026-11-12 | 6.8 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to the insertion of sensitive information into log files. | ||||
| CVE-2026-58690 | 2026-11-12 | 7.8 High | ||
| In multiple functions of bitmap_image_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution environment heap due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||