Export limit exceeded: 372771 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372771 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66609 | 2026-08-20 | 9.3 Critical | ||
| Unauthenticated SQL Injection in TheGem (Elementor) <= 5.12.3 versions. | ||||
| CVE-2026-66598 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in B2BKing Premium <= 5.6.07 versions. | ||||
| CVE-2026-68564 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in NotificationX Pro <= 3.1.4 versions. | ||||
| CVE-2026-66672 | 2026-08-20 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Flatastic <= 2.0 versions. | ||||
| CVE-2025-15637 | 2026-08-20 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions. | ||||
| CVE-2025-62307 | 2026-08-20 | 5.4 Medium | ||
| HCL IntelliOps Event Management (IEM) is affected by insufficient logging. Insufficient logging weakens accountability, obscures attack detection, and enables privilege probing. | ||||
| CVE-2026-74020 | 2026-08-20 | 7.5 High | ||
| Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. | ||||
| CVE-2026-74019 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. | ||||
| CVE-2026-74018 | 2026-08-20 | 9.9 Critical | ||
| Subscriber Arbitrary File Upload in Warehouse Cargo <= 2.6.9 versions. | ||||
| CVE-2026-74013 | 2026-08-20 | 8.5 High | ||
| Subscriber SQL Injection in eShipper Commerce <= 2.16.13 versions. | ||||
| CVE-2026-73998 | 2026-08-20 | 8.5 High | ||
| Subscriber SQL Injection in WP w3all phpBB <= 3.0.5 versions. | ||||
| CVE-2026-66677 | 2026-08-20 | 7.6 High | ||
| Subscriber Broken Authentication in Leyka <= 3.32.3 versions. | ||||
| CVE-2026-66614 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.2 versions. | ||||
| CVE-2026-66606 | 2026-08-20 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SmartSMTP <= 1.2.0 versions. | ||||
| CVE-2026-66594 | 2026-08-20 | 8.5 High | ||
| Subscriber SQL Injection in WordPress Persistent Login <= 3.1.0 versions. | ||||
| CVE-2026-66583 | 2026-08-20 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Forminator <= 1.57.0 versions. | ||||
| CVE-2026-74021 | 2026-08-20 | 7.5 High | ||
| Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. | ||||
| CVE-2026-77084 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69 (and 2.x before 2.33.4 / 2.34.1) contains a code execution vulnerability in the Git node. The Git node executed certain repository-local git configuration values without neutralizing them, so any subsequent Git node operation against a repository containing a malicious value would execute it as the n8n process user. This is not reachable through the Git node's own configuration controls and requires a separate file-write vulnerability elsewhere to plant the malicious value. | ||||
| CVE-2026-77082 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69, 2.x before 2.33.4, and 2.34.x before 2.34.1 contains a regular expression denial of service (ReDoS) vulnerability in the Filter and Switch nodes, which compile user-supplied regex patterns with new RegExp() and execute them synchronously on the worker thread without complexity validation or execution timeout. A crafted regex pattern can block the worker for an extended period per data item processed, delaying other workflow executions on the same worker. | ||||
| CVE-2026-77081 | 1 N8n | 1 N8n | 2026-08-20 | N/A |
| n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enforces the allowed-domains policy of only the first credential while still attaching material from both. An authenticated user with workflow-authoring rights can thereby send a domain-restricted credential to an attacker-controlled endpoint, exfiltrating it with the leaked credential's permissions. | ||||