Export limit exceeded: 386286 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386286 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85302 | 2026-09-03 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2. | ||||
| CVE-2026-84766 | 2026-09-03 | 5.9 Medium | ||
| Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. | ||||
| CVE-2026-81295 | 2026-09-03 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions. | ||||
| CVE-2026-84238 | 2026-09-03 | 9.8 Critical | ||
| Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. | ||||
| CVE-2026-81773 | 2026-09-03 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | ||||
| CVE-2026-19475 | 1 Grafana | 4 Grafana, Microsoft Sql Server Datasource, Mysql Datasource and 1 more | 2026-09-03 | 6.5 Medium |
| An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro through a WHERE clause, which Grafana's regex-based macro parsing does not reject. Evaluating the injected macro causes uncontrolled memory consumption that can terminate the Grafana server process, resulting in a denial of service. The Microsoft SQL Server, PostgreSQL, and MySQL data sources are affected. | ||||
| CVE-2026-84848 | 2026-09-03 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. | ||||
| CVE-2026-84847 | 2026-09-03 | 7.5 High | ||
| Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. | ||||
| CVE-2026-84812 | 2026-09-03 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | ||||
| CVE-2026-84778 | 2026-09-03 | 7.5 High | ||
| Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions. | ||||
| CVE-2026-84776 | 2026-09-03 | 7.5 High | ||
| Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. | ||||
| CVE-2026-84769 | 2026-09-03 | 6.5 Medium | ||
| Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions. | ||||
| CVE-2026-84767 | 2026-09-03 | 5.3 Medium | ||
| Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. | ||||
| CVE-2026-84758 | 2026-09-03 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | ||||
| CVE-2026-84754 | 2026-09-03 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. | ||||
| CVE-2026-84753 | 2026-09-03 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. | ||||
| CVE-2026-81776 | 2026-09-03 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | ||||
| CVE-2026-81282 | 2026-09-03 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. | ||||
| CVE-2026-81281 | 2026-09-03 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. | ||||
| CVE-2026-51689 | 1 Totolink | 1 T6 | 2026-09-03 | 9.1 Critical |
| Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||