Export limit exceeded: 105669 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (105669 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102324 | 1 Google | 1 Chrome | 2026-09-30 | 8.3 High |
| Use after free in PictureInPicture in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102326 | 1 Google | 1 Chrome | 2026-09-30 | 8.8 High |
| Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102328 | 1 Google | 1 Chrome | 2026-09-30 | 8.8 High |
| Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95322 | 1 Google | 2 Android, Chrome | 2026-09-30 | 8.3 High |
| Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-65488 | 2 La-studioweb, Wordpress | 2 Element Kit For Elementor, Wordpress | 2026-09-30 | 7.1 High |
| Cross-Site Request Forgery (CSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Stored XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2. | ||||
| CVE-2026-80110 | 1 Redhat | 3 Certificate System, Dogtag Certificate System, Enterprise Linux | 2026-09-30 | 8.1 High |
| A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both match. In the CA's profile-management REST API this allows a request to POST /v2/profiles/raw -- intended to require Administrator-level profiles.create permission -- to instead be authorized under the lower-privileged profiles.approve permission held by the default Certificate Manager Agents group. The highest threat from this vulnerability is to confidentiality and integrity of the certificate authority's issuance policy. | ||||
| CVE-2025-13808 | 1 Orionsec | 2 Orion-ops, Orion Ops | 2026-09-30 | 7.3 High |
| A flaw has been found in orionsec orion-ops up to 5925824997a3109651bbde07460958a7be249ed1. Affected by this vulnerability is the function update of the file orion-ops-api/orion-ops-web/src/main/java/cn/orionsec/ops/controller/UserController.java of the component User Profile Handler. This manipulation of the argument ID causes improper authorization. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-62540 | 1 Oracle | 2 Cost Management, E-business Suite | 2026-09-30 | 7.2 High |
| Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-97293 | 2026-09-30 | 8.5 High | ||
| Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. | ||||
| CVE-2026-97253 | 2026-09-30 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0. | ||||
| CVE-2026-97245 | 2026-09-30 | 7.2 High | ||
| Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. | ||||
| CVE-2026-97244 | 2026-09-30 | 7.5 High | ||
| Contributor Path Traversal in Creator LMS <= 1.2.19 versions. | ||||
| CVE-2026-97241 | 2026-09-30 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in BackupEase <= 2.2.2 versions. | ||||
| CVE-2026-97240 | 2026-09-30 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in StifLi Backup Tools <= 2.2.7 versions. | ||||
| CVE-2026-97237 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions. | ||||
| CVE-2026-97235 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions. | ||||
| CVE-2026-97197 | 2026-09-30 | 7.5 High | ||
| Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions. | ||||
| CVE-2026-97077 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions. | ||||
| CVE-2026-97065 | 2026-09-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions. | ||||
| CVE-2026-96838 | 2026-09-30 | 8.8 High | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions. | ||||