Export limit exceeded: 417679 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 417679 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417679 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84224 | 1 Wordpress-extensions | 1 Kirki | 2026-10-25 | 4.1 Medium |
| The Kirki WordPress plugin before 6.3.2 does not validate the host of a URL it is given before fetching it, allowing users with editor-level access and above to make the site issue requests to internal services that are not otherwise reachable, and to tell which of those are live from the response. | ||||
| CVE-2026-94663 | 2 Metagauss, Wordpress-extensions | 2 Profilegrid, Profilegrid | 2026-10-25 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Blind SQL Injection.This issue affects ProfileGrid: from n/a through 6.0.0.2. | ||||
| CVE-2026-107866 | 2 Crocoblock, Wordpress-extensions | 2 Jetelements For Elementor, Jetelements For Elementor | 2026-10-25 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3. | ||||
| CVE-2026-54869 | 1 Idxbroker | 1 Impress For Idx Broker | 2026-10-25 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1. | ||||
| CVE-2026-69914 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-25 | 5.5 Medium |
| Out-of-bounds read in Windows AppX Deployment Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-84020 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-25 | 7 High |
| Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85837 | 1 Microsoft | 10 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 7 more | 2026-10-25 | 7.8 High |
| Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103520 | 2 Hivepress, Wordpress-extensions | 2 Hivepress, Hivepress | 2026-10-25 | 6.4 Medium |
| The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom text attribute (user-defined field name)' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when an administrator has configured a Text attribute whose display format places the %value% token inside an HTML attribute (e.g., title="%value%"), which is a documented HivePress pattern. | ||||
| CVE-2026-83871 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-25 | 7 High |
| Heap-based buffer overflow in OpenSSH for Windows allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-84016 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-25 | 7.8 High |
| Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-94256 | 1 Wordpress-extensions | 1 Sms Alert | 2026-10-25 | 8.1 High |
| The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs to, allowing unauthenticated attackers to sign in as any user with a stored phone number, including an administrator, by completing a code challenge on a phone they control. | ||||
| CVE-2026-85370 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-25 | 7 High |
| Use after free in WebDAV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-85374 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-25 | 5.5 Medium |
| Out-of-bounds read in Windows Installer allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-85798 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-25 | 7.2 High |
| Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-85811 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-25 | 7.5 High |
| Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-85915 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-25 | 7.8 High |
| Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-102857 | 1 Microsoft | 5 365 Apps, Microsoft Office Ltsc 2021, Microsoft Office Ltsc 2024 and 2 more | 2026-10-25 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69909 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-25 | 7.8 High |
| Heap-based buffer overflow in Microsoft COM for Windows allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69945 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-25 | 8.8 High |
| Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69957 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-25 | 7.8 High |
| Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally. | ||||