Export limit exceeded: 402013 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (402013 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104399 | 2026-10-06 | N/A | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in StylemixThemes Motors allows Retrieve Embedded Sensitive Data. This issue affects Motors: from n/a through 1.4.124. | ||||
| CVE-2026-94206 | 1 Danielberkompas | 2 Cloak, Cloak Ecto | 2026-10-06 | N/A |
| Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The dump/1 callback that Cloak.Ecto.PBKDF2 (Cloak.Fields.PBKDF2 in cloak before the Ecto code moved to cloak_ecto) injects into a field module calls :pbkdf2.pbkdf2/4 with config[:size] in the iteration-count position. The :iterations setting is validated but never used. With the cloak_ecto defaults (iterations: 600_000, size: 32) each hash runs 32 PBKDF2 rounds instead of 600,000, so offline guessing of values such as email addresses costs about 18,750 times less than configured. This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. | ||||
| CVE-2026-95105 | 1 Danielberkompas | 1 Cloak | 2026-10-06 | N/A |
| Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking vulnerability in danielberkompas cloak allows an attacker with write access to stored ciphertext to make it decrypt to a chosen value via bit flipping. Cloak.Ciphers.AES.CTR encrypts with AES-256 in CTR mode and stores the key tag, the IV and the ciphertext with no MAC. decrypt/2 checks only the key tag and the minimum length before it returns the plaintext, and Cloak.Ciphers.Deprecated.AES.CTR decrypts the legacy format the same way. CTR is a stream cipher, so a value XORed into the stored ciphertext is XORed into the plaintext at the same offset. An attacker who can write to the encrypted store (for example through SQL injection or a compromised replica) and who knows or can guess a stored plaintext can replace it with any value of the same length. The application receives that value with no error. This issue affects cloak: from 0.1.0-pre onward. | ||||
| CVE-2026-49762 | 1 Elixir-lang | 1 Elixir | 2026-10-06 | 5.9 Medium |
| Uncontrolled Resource Consumption vulnerability in the Elixir standard library's Version module allows an attacker who controls a version string to cause a denial of service through CPU and memory exhaustion. The version parser converts numeric version components (major, minor, patch and numeric pre-release/build identifiers) to integers without bounding their length. A single large all-digit component therefore forces a super-linear, non-yielding base-10 to arbitrary-precision integer conversion (String.to_integer/1, i.e. :erlang.binary_to_integer/1) that pins a BEAM scheduler, and a larger component raises an uncaught SystemLimitError that crashes the calling process. A single moderately sized string (around one megabyte) is enough; no authentication is required. This is reachable from the public entry points Version.parse/1, Version.parse!/1, Version.match?/3, Version.compare/2, and Version.parse_requirement/1, which applications routinely call on untrusted input such as HTTP parameters, dependency-manifest fields, and package metadata. This vulnerability is associated with program files lib/version.ex and program routines 'Elixir.Version.Parser':parse_digits/2. This issue affects elixir: from 0.9.3 before 1.20.1. | ||||
| CVE-2026-105317 | 2026-10-06 | 8.5 High | ||
| Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions. | ||||
| CVE-2026-105071 | 2026-10-06 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in SiteVault – Backup, Restore, Migration & Cloning <= 1.5.17 versions. | ||||
| CVE-2026-105070 | 2026-10-06 | 8.8 High | ||
| Unauthenticated Privilege Escalation in Salon booking system <= 10.31.7 versions. | ||||
| CVE-2026-105061 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions. | ||||
| CVE-2026-105059 | 2026-10-06 | 6.5 Medium | ||
| Subscriber Broken Access Control in Delete All Comments of wordpress <= 7.1 versions. | ||||
| CVE-2026-105058 | 2026-10-06 | 8.8 High | ||
| Subscriber Privilege Escalation in WP User Profiles <= 2.7.3 versions. | ||||
| CVE-2026-105057 | 2026-10-06 | 5.3 Medium | ||
| Unauthenticated Bypass Vulnerability in Zero Spam <= 5.7.11 versions. | ||||
| CVE-2026-104814 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions. | ||||
| CVE-2026-104757 | 2026-10-06 | 7.2 High | ||
| Editor Privilege Escalation in Import and export users and customers <= 2.5.5 versions. | ||||
| CVE-2026-104747 | 2026-10-06 | 8.1 High | ||
| Unauthenticated PHP Object Injection in Haaken <= 1.5 versions. | ||||
| CVE-2026-104672 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions. | ||||
| CVE-2026-104670 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions. | ||||
| CVE-2026-104406 | 2026-10-06 | 7.3 High | ||
| Unauthenticated Broken Access Control in picu <= 3.10.1 versions. | ||||
| CVE-2026-104405 | 2026-10-06 | 8.1 High | ||
| Unauthenticated Privilege Escalation in GiveWP <= 4.17.0 versions. | ||||
| CVE-2026-104395 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions. | ||||
| CVE-2026-104394 | 2026-10-06 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions. | ||||