Export limit exceeded: 386960 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386960 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-46944 | 1 Oracle | 1 Isupport | 2026-08-13 | 9.1 Critical |
| Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). | ||||
| CVE-2026-46945 | 1 Oracle | 1 Isupport | 2026-08-13 | 9.1 Critical |
| Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle iSupport. While the vulnerability is in Oracle iSupport, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle iSupport. CVSS 3.1 Base Score 9.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H). | ||||
| CVE-2026-27539 | 2 Welcart, Wordpress | 2 Welcart E-commerce, Wordpress | 2026-08-13 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. | ||||
| CVE-2026-27999 | 2 Themefic, Wordpress | 2 Tourfic, Wordpress | 2026-08-13 | 6.5 Medium |
| Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. | ||||
| CVE-2026-61962 | 2 Hakan Ozevin, Wordpress | 2 Wp Base Booking, Wordpress | 2026-08-13 | 10 Critical |
| Unauthenticated Arbitrary Code Execution in WP BASE Booking <= 6.3.0 versions. | ||||
| CVE-2026-72673 | 1 Elastic | 1 Kibana | 2026-08-13 | 5.4 Medium |
| Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized deletion of Synthetics private locations via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). Synthetics private locations can be shared with more than one space, and deleting one removes it from every space it is shared with. The safeguard that prevented the deletion of a private location still in use evaluated only the monitors visible in the requesting user's own space, so monitors that depend on the private location in other spaces were not taken into account. As a result, an authenticated Kibana user holding the Synthetics write privilege in a single space could delete a private location that other spaces still depend on, even where the user has no access to those spaces. Deleting the private location removes the shared configuration and stops the monitors in the other spaces from running, which suppresses the availability monitoring those spaces rely on. | ||||
| CVE-2026-46600 | 1 Golang | 1 Net | 2026-08-13 | 7.5 High |
| Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer. | ||||
| CVE-2026-72856 | 1 Budibase | 1 Budibase | 2026-08-13 | 8.1 High |
| Budibase versions before 3.40.0 contain an authorization/authentication bypass in the PUT /api/global/users/tenant/owner (changeTenantOwnerEmail) endpoint. On self-hosted instances (SELF_HOSTED or DISABLE_ACCOUNT_PORTAL set), the cloudRestricted middleware is a no-op and the route is protected only by a general authentication check, so any authenticated user — including a lowest-privilege BASIC app user — can reassign the tenant account-holder (top-privilege admin) email to an attacker-controlled address. The attacker can then use the public password-reset flow to take over the admin account, leading to full administrative access. | ||||
| CVE-2026-19751 | 1 Enzovezzaro | 1 Mcp-dominican-layer | 2026-08-13 | 6.3 Medium |
| A flaw has been found in EnzoVezzaro mcp-dominican-layer up to 39dd373786712650097ad31db27d5c477c8f9c82. The affected element is the function axios.get of the file src/index.ts of the component parse-csv tool. This manipulation of the argument csvUrl causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2025-59327 | 1 Cpsd | 1 Cryptopro Secure Disk | 2026-08-13 | 7.5 High |
| In CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4, bootxsa.efi fails to properly validate LUKS encryption and, if encryption is present, all CryptoPro file integrity checks are skipped. | ||||
| CVE-2026-28188 | 2 Themefic, Wordpress | 2 Hydra Booking, Wordpress | 2026-08-13 | 7.3 High |
| Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions. | ||||
| CVE-2026-66471 | 2 Themepoints, Wordpress | 2 Accordion, Wordpress | 2026-08-13 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions. | ||||
| CVE-2026-66689 | 2 Acymailing Newsletter Team, Wordpress | 2 Anti Spam And List Cleaner – Acychecker, Wordpress | 2026-08-13 | 6.3 Medium |
| Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions. | ||||
| CVE-2026-19750 | 1 Tenda | 3 Ch, Cp, Tx3 | 2026-08-13 | 8.1 High |
| A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used. | ||||
| CVE-2026-72675 | 1 Elastic | 1 Kibana | 2026-08-13 | 7.1 High |
| Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions and relies on a per-request space filter to keep the machine learning data of one space separated from another. Part of the Machine Learning functionality did not apply that filter, so operations issued from one space were carried out against the machine learning data of every space in the deployment. | ||||
| CVE-2026-72672 | 1 Elastic | 1 Kibana | 2026-08-13 | 7.7 High |
| The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the caller's Elasticsearch index privileges are not. An authenticated user who holds Elastic Security feature privileges but no read access to the Elastic Defend event indices can therefore retrieve field values from that data, including process command line arguments, which commonly contain tokens, credentials, connection strings, and other sensitive operational detail from protected hosts. | ||||
| CVE-2026-72671 | 1 Elastic | 1 Kibana | 2026-08-13 | 4.3 Medium |
| A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose role grants create anomaly detection jobs and data frame analytics jobs without the trained model privilege can therefore remove a trained model from a space. The model itself is not deleted and remains available in its other spaces, and the change can be reversed by a suitably privileged user. | ||||
| CVE-2026-72669 | 1 Elastic | 1 Kibana | 2026-08-13 | 7.6 High |
| The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can therefore discover the onboarding flows of other users, read their onboarding state, and write arbitrary progress data into them. A tampered flow can also cause the owner's onboarding view to fail with a server error. | ||||
| CVE-2026-72661 | 1 Elastic | 1 Kibana | 2026-08-13 | 6.5 Medium |
| Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security Solution and endpoint privileges that its user-facing equivalents require, and it retrieved data with elevated internal permissions rather than the permissions of the requesting user. As a result, an authenticated low-privileged Kibana user with no Security Solution privileges, endpoint privileges and no Elasticsearch privileges on the underlying data, could read endpoint response action records and the corresponding response content returned by managed hosts. | ||||
| CVE-2026-72631 | 1 Elastic | 1 Kibana | 2026-08-13 | 6.5 Medium |
| Improper Privilege Management (CWE-269) in Kibana Fleet can lead to privilege escalation via Privilege Escalation (CAPEC-233). An integration policy may optionally declare extra data streams that the integration writes to, which Fleet adds to the Elasticsearch API key issued to Elastic Agents enrolled in the corresponding agent policy. The resulting key allows new documents to be inserted and index mappings to be extended for specific indices. The key does not allow reading, updating, or deleting existing documents | ||||