Export limit exceeded: 400567 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400567 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103388 | 1 Misp | 1 Misp | 2026-09-30 | N/A |
| MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim's browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected: <2.5.48. | ||||
| CVE-2026-62540 | 1 Oracle | 2 Cost Management, E-business Suite | 2026-09-30 | 7.2 High |
| Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Cost Management. Successful attacks of this vulnerability can result in takeover of Oracle Cost Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-97302 | 2026-09-30 | 5.3 Medium | ||
| Unauthenticated Sensitive Data Exposure in MPG <= 4.2.3 versions. | ||||
| CVE-2026-97301 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | ||||
| CVE-2026-97299 | 2026-09-30 | 5.4 Medium | ||
| Unauthenticated Cross Site Request Forgery (CSRF) in Razorpay Payment Links for WooCommerce <= 2.1.5 versions. | ||||
| CVE-2026-97298 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. | ||||
| CVE-2026-97293 | 2026-09-30 | 8.5 High | ||
| Contributor SQL Injection in Media LIbrary Assistant <= 3.41 versions. | ||||
| CVE-2026-97292 | 2026-09-30 | 6.5 Medium | ||
| Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions. | ||||
| CVE-2026-97270 | 2026-09-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions. | ||||
| CVE-2026-97267 | 2026-09-30 | 4.3 Medium | ||
| Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions. | ||||
| CVE-2026-97266 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions. | ||||
| CVE-2026-97262 | 2026-09-30 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions. | ||||
| CVE-2026-97261 | 2026-09-30 | 5.3 Medium | ||
| Unauthenticated Sensitive Data Exposure in Notivo <= 1.4.2 versions. | ||||
| CVE-2026-97253 | 2026-09-30 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0. | ||||
| CVE-2026-97249 | 2026-09-30 | 5.3 Medium | ||
| Unauthenticated Bypass Vulnerability in Paid Member Subscriptions <= 3.0.9 versions. | ||||
| CVE-2026-97248 | 2026-09-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Booking Activities <= 1.18.7.1 versions. | ||||
| CVE-2026-97247 | 2026-09-30 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions. | ||||
| CVE-2026-97246 | 2026-09-30 | 4.9 Medium | ||
| Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions. | ||||
| CVE-2026-97245 | 2026-09-30 | 7.2 High | ||
| Shop Worker Privilege Escalation in SureCart <= 4.7.2 versions. | ||||
| CVE-2026-97244 | 2026-09-30 | 7.5 High | ||
| Contributor Path Traversal in Creator LMS <= 1.2.19 versions. | ||||