Export limit exceeded: 425047 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425047 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121876 | 1 Redhat | 3 Enterprise Linux, Openshift, Rhel Els | 2026-11-12 | 7.9 High |
| A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation. | ||||
| CVE-2026-127119 | 1 Aws | 1 Aws-sdk-pandas | 2026-11-12 | 5.3 Medium |
| Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from 1.1.0 before 3.18.0 might allow remote actors to read Amazon EMR cluster logs, including job step output, via a pre-created S3 bucket. To remediate this issue, users should upgrade to version 3.18.0 or later. Users who can't upgrade immediately should pass an explicit log location, or create the default EMR log bucket in their own account in each region they use. | ||||
| CVE-2026-119529 | 1 Wordpress-extensions | 1 Gravity Forms | 2026-11-12 | 5.9 Medium |
| The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled. | ||||
| CVE-2026-121497 | 1 Wordpress-extensions | 1 Askany | 2026-11-12 | 9.8 Critical |
| The AskAny WordPress plugin before 2.2.0 does not validate the extension or content of files attached to chat messages, trusting the browser-supplied file type instead, which allows unauthenticated users to upload PHP files and execute arbitrary code when visitor attachments are enabled. | ||||
| CVE-2026-115735 | 1 Wordpress-extensions | 1 Somatic Framework | 2026-11-12 | 9.6 Critical |
| The Somatic Framework WordPress plugin through 1.8.14 does not perform an authorization check or validate a user-supplied file path before deleting it, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a full site takeover. | ||||
| CVE-2026-119032 | 2026-11-12 | 5.3 Medium | ||
| The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not check that the importing user may edit the posts named in a settings backup, nor restrict the import to its own post types, allowing users whose role an administrator has granted access to the Schema & Structured Data for WP & AMP WordPress plugin before 1.70's settings to modify, re-author, unpublish or trash any post or page on the site and write arbitrary post meta. | ||||
| CVE-2026-118241 | 1 Wordpress-extensions | 1 Smush | 2026-11-12 | 2.7 Low |
| The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup. | ||||
| CVE-2026-123667 | 1 Wordpress-extensions | 1 Photo Engine | 2026-11-12 | 6.4 Medium |
| The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names before storing them and outputting them on its debugging page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks against administrators who have enabled that page. | ||||
| CVE-2026-123668 | 1 Wordpress-extensions | 1 Getpaid | 2026-11-12 | 5.3 Medium |
| The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole numbers, allowing unauthenticated users to have an invoice for a priced item marked as paid without being charged. | ||||
| CVE-2026-92408 | 2026-11-12 | 5.3 Medium | ||
| The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input before using it to set the product price, allowing unauthenticated users to purchase bookable services at a price of their choosing, including zero. | ||||
| CVE-2026-88813 | 2026-11-12 | 5.3 Medium | ||
| The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues against the amount actually paid for it, instead crediting the new card with the item's pre-discount price, which allows customers to apply an ordinary store coupon at checkout and receive a gift card worth more than they paid. | ||||
| CVE-2026-109870 | 2026-11-12 | 8.1 High | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not verify that a discount coupon applied to a paid membership plan is actually valid for that plan before treating a fully discounted order as paid, allowing unauthenticated users to be granted the role mapped to a paid plan without paying for it, which can lead to privilege escalation up to administrator where a plan is mapped to a privileged role. | ||||
| CVE-2026-109873 | 2026-11-12 | 5.3 Medium | ||
| The User Registration & Membership WordPress plugin before 5.3.2 does not enforce its payment-before-login restriction when a registration is submitted without a membership selection, allowing unauthenticated users to create an account on a payment-gated registration form and log in without completing payment. | ||||
| CVE-2026-110016 | 1 Wordpress-extensions | 1 Data Tables Generator By Supsystic | 2026-11-12 | 5.3 Medium |
| The Data Tables Generator by Supsystic WordPress plugin before 1.15.8 does not perform any authorization or ownership check before returning the stored contents of a table, relying only on a nonce that is exposed to every anonymous visitor, allowing unauthenticated users to read the full contents of any table by its identifier, including tables that are never published anywhere on the site. | ||||
| CVE-2026-111579 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-12 | 8.1 High |
| The Forminator Forms WordPress plugin before 1.58.4 does not enforce payment on the server side when a form's configured payment gateway is unavailable, allowing unauthenticated visitors to complete a payment-gated User Registration form without paying and be assigned the form's configured role, up to administrator, after the gateway has been connected and later disconnected. | ||||
| CVE-2026-111597 | 1 Wordpress-extensions | 1 Forminator Forms | 2026-11-12 | 5.3 Medium |
| The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying. | ||||
| CVE-2026-115733 | 1 Wordpress-extensions | 1 Printaura Woocommerce Api | 2026-11-12 | 9.1 Critical |
| The Printaura-Woocommerce WordPress plugin through 4.0.2 does not properly restrict access to the WooCommerce REST API, causing every WooCommerce REST route to accept unauthenticated requests, which allows unauthenticated attackers to read and modify store data including customer orders and personal information, store and payment settings, and webhooks. | ||||
| CVE-2026-115734 | 1 Wordpress-extensions | 1 Pay With A Tweet | 2026-11-12 | 9.6 Critical |
| The Pay with a tweet WordPress plugin through 1.0.5 does not validate a file path before deleting it, nor does it restrict access to the relevant administration screens, allowing users with a role as low as Subscriber to delete arbitrary files on the server, which can lead to a full site compromise. | ||||
| CVE-2026-117521 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 6.8 Medium |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape a user-controlled profile value before outputting it in a quoted attribute in one of its Elementor widgets, allowing authenticated users with the Author role to store a payload that executes in the session of anyone, including an administrator, who views a post the attacker authored, resulting in Stored Cross-Site Scripting. | ||||
| CVE-2026-117522 | 1 Wordpress-extensions | 1 Dynific Addons For Elementor | 2026-11-12 | 6.8 Medium |
| The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not escape the post title before outputting it in a quoted HTML attribute in one of its Elementor widgets, allowing authenticated users with the Author role to publish a post whose title executes as script in the session of anyone, including an administrator, who views it, resulting in Stored Cross-Site Scripting. | ||||