Export limit exceeded: 421198 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421198 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421198 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421198 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123357 | 1 Grobidorg | 1 Grobid | 2026-11-07 | 0 Low |
| GROBID is machine learning software for extracting information from scholarly documents. Prior to 0.9.1, the Linux non-server PDF conversion path in grobid-core/src/main/java/org/grobid/core/document/DocumentSource.java passes an attacker-influenced PDF filename through DocumentSource.pdfalto, which interpolates the path into a bash -c command string. A single quote in the filename can terminate the intended quoting, and ProcessRunner.run in grobid-core/src/main/java/org/grobid/core/process/ProcessRunner.java starts the resulting command through ProcessBuilder, allowing arbitrary commands to execute with GROBID process privileges. The bundled REST server path is not affected. This issue is fixed in version 0.9.1. | ||||
| CVE-2026-123321 | 1 Jetbrains | 1 Webstorm | 2026-11-07 | 7.8 High |
| In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects | ||||
| CVE-2026-123317 | 1 Jetbrains | 1 Ktor | 2026-11-07 | 8.1 High |
| In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies | ||||
| CVE-2026-123307 | 1 Jetbrains | 1 Intellij Idea | 2026-11-07 | 6.8 Medium |
| In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible | ||||
| CVE-2026-123306 | 1 Jetbrains | 1 Intellij Idea | 2026-11-07 | 7.4 High |
| In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs | ||||
| CVE-2026-123297 | 1 Jetbrains | 1 Hub | 2026-11-07 | 6.8 Medium |
| In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow | ||||
| CVE-2026-123295 | 1 Jetbrains | 1 Hub | 2026-11-07 | 8.1 High |
| In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint | ||||
| CVE-2026-123148 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in TMS IvyForms ivyforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IvyForms: from n/a through 1.5.1. | ||||
| CVE-2026-122675 | 2026-11-07 | 5.4 Medium | ||
| Cross-Site Request Forgery (CSRF) vulnerability in Wpmet Wp Social wp-social allows Cross Site Request Forgery.This issue affects Wp Social: from n/a through 3.2.3. | ||||
| CVE-2026-122670 | 2 Wordpress-extensions, Wp Syntex | 2 Polylang, Polylang | 2026-11-07 | 5.4 Medium |
| Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Polylang: from n/a through 3.9. | ||||
| CVE-2026-122668 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-122660 | 2026-11-07 | 4.3 Medium | ||
| Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FloristPress: from n/a through 7.8.5. | ||||
| CVE-2026-122659 | 2026-11-07 | 5.4 Medium | ||
| Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0. | ||||
| CVE-2026-122041 | 2026-11-07 | 9.1 Critical | ||
| The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of arbitrary attachments due to a missing capability/ownership check in the ajax_remove_uploaded() function in versions up to, and including, 3.8.0. The handler is registered for both wp_ajax and wp_ajax_nopriv and is gated solely by the 'file_handling_nonce' nonce, which is emitted inside the public checkout page markup (data-nonce attribute) whenever a File Upload checkout field is configured. This makes it possible for unauthenticated attackers to delete arbitrary attachments (including those belonging to other users or posts) by submitting a crafted attachment_id, which can lead to loss of important media and potential denial of service. | ||||
| CVE-2026-121783 | 2 Passionate Programmer Peter, Wordpress-extensions | 2 Wp Data Access, Wp Data Access | 2026-11-07 | 6.5 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Passionate Programmer Peter WP Data Access wp-data-access allows Cross Site Request Forgery.This issue affects WP Data Access: from n/a through 5.5.90. | ||||
| CVE-2026-121781 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Booking: from n/a through 2.5.0. | ||||
| CVE-2026-121779 | 2026-11-07 | 5.3 Medium | ||
| Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Subscription yith-woocommerce-subscription allows Retrieve Embedded Sensitive Data.This issue affects YITH WooCommerce Subscription: from n/a through 4.22.0. | ||||
| CVE-2026-121778 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in WP Lab WP-Lister Lite for Amazon wp-lister-for-amazon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for Amazon: from n/a through 2.9.2. | ||||
| CVE-2026-121775 | 2026-11-07 | 5.3 Medium | ||
| Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CURCY: from n/a through 2.2.20. | ||||
| CVE-2026-121766 | 2026-11-07 | 5.4 Medium | ||
| Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PowerPress Podcasting: from n/a through 11.18.0. | ||||