Export limit exceeded: 420867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420867 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118549 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118548 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 3.7 Low |
| Incorrect Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Resource Injection. This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118546 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118545 | 1 Drupal | 1 Artificial Intelligence | 2026-11-06 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scripting (XSS). This issue affects AI (Artificial Intelligence) versions: from 0.0.0 to 1.4.11, from 1.5.0 to 1.5.2. | ||||
| CVE-2026-118543 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 5.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Commerce Core allows Cross Site Request Forgery. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-118542 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 2.7 Low |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-118541 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 4.3 Medium |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41.0, from 3.0.0 to 3.3.13. | ||||
| CVE-2026-118540 | 1 Drupal | 1 Commerce Core | 2026-11-06 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.2.0. | ||||
| CVE-2026-114573 | 1 Drupal | 1 Monster Menus | 2026-11-06 | 8.8 High |
| Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Monster Menus allows Object Injection. This issue affects Monster Menus versions: from 0.0.0 to 9.5.6. | ||||
| CVE-2026-114571 | 1 Drupal | 1 Rabbit Hole | 2026-11-06 | 6.5 Medium |
| Incorrect Authorization vulnerability in Drupal Rabbit Hole allows Forceful Browsing. This issue affects Rabbit Hole versions: from 0.0.0 to 1.3.0. | ||||
| CVE-2026-123326 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.1 High |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension | ||||
| CVE-2026-120749 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more | 2026-11-06 | 6.2 Medium |
| A flaw was found in D-Bus. With a privileged Monitoring client attached (for example dbus-monitor or busctl monitor), an unprivileged local user can cause dbus-daemon to abort if a driver-originated broadcast such as NameOwnerChanged or ActivatableServicesChanged cannot be delivered to a recipient (for example due to a deny rule or an exceeded outgoing message queue). Driver broadcasts still use serial 0; when delivery fails, composing the monitor error reply asserts reply_serial != 0 and aborts the daemon. This is an incomplete fix for CVE-2023-34969, which only assigned serials for driver messages sent to a single recipient. On the well-known system bus this is a denial of service. | ||||
| CVE-2026-120550 | 2 Wordpress-extensions, Wpusermanager | 2 Wp User Manager, Wp User Manager | 2026-11-06 | 6.4 Medium |
| The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (REST users endpoint) -> wp_users.display_name' parameter in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is stored via the WordPress core REST endpoint POST /wp-json/wp/v2/users/me, which bypasses the plugin's own wpum_sanitize_text sanitizer applied on its front-end account form, making the save-time sanitization ineffective as a mitigation. | ||||
| CVE-2026-123323 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 8.4 High |
| In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send REST requests without user confirmation | ||||
| CVE-2026-123335 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.5 Low |
| In JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization allowed attaching tags to any issue via the tag issues collection | ||||
| CVE-2026-123337 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19656 users without update permission could change issue visibility | ||||
| CVE-2026-115431 | 2026-11-06 | 7.1 High | ||
| Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-offer-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Upsell Order Bump Offer for WooCommerce: from n/a through 3.1.6. | ||||
| CVE-2026-115952 | 2026-11-06 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.58.3. | ||||
| CVE-2026-123301 | 1 Jetbrains | 1 Intellij Idea | 2026-11-06 | 8.2 High |
| In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible | ||||
| CVE-2026-123276 | 1 Jetbrains | 1 Clion | 2026-11-06 | 7.8 High |
| In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile | ||||