Lucene search
+L

108256 matches found

Cvelist
Cvelist
added 2026/07/24 4:40 a.m.43 views

CVE-2026-16870 Multiple Security Vulnerabilities in Snowflake libsnowflakeclient

Multiple security vulnerabilities in Snowflake libsnowflakeclient versions prior to 2.9.2 could allow remote code execution and credential exfiltration. A stack-based buffer overflow in the file download path could allow remote code execution on a victim host. An attacker could exploit this by...

8.8CVSS0.00362EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/24 4:16 a.m.9 views

CVE-2026-15420

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

4.3CVSS0.00586EPSS
SaveExploits0References10
NVD
NVD
added 2026/07/24 4:16 a.m.12 views

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

5.3CVSS0.00343EPSS
SaveExploits0References8
CVE
CVE
added 2026/07/24 2:32 a.m.25 views

CVE-2026-11354

The CVE-2026-11354 entry affects the WordPress plugin Participants Database (versions up to 2.7.8.3). The vulnerability is a Missing Authorization issue via the id parameter, allowing unauthenticated attackers to overwrite arbitrary participant records and redirect the private_id‑bearing record-a...

5.3CVSS5.6AI score0.00239EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/07/24 2:32 a.m.37 views

CVE-2026-11354 Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the...

5.3CVSS0.00239EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/24 2:31 a.m.24 views

CVE-2026-13464

The CVE concerns Kirki for WordPress (

5.3CVSS5.6AI score0.00343EPSS
SaveExploits0References8
EUVD
EUVD
added 2026/07/24 2:31 a.m.7 views

EUVD-2026-48464

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

4.3CVSS5.5AI score0.00586EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/07/24 2:31 a.m.37 views

CVE-2026-15420 Nexter Blocks <= 5.0.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary CSS/JS File Deletion via 'plus_name' Parameter

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plusname' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

4.3CVSS0.00586EPSS
SaveExploits0References10
ATTACKERKB
ATTACKERKB
added 2026/07/24 2:31 a.m.10 views

CVE-2026-13464

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

5.3CVSS5.5AI score0.00343EPSS
SaveExploits0References9
CVE
CVE
added 2026/07/24 2:31 a.m.29 views

CVE-2026-15420

The CVE-2026-15420 entry concerns Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder for WordPress. Affected component: the WordPress plugin itself (Nexter Blocks) with a Directory Traversal flaw exploitable via the plus_name parameter. Impact: authenticated attackers with subscr...

4.3CVSS5.5AI score0.00586EPSS
SaveExploits0References10
Cvelist
Cvelist
added 2026/07/24 2:31 a.m.39 views

CVE-2026-13464 Kirki <= 6.0.14 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

5.3CVSS0.00343EPSS
SaveExploits0References8
SUSE CVE
SUSE CVE
added 2026/07/24 2:21 a.m.9 views

SUSE CVE-2026-46600

Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

6.5CVSS5.8AI score0.00339EPSS
SaveExploits0References4
Positive Technologies
Positive Technologies
added 2026/07/24 12:0 a.m.16 views

PT-2026-64229

The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 5.0.0 via the 'plus name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, ...

4.3CVSS5.5AI score0.00586EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/07/24 12:0 a.m.17 views

PT-2026-64291

External control of Assumed-Immutable web parameter vulnerability in ABIS Technology Ltd. Co. AVESİS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects AVESİS: before 202606251646...

5.3CVSS5.8AI score0.00197EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/07/24 12:0 a.m.21 views

PT-2026-64227

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.0.14 via the 'context' parameter due to missing validation on a user controlled key. This makes it possible for...

5.3CVSS5.5AI score0.00343EPSS
SaveExploits0References9
CNVD
CNVD
added 2026/07/24 12:0 a.m.6 views

Apache Syncope SQL Injection Vulnerability (CNVD-2026-30664)

Apache Syncope is an open-source identity management system, primarily used for managing the identity lifecycle of enterprise-level users and devices. Apache Syncope has a SQL injection vulnerability. This vulnerability stems from improper handling of the sort parameter in the Audit Events search...

9.8CVSS6AI score0.00496EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/07/24 12:0 a.m.21 views

PT-2026-64224

The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant records by numeric ID and redirect the priva...

5.3CVSS5.5AI score0.00239EPSS
SaveExploits0References7
NVD
NVD
added 2026/07/23 10:16 p.m.13 views

CVE-2026-65694

Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter. Attackers can send a single unauthenticated HTTP GET...

8.7CVSS0.02456EPSS
SaveExploits1References2
Cvelist
Cvelist
added 2026/07/23 9:45 p.m.36 views

CVE-2026-16765 CodeAstro Online Classroom loginlinkadmin.php sql injection

A vulnerability was determined in CodeAstro Online Classroom 1.0. Affected by this issue is some unknown functionality of the file /OnlineClassroom/loginlinkadmin.php. Executing a manipulation of the argument aid can lead to sql injection. The attack can be executed remotely. The exploit has been...

7.5CVSS0.00263EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/23 9:20 p.m.46 views

CVE-2026-65694

Microweber CMS up to version 2.0.20 is affected by a path traversal in the static file controller. The vulnerability allows unauthenticated remote attackers to read arbitrary files by supplying directory traversal sequences in the path query parameter, exploiting normalize_path() failure to strip...

8.7CVSS5.6AI score0.02456EPSS
SaveExploits1References2
Rows per page
Query Builder