Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
36,842 matching · page 159/737Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-19293(opens NVD record) | High | 8.8 | SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below. | Aug 13, 2026 |
| CVE-2026-19292(opens NVD record) | High | 8.8 | Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below. | Aug 13, 2026 |
| CVE-2026-19291(opens NVD record) | High | 8.8 | Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below. | Aug 13, 2026 |
| CVE-2026-16101(opens NVD record) | High | 8.8 | Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below | Aug 13, 2026 |
| CVE-2026-15994(opens NVD record) | High | 7.0 | During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges. | Aug 13, 2026 |
| CVE-2026-14456(opens NVD record) | High | 7.5 | Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | Aug 13, 2026 |
| CVE-2026-14256(opens NVD record) | Medium | 4.7 | ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash. | Aug 13, 2026 |
| CVE-2026-12036(opens NVD record) | High | 7.1 | An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges. | Aug 13, 2026 |
| CVE-2026-73403(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. | Aug 13, 2026 |
| CVE-2026-73401(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions. | Aug 13, 2026 |
| CVE-2026-73357(opens NVD record) | Medium | 6.5 | Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | Aug 13, 2026 |
| CVE-2026-73353(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions. | Aug 13, 2026 |
| CVE-2026-73349(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | Aug 13, 2026 |
| CVE-2026-73346(opens NVD record) | High | 7.6 | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. | Aug 13, 2026 |
| CVE-2026-73344(opens NVD record) | Medium | 5.9 | Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | Aug 13, 2026 |
| CVE-2026-73340(opens NVD record) | Medium | 6.5 | Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions. | Aug 13, 2026 |
| CVE-2026-73188(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610. | Aug 13, 2026 |
| CVE-2026-67991(opens NVD record) | High | 7.5 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service. | Aug 13, 2026 |
| CVE-2026-67990(opens NVD record) | Medium | 5.4 | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services. | Aug 13, 2026 |
| CVE-2026-67986(opens NVD record) | High | 8.4 | amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names. | Aug 13, 2026 |
| CVE-2026-66704(opens NVD record) | High | 7.2 | Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions. | Aug 13, 2026 |
| CVE-2026-66700(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions. | Aug 13, 2026 |
| CVE-2026-66698(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions. | Aug 13, 2026 |
| CVE-2026-66697(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. | Aug 13, 2026 |
| CVE-2026-66693(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in Motors <= 1.4.113 versions. | Aug 13, 2026 |
| CVE-2026-66691(opens NVD record) | Critical | 9.8 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | Aug 13, 2026 |
| CVE-2026-66689(opens NVD record) | Medium | 6.3 | Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions. | Aug 13, 2026 |
| CVE-2026-66687(opens NVD record) | Medium | 6.5 | Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions. | Aug 13, 2026 |
| CVE-2026-66661(opens NVD record) | High | 7.7 | Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. | Aug 13, 2026 |
| CVE-2026-66660(opens NVD record) | Medium | 6.5 | Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. | Aug 13, 2026 |
| CVE-2026-66658(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Reviewer <= 3.14.2 versions. | Aug 13, 2026 |
| CVE-2026-66657(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | Aug 13, 2026 |
| CVE-2026-66656(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. | Aug 13, 2026 |
| CVE-2026-66655(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. | Aug 13, 2026 |
| CVE-2026-66654(opens NVD record) | Medium | 6.0 | Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions. | Aug 13, 2026 |
| CVE-2026-66653(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. | Aug 13, 2026 |
| CVE-2026-66478(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | Aug 13, 2026 |
| CVE-2026-66472(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | Aug 13, 2026 |
| CVE-2026-66471(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions. | Aug 13, 2026 |
| CVE-2026-66469(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | Aug 13, 2026 |
| CVE-2026-66468(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Local Delivery Drivers for WooCommerce <= 3.0.0 versions. | Aug 13, 2026 |
| CVE-2026-66467(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in FluentCommunity <= 2.7.5 versions. | Aug 13, 2026 |
| CVE-2026-66466(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions. | Aug 13, 2026 |
| CVE-2026-66465(opens NVD record) | Critical | 9.8 | Unauthenticated Broken Authentication in Cartify <= 1.3.0.1 versions. | Aug 13, 2026 |
| CVE-2026-66464(opens NVD record) | Medium | 6.5 | Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. | Aug 13, 2026 |
| CVE-2026-66463(opens NVD record) | High | 7.5 | Unauthenticated Sensitive Data Exposure in iCARRY <= 2.9 versions. | Aug 13, 2026 |
| CVE-2026-66462(opens NVD record) | High | 7.5 | Unauthenticated Sensitive Data Exposure in WooCommerce Appointments <= 5.3.8 versions. | Aug 13, 2026 |
| CVE-2026-66461(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions. | Aug 13, 2026 |
| CVE-2026-66460(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in AfterShip Tracking <= 1.18.1 versions. | Aug 13, 2026 |
| CVE-2026-66459(opens NVD record) | Medium | 6.5 | Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions. | Aug 13, 2026 |