Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
40,572 matching · page 59/812Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-45129(opens NVD record) | Medium | 4.6 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes action=recovery_codes page regenerates Two-Factor Authentication recovery codes in mybb_adminoptions.recovery_codes on GET requests without request forgery protection. The uniquely identifying implementation details include admin/modules/home/preferences.php. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45128(opens NVD record) | Low | 3.5 | MyBB is free and open source forum software. Prior to 1.8.40, the ACP Users View Manager module does not validate requests correctly, allowing same-site attackers to change a victim administrator's default user list view by embedding a specially crafted URL. The Set as Default control named set_default in Admin CP, Users & Groups, Users, View Manager changes the administrator's default view on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Users → View Manager, and admin/inc/functions_view_manager.php. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45127(opens NVD record) | Low | 3.5 | MyBB is free and open source forum software. Prior to 1.8.40, the ACP Mass Mail module does not validate certain requests correctly, allowing same-site attackers to create draft entries from archived entries by embedding a specially crafted URL. The Resend route in Admin CP, Users & Groups, Mass Mail, Mass Mailing Archive duplicates archived mailing entries into new drafts with mybb_massemails.status set to 0 on GET requests without request forgery protection. The uniquely identifying implementation details include Users & Groups → Mass Mail → Mass Mailing Archive, mybb_massemails.status = 0, and admin/modules/user/mass_mail.php. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45126(opens NVD record) | Low | 3.5 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Security Questions module does not validate the anti-CSRF token correctly, allowing same-site attackers to enable or disable registration challenge questions with a specially crafted URL. The controller processes GET requests for the disable and enable actions to modify mybb_questions.active without verifying the my_post_key token attached by the user interface. The uniquely identifying implementation details include admin/modules/config/questions.php. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45125(opens NVD record) | Medium | 5.3 | MyBB is free and open source forum software. Prior to 1.8.40, the Email User controller does not sanitize sender names correctly, resulting in mail header injection. member.php?action=do_emailuser accepts the fromname HTTP parameter for guests or the stored username for authenticated users when the cansendemail group permission is enabled. When mail_handler is set to the default PHP mail value, the sender name is used without sanitization in Return-Path and Reply-To headers, allowing arbitrary headers to be injected with CRLF sequences. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45124(opens NVD record) | Medium | 4.3 | MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45123(opens NVD record) | Medium | 4.3 | MyBB is free and open source forum software. Prior to 1.8.40, the remote requests feature does not correctly handle IPv6 addresses, resulting in a server-side request forgery vulnerability. The default disallowed remote hosts list does not include IPv6 addresses. Verification in fetch_remote_file() fails open when get_ip_by_hostname() returns no result because that function does not return IPv6 results, allowing a crafted remote target to bypass the host restriction. The uniquely identifying implementation details include fail-open verification, and inc/functions.php. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45122(opens NVD record) | Medium | 4.3 | MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not validate moderation permissions for the destination calendar when moving events. A user with moderation permission for the source calendar can move an event to a calendar where the user has only viewing permission because the do_move action in calendar.php does not check canmoderateevents for the target calendar. The uniquely identifying implementation details include calendar event move, source calendar moderation permission, and destination calendar viewing permission. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45121(opens NVD record) | Medium | 4.3 | MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not check permissions consistently when listing calendars, allowing authenticated users to access titles of calendars that are otherwise inaccessible. The affected calendar-selection paths in calendar.php perform permission checks against an invalid calendar context before returning calendar titles. The uniquely identifying implementation details include titles of inaccessible calendars, and invalid calendar permission context. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45120(opens NVD record) | Medium | 5.4 | MyBB is free and open source forum software. Prior to 1.8.40, the calendar module does not verify private event status consistently, allowing users with viewing and moderation permissions to access and moderate private events. The private-event check used by get_events() in inc/functions_calendar.php and the event action is missing from the remaining calendar.php actions, despite the limited-access behavior described in inc/languages/english/calendar.lang.php. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45119(opens NVD record) | Medium | 4.6 | MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP UTF-8 Conversion module does not validate certain requests correctly, allowing same-site attackers to alter table encoding and deny service with a specially crafted URL. The do=all control flow in admin/modules/tools/system_health.php performs ALTER TABLE operations, column rewrite phases, and fulltext index rebuilds on GET requests for the database table named by the table parameter without request verification. The uniquely identifying implementation details include GET requests without request verification. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45118(opens NVD record) | Critical | 9.3 | MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb->input['from'] or the Referer HTTP header in $_SERVER['HTTP_REFERER'] and passes it to redirect() without sufficient verification. A javascript: URI becomes the target of the `Click here if you don't want to wait any longer` link because $force_redirect is true, allowing script execution when a victim selects the link. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45117(opens NVD record) | Critical | 9.8 | MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available. install/index.php processes the values with addcslashes(), but the $characters argument added in MyBB 1.8.13 does not include the backslash character, allowing crafted input to escape the generated PHP string. The uniquely identifying implementation details include introduced in MyBB 1.8.13. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45116(opens NVD record) | High | 8.7 | MyBB is free and open source forum software. Prior to 1.8.40, the user datahandler does not properly validate checkbox and multiselect profile field types, resulting in stored JavaScript code injection. UserDataHandler::verify_profile_fields() only performs the specialized validation when is_array($profile_fields[$field]) is true. A non-array profile_fields[fidX] value instead of the expected profile_fields[fidX][] shape falls through to generic text handling and is stored without verification. The affected value is then rendered directly by member.php and inc/functions_post.php rather than processed by the MyCode parser. The uniquely identifying implementation details include inc/datahandlers/user.php. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-45115(opens NVD record) | High | 8.7 | MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messages pass usernames through htmlspecialchars_uni(), which may leave single quotes unescaped. The payload is triggered when a victim chooses Yes in Please Confirm while removing the username in usercp.php, or selects the username through the onclick handler in the xmlhttp.php Select Buddies popup. The uniquely identifying implementation details include Private Messages Select Buddies list, and unescaped single quotes. This issue is fixed in version 1.8.40. | Aug 18, 2026 |
| CVE-2026-19501(opens NVD record) | High | 8.8 | CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows a remote attacker to execute spreadsheet formulas on an administrator's workstation when the exported CSV file is opened in a vulnerable spreadsheet application. | Aug 18, 2026 |
| CVE-2026-19500(opens NVD record) | High | 7.5 | The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which allows a remote attacker to exhaust server resources, prevent administrators from accessing the Entries interface, and trigger HTTP 500 errors via crafted form submissions. | Aug 18, 2026 |
| CVE-2026-15806(opens NVD record) | Unscored | — | The HTTPPasswordMgr class in the urllib.request module, along with its subclasses HTTPPasswordMgrWithDefaultRealm and HTTPPasswordMgrWithPriorAuth, did not take the URL scheme into account when matching stored credentials against a requested URL. Credentials added for an https:// URL were also used for requests to the same host over http://, so an attacker able to redirect or downgrade a client to plain HTTP (for example, via an HTTPS-to-HTTP redirect or an on-path position) could capture credentials in cleartext. Credentials added for http:// URLs could likewise be sent over https://. Credential matching is now scoped by URL scheme. Credentials registered with a URL that includes a scheme are only used for requests with the same scheme. Credentials registered with a bare authority (such as example.com or example.com:8080) continue to match any scheme, preserving compatibility with existing code, including proxy authentication. Users who cannot upgrade immediately can mitigate by ensuring that applications never make plain http:// requests to hosts for which credentials are registered, for example by not following redirects to http:// URLs. | Aug 18, 2026 |
| CVE-2026-12564(opens NVD record) | Critical | 9.6 | A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a HashiCorp Vault Secret Lookup credential with kubernetes_role authentication is tested. An authenticated attacker with credential-creation privileges can exfiltrate the service account token, gaining Kubernetes API access to the control plane namespaces with full pod CRUD and secret read permissions, including database credentials and the Django SECRET_KEY. | Aug 18, 2026 |
| CVE-2026-75898(opens NVD record) | High | 8.5 | RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py). The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or requests.put without calling the shared assert_url_is_safe validator or pinning the resolved address, unlike the crawler, SearXNG, file-upload, and RSS fetch paths. A user who can create or trigger an agent can direct the server to fetch loopback, link-local, and RFC 1918 destinations, including cloud instance metadata endpoints and services co-located on the deployment network, and the response body is returned as the component output. Where an agent is configured to interpolate the chat query into the Invoke URL, the destination is chosen by whoever can send that query. | Aug 18, 2026 |
| CVE-2026-75890(opens NVD record) | Unscored | — | Rejected reason: Duplicate of CVE-2026-50236. This CVE ID was reserved in error for a finding that already had an existing CVE assignment. | Aug 18, 2026 |
| CVE-2026-75872(opens NVD record) | Unscored | — | HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the first_name field of the subscription request, which is interpolated unescaped into the double opt-in verification email. | Aug 18, 2026 |
| CVE-2026-75784(opens NVD record) | Critical | 10.0 | A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01. Affected by this issue is the function FUN_0040da4c of the file /usr/nginx/sbin/nginx of the component HTTP Header Handler. The manipulation of the argument Server results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used. | Aug 18, 2026 |
| CVE-2026-75032(opens NVD record) | Medium | 6.3 | A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device. | Aug 18, 2026 |
| CVE-2026-74015(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | Aug 18, 2026 |
| CVE-2026-74012(opens NVD record) | High | 8.8 | Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection. This issue affects TaxoPress: from n/a through 3.51.0. | Aug 18, 2026 |
| CVE-2026-74009(opens NVD record) | Medium | 5.3 | Unauthenticated Insecure Direct Object References (IDOR) in Razorpay for WooCommerce <= 4.8.7 versions. | Aug 18, 2026 |
| CVE-2026-74008(opens NVD record) | Medium | 5.3 | Unauthenticated Sensitive Data Exposure in Shortcodes and extra features for Phlox theme <= 2.17.22 versions. | Aug 18, 2026 |
| CVE-2026-74007(opens NVD record) | Medium | 5.3 | Unauthenticated Sensitive Data Exposure in 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.20 versions. | Aug 18, 2026 |
| CVE-2026-74006(opens NVD record) | Medium | 4.3 | Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions. | Aug 18, 2026 |
| CVE-2026-74004(opens NVD record) | Medium | 5.4 | Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions. | Aug 18, 2026 |
| CVE-2026-74003(opens NVD record) | Medium | 4.3 | Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions. | Aug 18, 2026 |
| CVE-2026-73997(opens NVD record) | High | 7.5 | Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions. | Aug 18, 2026 |
| CVE-2026-73996(opens NVD record) | Critical | 9.8 | Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions. | Aug 18, 2026 |
| CVE-2026-73995(opens NVD record) | Medium | 5.4 | Subscriber Broken Authentication in User Registration <= 5.2.6 versions. | Aug 18, 2026 |
| CVE-2026-73994(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | Aug 18, 2026 |
| CVE-2026-73426(opens NVD record) | Medium | 4.6 | Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes attribute with a malicious payload that, when rendered, executes arbitrary JavaScript in the user's session and may perform unauthorized actions or disclose sensitive information. This issue is fixed in version 2.1.17. | Aug 18, 2026 |
| CVE-2026-73404(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions. | Aug 18, 2026 |
| CVE-2026-73400(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions. | Aug 18, 2026 |
| CVE-2026-73399(opens NVD record) | Medium | 6.5 | Unauthenticated Broken Authentication in Flutterwave WooCommerce <= 3.3.0 versions. | Aug 18, 2026 |
| CVE-2026-73398(opens NVD record) | Medium | 6.5 | Unauthenticated Broken Authentication in Piraeus Bank WooCommerce Payment Gateway 3.2.0 versions. | Aug 18, 2026 |
| CVE-2026-73397(opens NVD record) | Critical | 9.8 | Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. | Aug 18, 2026 |
| CVE-2026-73396(opens NVD record) | High | 7.1 | Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions. | Aug 18, 2026 |
| CVE-2026-73395(opens NVD record) | Medium | 6.5 | Unauthenticated Insecure Direct Object References (IDOR) in Booking calendar, Appointment Booking System <= 3.2.36 versions. | Aug 18, 2026 |
| CVE-2026-73393(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions. | Aug 18, 2026 |
| CVE-2026-73392(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Super Store Finder <= 7.8 versions. | Aug 18, 2026 |
| CVE-2026-73383(opens NVD record) | Medium | 4.9 | Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions. | Aug 18, 2026 |
| CVE-2026-73382(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.2.0 versions. | Aug 18, 2026 |
| CVE-2026-73381(opens NVD record) | Critical | 9.1 | Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions. | Aug 18, 2026 |
| CVE-2026-73380(opens NVD record) | Critical | 9.8 | Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | Aug 18, 2026 |