Export limit exceeded: 425932 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425932 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125440 | 2 Cristián Lávaque, Wordpress-extensions | 2 S2member, S2member | 2026-11-14 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cristián Lávaque s2Member s2member allows Code Injection.This issue affects s2Member: from n/a through 261106. | ||||
| CVE-2026-125834 | 2 Wordpress-extensions, Wp Media | 2 Imagify, Imagify | 2026-11-14 | 4.3 Medium |
| Missing Authorization vulnerability in WP Media Imagify imagify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imagify: from n/a through 2.3.4. | ||||
| CVE-2026-128991 | 1 Stefan Schippers | 1 Xschem | 2026-11-14 | 5.3 Medium |
| xschem 2.9.9 through 3.4.7 contains an out-of-bounds read vulnerability in read_xschem_file() in src/save.c that mishandles embedded-symbol records lacking a preceding instance. Attackers can supply a crafted schematic beginning with a "[" record, causing xschem to read and dereference memory below the instance array and crash. | ||||
| CVE-2026-128990 | 1 Stefan Schippers | 1 Xschem | 2026-11-14 | 7.8 High |
| xschem 2.9.9 through 3.4.7 contains a heap out-of-bounds write vulnerability in read_dataset() in src/rawtovcd.c due to an unchecked variable index. Attackers can supply a crafted ngspice .raw file that, when converted with rawtovcd, writes file-controlled heap pointers at chosen signed offsets, corrupting heap memory. | ||||
| CVE-2026-123975 | 1 Grid Community Forum | 2 Globus-gss-assist, Grid Community Toolkit | 2026-11-14 | 7.5 High |
| Grid Community Toolkit before 6.2.20261111 (globus-gss-assist before 12.9) contains a heap out-of-bounds write in globus_gss_assist_token_get_fd() triggered by SSLv2 record lengths below 3. Remote unauthenticated clients can send a crafted GSI handshake record to services like globus-gatekeeper and myproxy to corrupt heap memory and crash the service. | ||||
| CVE-2026-103769 | 2 Acowebs, Wordpress-extensions | 2 Pdf Invoices And Packing Slips For Woocommerce, Pdf Invoices And Packing Slips For Woocommerce | 2026-11-14 | 7.2 High |
| Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10. | ||||
| CVE-2026-125852 | 2 Realtyna, Wordpress-extensions | 2 Realtyna Organic Idx Plugin, Realtyna Organic Idx Plugin | 2026-11-14 | 7.7 High |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows Path Traversal.This issue affects Realtyna Organic IDX plugin: from n/a through 5.5.0. | ||||
| CVE-2026-125853 | 2 Everestthemes, Wordpress-extensions | 2 Everest Backup, Everest Backup | 2026-11-14 | 6.5 Medium |
| Missing Authorization vulnerability in Everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through 2.3.15. | ||||
| CVE-2026-125837 | 2 Thethemefoundry, Wordpress-extensions | 2 Make, Make | 2026-11-14 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thethemefoundry Make make allows Reflected XSS.This issue affects Make: from n/a through 1.10.10. | ||||
| CVE-2026-125855 | 2 Elextensions, Wordpress-extensions | 2 Elex Wordpress Helpdesk & Customer Ticketing System, Elex Wordpress Helpdesk & Customer Ticketing System | 2026-11-14 | 9.8 Critical |
| Deserialization of Untrusted Data vulnerability in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Object Injection.This issue affects ELEX WordPress HelpDesk & Customer Ticketing System: from n/a through 3.3.9. | ||||
| CVE-2026-125858 | 2 Cleverreach, Wordpress-extensions | 2 Cleverreach® Wp, Cleverreach Wp | 2026-11-14 | 6.3 Medium |
| Missing Authorization vulnerability in CleverReach CleverReach® WP cleverreach-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CleverReach® WP: from n/a through 1.5.26. | ||||
| CVE-2026-124970 | 2 Wordpress-extensions, Wp Base | 2 Wp Base Booking, Wp Base Booking | 2026-11-14 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP BASE WP BASE Booking wp-base-booking-of-appointments-services-and-events allows Blind SQL Injection.This issue affects WP BASE Booking: from n/a through 6.5.2. | ||||
| CVE-2026-124420 | 2 Themeisle, Wordpress-extensions | 2 Woody Ad Snippets, Woody Ad Snippets | 2026-11-14 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10. | ||||
| CVE-2026-124267 | 2 Noor Alam, Wordpress-extensions | 2 Gmail Smtp, Gmail Smtp | 2026-11-14 | 7.5 High |
| Missing Authorization vulnerability in Noor Alam Gmail SMTP gmail-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gmail SMTP: from n/a through 1.2.3.23. | ||||
| CVE-2026-124415 | 2 Alejandro, Wordpress-extensions | 2 Alex Reservations, Alex Reservations | 2026-11-14 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8. | ||||
| CVE-2026-125432 | 2 Relywp, Wordpress-extensions | 2 Recaptcha For Woocommerce, Recaptcha For Woocommerce | 2026-11-14 | 5.3 Medium |
| Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7. | ||||
| CVE-2026-63079 | 1 Rbh Access Technologies | 1 Integra32 Security Management System | 2026-11-14 | 9.8 Critical |
| RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host. | ||||
| CVE-2026-105671 | 1 Zenitel | 1 Zenitel Connect | 2026-11-14 | N/A |
| The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests. | ||||
| CVE-2026-129105 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 6.5 Medium |
| Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process. | ||||
| CVE-2026-129104 | 1 Shenzhen Cudy Technology | 1 Tr3000 | 2026-11-14 | 6.5 Medium |
| Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq. | ||||