Export limit exceeded: 425894 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425894 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110960 | 2026-11-15 | N/A | ||
| The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account. | ||||
| CVE-2026-110987 | 2026-11-15 | N/A | ||
| The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it inside an inline script block on several of its admin screens, allowing unauthenticated attackers to inject arbitrary JavaScript that executes in the session of an administrator who is tricked into opening a crafted link. | ||||
| CVE-2026-114451 | 2026-11-15 | N/A | ||
| The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a schema-altering database maintenance routine, allowing unauthenticated users to convert the Membership Plugin WordPress plugin before 4.0.6's own tables to a narrower character set, which irreversibly replaces every 4-byte character (such as emoji and some CJK characters) in the membership level, discount code and payment records with a question mark. | ||||
| CVE-2026-124671 | 1 Wordpress-extensions | 1 Burst Statistics | 2026-11-15 | N/A |
| The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for. | ||||
| CVE-2026-124673 | 1 Wordpress-extensions | 1 Burst Statistics | 2026-11-15 | N/A |
| The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts. | ||||
| CVE-2026-127048 | 2026-11-15 | N/A | ||
| The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes, as its permission checks return a non-error response that WordPress treats as granted, allowing unauthenticated users to execute arbitrary PHP code on the server. | ||||
| CVE-2026-13409 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 4.3 Medium |
| The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account. | ||||
| CVE-2026-14542 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 6.7 Medium |
| The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-63288 | 2026-11-15 | 8.3 High | ||
| A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer. | ||||
| CVE-2026-4762 | 1 Axis Communications Ab | 1 Axis Camera Station Pro | 2026-11-15 | 8.8 High |
| A vulnerability to perform a privilege escalation attack on the server as a non-admin user. | ||||
| CVE-2026-8372 | 1 Axis Communications Ab | 1 Axis Camera Station Pro | 2026-11-15 | 8.8 High |
| A vulnerability that could allow an attacker to gain unauthorized access. | ||||
| CVE-2026-12389 | 1 Axis Communications Ab | 1 Axis Camera Station Pro | 2026-11-15 | 8.4 High |
| A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack. | ||||
| CVE-2026-12963 | 1 Axis Communications Ab | 2 Axis Camera Station, Axis Camera Station Pro | 2026-11-15 | 7.4 High |
| A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on the server. | ||||
| CVE-2026-12964 | 1 Axis Communications Ab | 1 Axis Camera Station Pro | 2026-11-15 | 8 High |
| A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges. | ||||
| CVE-2026-13312 | 1 Axis Communications Ab | 2 Axis Camera Station, Axis Camera Station Pro | 2026-11-15 | 9.9 Critical |
| A vulnerability that could allow an attacker to compromise a system. | ||||
| CVE-2026-112137 | 2026-11-15 | 5.4 Medium | ||
| A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server. | ||||
| CVE-2026-101275 | 2026-11-15 | N/A | ||
| Our payment integration with Adyen did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid tickets with only one payment. | ||||
| CVE-2026-110984 | 2026-11-15 | N/A | ||
| The RegistrationMagic WordPress plugin before 6.1.0.4 does not sanitise and escape a parameter before using it in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks. | ||||
| CVE-2026-103361 | 2026-11-15 | N/A | ||
| The Payment Gateway via Valitor for WooCommerce WordPress plugin before 1.9.41 does not properly validate the authenticity of payment callbacks, relying on a verification secret that ships with a hard-coded default value used by every store that has not changed it, allowing unauthenticated attackers to forge a valid payment confirmation and mark arbitrary orders as paid. | ||||
| CVE-2026-125715 | 1 Samsung Open Source | 1 Mtower | 2026-11-15 | 5.3 Medium |
| Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or use a close existing sessions if thier identifiers are known, The impact depends on the affected TA. | ||||