Export limit exceeded: 422006 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 422006 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422006 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118795 | 1 Compugroup Medical | 3 Infantia, Profim, Venere | 2026-11-09 | N/A |
| Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access. | ||||
| CVE-2026-118798 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise. | ||||
| CVE-2026-95648 | 1 C-prot | 1 Appdefense | 2026-11-09 | 8.1 High |
| Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729. | ||||
| CVE-2026-16283 | 1 Osbil Technology | 1 Opanel | 2026-11-09 | 8.8 High |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66. | ||||
| CVE-2026-95779 | 1 Hpe | 1 Morpheus Software | 2026-11-09 | 8.8 High |
| An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software. | ||||
| CVE-2025-10248 | 1 Opentext | 1 Filr | 2026-11-09 | N/A |
| XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack. | ||||
| CVE-2026-112165 | 2026-11-09 | N/A | ||
| The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications. | ||||
| CVE-2026-115213 | 2026-11-09 | 9.8 Critical | ||
| The EASY-JS-WPAPI Client HANDLE for the WordPress REST-API WordPress plugin through 2.0 does not prevent the administrator credentials it stores from being disclosed to unauthenticated users and does not correctly verify authentication, allowing unauthenticated attackers to obtain administrator credentials and gain full administrator access to the site. | ||||
| CVE-2026-118201 | 2026-11-09 | 7.5 High | ||
| The Limit Login Attempts Security WordPress plugin before 3.4.1 does not enforce its two-factor authentication on every password-authentication route, so an attacker who already knows a protected user's password can authenticate through an alternative login interface and obtain that user's access without completing the second factor. | ||||
| CVE-2026-121874 | 2026-11-09 | 7.2 High | ||
| The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site administrator on a multisite network who is not a Super Admin to overwrite arbitrary options of their site, including the role definitions, and so grant themselves network-management capabilities. | ||||
| CVE-2026-121875 | 2026-11-09 | 7.2 High | ||
| The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its permissions settings, allowing a site administrator on a multisite network who is not a Super Admin to grant any role arbitrary capabilities, including the network-management capabilities reserved to the Super Admin. | ||||
| CVE-2026-123088 | 2026-11-09 | 5.3 Medium | ||
| The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address). | ||||
| CVE-2026-123091 | 2026-11-09 | 7.5 High | ||
| The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than the default WordPress one, allowing an attacker who knows a user's password to skip the second factor and log in as that user. | ||||
| CVE-2026-111421 | 1 Apache | 1 Airflow | 2026-11-09 | 8.8 High |
| Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied elsewhere, so a Dag author's task could write an XCom that, when a user later viewed it through the API with deserialization enabled, made the API server instantiate classes from the `airflow.*` namespace with arguments the Dag author chose. This is an incomplete fix for CVE-2026-59242: users who applied that fix in apache-airflow 3.3.1 remain affected through this route and should upgrade to apache-airflow 3.4.0 or later. | ||||
| CVE-2026-120367 | 1 Apache | 1 Apache Axis2/java | 2026-11-09 | 7.5 High |
| Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/Java. The JSON message builders, including the Gson, Moshi and HTTP/2 variants, buffered the entire request body with no size limit, so an unauthenticated caller could exhaust server memory with a large JSON request. Version 2.0.2 bounds JSON request bodies with the configurable jsonMaxRequestSize parameter. This issue affects Apache Axis2/Java: through 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue. | ||||
| CVE-2026-121842 | 1 Mozilla | 1 Firefox For Ios | 2026-11-09 | 8.8 High |
| Privilege escalation in the Reader View component in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0. | ||||
| CVE-2026-121843 | 1 Mozilla | 1 Firefox For Ios | 2026-11-09 | 8.8 High |
| Privilege escalation in Firefox for iOS. This vulnerability was fixed in Firefox for iOS 160.0. | ||||
| CVE-2026-94249 | 1 Tubitak Bilgem Software Technologies Research Institute | 1 Liderahenk | 2026-11-09 | 8.1 High |
| Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse. This issue affects Liderahenk: before 2.0.3. | ||||
| CVE-2026-92606 | 1 Tubitak Bilgem Software Technologies Research Institute | 1 Pardus Os My Computer | 2026-11-09 | 6 Medium |
| Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions. This issue affects Pardus MyComputer: from 0.8.0 before 0.8.1. | ||||
| CVE-2026-94434 | 1 Tubitak Bilgem Software Technologies Research Institute | 1 Pardus Boot Repair | 2026-11-09 | 8.8 High |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection. This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9. | ||||