Export limit exceeded: 425783 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425783 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-128970 | 1 Esaqa | 1 Psono | 2026-11-13 | 5.4 Medium |
| Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership matching the target group, the authenticated user, and share_admin=True, but omits accepted=True. An authenticated remote attacker who has been invited to a group with share-admin privileges, and who knows a group share-right UUID, can therefore delete that group's share-right record without accepting the invitation or after declining it. Pending invitations have accepted=None, while declined invitations retain accepted=False and the share_admin flag. Deletion revokes the group's access to the affected share and its contained secrets for all accepted group members, without deleting the underlying data or disclosing secret contents. The issue was fixed in version 7.5.1 of both editions, released on 2026-10-13. | ||||
| CVE-2026-125821 | 2 Pt Norther Lights Production, Wordpress-extensions | 2 Mapsvg, Mapsvg | 2026-11-13 | 5.3 Medium |
| Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Code Injection.This issue affects MapSVG: from n/a through 9.0.4. | ||||
| CVE-2026-125810 | 2 Mycred, Wordpress-extensions | 2 Mycred, Mycred | 2026-11-13 | 4.3 Medium |
| Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2. | ||||
| CVE-2026-121776 | 2 Wordpress-extensions, Wpchill | 2 Passster, Passster | 2026-11-13 | 6.5 Medium |
| Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Passster: from n/a through 4.3.20. | ||||
| CVE-2026-14447 | 2026-11-13 | 2.3 Low | ||
| In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55297 | 2026-11-13 | 6.4 Medium | ||
| In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory modification due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-55360 | 2026-11-13 | 8.4 High | ||
| In secure_transport_usecase_handshake of secure_transport.c, there is a possible way to bypass secure transport channel encryption due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56897 | 2026-11-13 | 4.0 Medium | ||
| In multiple functions of attestation_object.c, there is a possible way to disclose uninitialized secure element stack memory in key attestation certificates due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56909 | 2026-11-13 | 6.7 Medium | ||
| In multiple functions of sswrp_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56929 | 2026-11-13 | 7.8 High | ||
| In TrustyKeyMintManager::VerifyHat of trusty_keymint_manager.cc, there is a possible Security check bypass due to a logic error in the code. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. | ||||
| CVE-2026-56947 | 2026-11-13 | 4.0 Medium | ||
| In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-56971 | 2026-11-13 | 9.8 Critical | ||
| In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-63166 | 2 Agora-project, Omnispace | 2 Agora-project, Agora Project | 2026-11-13 | 6.1 Medium |
| Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context. | ||||
| CVE-2026-107523 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-11-13 | 8.7 High |
| Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service. | ||||
| CVE-2026-125802 | 2 Brainstormforce, Wordpress-extensions | 2 Spectra, Spectra | 2026-11-13 | 5.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Retrieve Embedded Sensitive Data.This issue affects Spectra: from n/a through 2.20.5. | ||||
| CVE-2026-107522 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-11-13 | 7.2 High |
| Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator. | ||||
| CVE-2026-82175 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-11-13 | 3.8 Low |
| Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. A high-privileged attacker could exploit this vulnerability to reach internal network services from the appliance. | ||||
| CVE-2026-125452 | 2 Denishua, Wordpress-extensions | 2 Wpjam Basic, Wpjam Basic | 2026-11-13 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM Basic wpjam-basic allows Reflected XSS.This issue affects WPJAM Basic: from n/a through 7.1.2. | ||||
| CVE-2026-120835 | 2 Villatheme, Wordpress-extensions | 2 Affi – Affiliate Marketing For Woocommerce, Affi - Affiliate Marketing For Woocommerce | 2026-11-13 | 8.8 High |
| Deserialization of Untrusted Data vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Object Injection.This issue affects AFFI – Affiliate Marketing for WooCommerce: from n/a through 1.0.11. | ||||
| CVE-2026-129180 | 1 Projectworlds | 1 Visitor Management System | 2026-11-13 | 7.3 High |
| A flaw has been found in projectworlds Visitor Management System 1.0. This vulnerability affects the function mysqli_query of the file actionpage.php. This manipulation of the argument purpose causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. | ||||