Export limit exceeded: 367457 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (367457 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-43694 | 1 Malwarebytes | 1 Malwarebytes | 2026-04-15 | 5.2 Medium |
| An issue was discovered in Malwarebytes 4.6.14.326 and before and 5.1.5.116 and before (and Nebula 2020-10-21 and later). An Out of bounds read in several disassembling utilities causes stability issues and denial of service. | ||||
| CVE-2023-42772 | 1 Intel | 112 Core I9-10900x X-series Firmware, Core I9-10920x X-series Firmware, Core I9-10940x X-series Firmware and 109 more | 2026-04-15 | 8.2 High |
| Untrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to potentially enable escalation of privilege via local access. | ||||
| CVE-2023-42667 | 1 Intel | 1 Core Ultra Processor | 2026-04-15 | 7.8 High |
| Improper isolation in the Intel(R) Core(TM) Ultra Processor stream cache mechanism may allow an authenticated user to potentially enable escalation of privilege via local access. | ||||
| CVE-2023-42427 | 1 Japan System Techniques | 1 Universal Passport Rx | 2026-04-15 | 6.5 Medium |
| Cross-site scripting vulnerability exists in UNIVERSAL PASSPORT RX versions 1.0.0 to 1.0.7, which may allow a remote authenticated attacker to execute an arbitrary script on the web browser of the user who is using the product. | ||||
| CVE-2023-42133 | 1 Paxtechnology | 1 Paydroid | 2026-04-15 | 6.7 Medium |
| PAX Android based POS devices allow for escalation of privilege via improperly configured scripts. An attacker must have shell access with system account privileges in order to exploit this vulnerability. A patch addressing this issue was included in firmware version PayDroid_8.1.0_Sagittarius_V11.1.61_20240226. | ||||
| CVE-2023-41928 | 2026-04-15 | 5.3 Medium | ||
| The device is observed to accept deprecated TLS protocols, increasing the risk of cryptographic weaknesses. | ||||
| CVE-2023-41927 | 2026-04-15 | 5.3 Medium | ||
| The server supports at least one cipher suite which is on the NCSC-NL list of cipher suites to be phased out, increasing the risk of cryptographic weaknesses. | ||||
| CVE-2023-41926 | 2026-04-15 | 8.8 High | ||
| The webserver utilizes basic authentication for its user login to the configuration interface. As encryption is disabled on port 80, it enables potential eavesdropping on user traffic, making it possible to intercept their credentials. | ||||
| CVE-2023-41923 | 2026-04-15 | 7.2 High | ||
| The user management section of the web application permits the creation of user accounts with excessively weak passwords, including single-character passwords. | ||||
| CVE-2023-41921 | 2026-04-15 | 9.8 Critical | ||
| A vulnerability allows attackers to download source code or an executable from a remote location and execute the code without sufficiently verifying the origin and integrity of the code. This vulnerability can allow attackers to modify the firmware before uploading it to the system, thus achieving the modification of the target’s integrity to achieve an insecure state. | ||||
| CVE-2023-41918 | 2026-04-15 | 10 Critical | ||
| A vulnerability allows unauthorized access to functionality inadequately constrained by ACLs. Attackers may exploit this to unauthenticated execute commands potentially leading to unauthorized data manipulation, access to privileged functions, or even the execution of arbitrary code. | ||||
| CVE-2023-41917 | 2026-04-15 | 10 Critical | ||
| Inadequate input validation exposes the system to potential remote code execution (RCE) risks. Attackers can exploit this vulnerability by appending shell commands to the Speed-Measurement feature, enabling unauthorized code execution. | ||||
| CVE-2023-41833 | 1 Ieisystem | 1 Uefi Firmware | 2026-04-15 | 7.5 High |
| A race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escalation of privilege via local access. | ||||
| CVE-2025-68750 | 1 Linux | 1 Linux Kernel | 2026-04-15 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: usb: potential integer overflow in usbg_make_tpg() The variable tpgt in usbg_make_tpg() is defined as unsigned long and is assigned to tpgt->tport_tpgt, which is defined as u16. This may cause an integer overflow when tpgt is greater than USHRT_MAX (65535). I haven't tried to trigger it myself, but it is possible to trigger it by calling usbg_make_tpg() with a large value for tpgt. I modified the type of tpgt to match tpgt->tport_tpgt and adjusted the relevant code accordingly. This patch is similar to commit 59c816c1f24d ("vhost/scsi: potential memory corruption"). | ||||
| CVE-2023-41134 | 1 Wordpress | 1 Wordpress | 2026-04-15 | 5.3 Medium |
| Authentication Bypass by Spoofing vulnerability in pluginkollektiv Antispam Bee allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Antispam Bee: from n/a through 2.11.3. | ||||
| CVE-2022-4532 | 2026-04-15 | 6.5 Medium | ||
| The LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 2.1. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address from logging in. | ||||
| CVE-2022-4534 | 1 Wp-buy | 1 Limit Login Attempts | 2026-04-15 | 5.3 Medium |
| The Limit Login Attempts (Spam Protection) plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can supply the X-Forwarded-For header with with a different IP Address that will be logged and can be used to bypass settings that may have blocked out an IP address or country from logging in. | ||||
| CVE-2022-45811 | 1 Wordpress | 1 Wordpress | 2026-04-15 | 5.4 Medium |
| Missing Authorization vulnerability in WeyHan Ng Post Teaser.This issue affects Post Teaser: from n/a through 4.1.5. | ||||
| CVE-2022-45929 | 1 Northern.tech | 1 Mender | 2026-04-15 | 8.8 High |
| Northern.tech Mender 3.3.x before 3.3.2, 3.5.x before 3.5.0, and 3.6.x before 3.6.0 has Incorrect Access Control and allows users to change their roles and could allow privilege escalation from a low-privileged read-only user to a high-privileged user. | ||||
| CVE-2024-13743 | 2 Wonderplugin, Wordpress | 2 Wonder Video Embed, Wordpress | 2026-04-15 | 6.4 Medium |
| The Wonder Video Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wonderplugin_video shortcode in all versions up to, and including, 2.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||