Export limit exceeded: 413023 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (664 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16538 | 1 Wordpress-extensions | 1 Wallet For Woocommerce | 2026-11-11 | 9.1 Critical |
| The Wallet for WooCommerce WordPress plugin before 1.6.10 does not verify the amount actually collected for a wallet top-up before crediting the wallet, allowing customers to top up their wallet balance for less than its value. | ||||
| CVE-2026-14842 | 1 Wordpress-extensions | 1 Events Made Easy | 2026-11-11 | 5.3 Medium |
| The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged, allowing unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid. | ||||
| CVE-2026-16298 | 1 Wordpress-extensions | 1 Foodboxbooker | 2026-11-11 | 9.8 Critical |
| The FoodBoxBooker WordPress plugin before 1.0.7 does not properly validate the password reset request, allowing unauthenticated attackers to reset the password of arbitrary users, including administrators, which could lead to a full site takeover. | ||||
| CVE-2026-126626 | 2026-11-11 | 5.3 Medium | ||
| The web services listener of Progressive Robot hMailServer 6.3.3 through 6.3.7 counts every failed CardDAV, CalDAV or Autodiscover sign-in from a proxy it trusts - one on the same machine, or one named in WebServicesTrustedProxies, whose X-Forwarded-Proto it believes - against the proxy's own address, which allows a remote unauthenticated attacker who can reach the proxy to have that address banned from the server's mail listeners. The listener, off by default (WebServicesHttpPort and WebServicesHttpsPort 0), signs an account in with HTTP Basic over HTTPS for CardDAV from 6.3.3 and for CalDAV and Outlook Autodiscover from 6.3.4. Behind a TLS-terminating proxy, which the server trusts when it is on the same machine or named in WebServicesTrustedProxies, the listener takes the client's HTTPS from the proxy's X-Forwarded-Proto header, but it does not believe X-Forwarded-For and sees the proxy's address for every client. Each failed sign-in counted towards the auto-ban against that address, so that failed sign-ins through the proxy from anybody, under any user name, reaching MaxInvalidLogonAttempts (3 within 30 minutes by default) wrote an IP range that refused the proxy's address at the SMTP, POP3, IMAP and ManageSieve listeners for AutoBanMinutes (60 by default), and could write it again each time it lapsed. For a proxy on the same machine that address is the loopback address, so that a webmail on that machine, local scripts that submit mail and the other local clients of the mail listeners were shut out; for a proxy at another address that also carries mail, every mail client behind it was. Such a proxy forwarding to the listener's HTTPS port, re-encrypting, was counted against in the same way, and listing it in WebServicesTrustedProxies did not spare it. The auto-ban is on by default and AutoBanNeverBan, which spares an address, is empty by default; the listener itself went on serving the proxy. | ||||
| CVE-2026-96414 | 2026-11-11 | N/A | ||
| In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of permissions assigned to a user that allowed them to view users or audit events, could result in the user escalating their privileges to those of an Administrator. | ||||
| CVE-2026-126186 | 2026-11-10 | 8.8 High | ||
| Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.1.4.1 and 8.0.5.2, ActiveStorage::Blob#open writes a blob to a tempfile whose name carries the extension of the uploaded filename, and hands that path to ffprobe (VideoAnalyzer, AudioAnalyzer), ffmpeg (VideoPreviewer) and ImageMagick (ImageAnalyzer, the :mini_magick variant processor). These tools select a decoder from the file extension when the content does not identify its own format, so an attacker who chooses the filename and declares the content type of an upload chooses which decoder processes it. An FFmpeg built with AviSynth support treats a file with the .avs extension as an AviSynth script and evaluates it, which could disclose files readable by the application process through the preview image, or load a native library the attacker has also uploaded, possibly leading to remote code execution in the FFmpeg process. ImageMagick selects its coders and delegates from the extension in the same way. An application is affected if it accepts uploads from untrusted users and analyzes video or audio attachments, generates video previews, or processes images with ImageMagick. The AviSynth attack additionally requires an FFmpeg built with --enable-avisynth and the AviSynthPlus runtime on the host. Upstream FFmpeg and the common Linux distribution and Homebrew packages do not enable it; the GPL builds distributed for Windows and Linux from ffmpeg.org do. Other decoders that FFmpeg or ImageMagick select from the extension may be reachable without AviSynth. This issue is fixed in versions 8.1.4.1 and 8.0.5.2. | ||||
| CVE-2026-125880 | 2026-11-10 | N/A | ||
| Improper neutralization of HTTP headers for scripting syntax vulnerability in N-able N-central allows Cross-Site Scripting (XSS). This issue affects N-central: before 26.4.1. | ||||
| CVE-2026-70175 | 1 Microsoft | 19 .net 10.0 Installed On Linux, .net 10.0 Installed On Mac Os, .net 10.0 Installed On Windows and 16 more | 2026-11-10 | 8.1 High |
| Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-118741 | 1 Microsoft | 7 Microsoft.dotnet-scaffold, Microsoft.dotnet-scaffold-aspnet, Microsoft.dotnet.web.projecttemplates.10.0 and 4 more | 2026-11-10 | 8.1 High |
| Improper authentication in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-58957 | 1 Google | 1 Android | 2026-11-10 | 8.4 High |
| In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-60046 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.5 High |
| An unauthenticated remote attacker can perform password resets for any user with known username and email without rate limiting. This can result in a total loss of availabilit since the password will be reseted. | ||||
| CVE-2026-125396 | 1 Artifex | 1 Ghostscript | 2026-11-09 | 7.8 High |
| Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code. | ||||
| CVE-2026-125074 | 1 Sourcecodester | 1 Smart Attendance System With Qr Code Scanner | 2026-11-09 | 7.3 High |
| A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used. | ||||
| CVE-2026-114421 | 1 Seppmail | 1 Seppmail Secure Email Gateway | 2026-11-09 | N/A |
| SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery. | ||||
| CVE-2026-101272 | 1 Pretix | 1 Pretix | 2026-11-09 | N/A |
| The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referred to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. As part of the fix, we have also improved hardening of some other related code areas. | ||||
| CVE-2026-123196 | 1 Authorizerdev | 1 Authorizer | 2026-11-09 | 8.1 High |
| Authorizer before 2.4.2 contains a password reset poisoning vulnerability that allows unauthenticated attackers to control emailed link hosts by supplying x-authorizer-url gRPC metadata. Attackers can send this metadata to the gRPC port or a Grpc-Metadata-X-Authorizer-Url header through the REST gateway to capture reset or magic-link tokens and take over accounts. | ||||
| CVE-2026-118459 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials. | ||||
| CVE-2026-114442 | 1 Apache | 1 Hertzbeat | 2026-11-06 | 6.5 Medium |
| Apache HertzBeat versions 1.7.1, 1.7.2, 1.7.3, 1.8.0, and 1.9.0 have incomplete XPath expression validation in the HTTP collector XML parsing path. An authenticated user with permission to create monitor templates can supply XPath expressions through metrics.aliasFields that are evaluated without the validation applied to parseScript. When processing a crafted XML response, repeated evaluation may consume excessive CPU resources and impair collector availability. This is a follow-up to the incomplete fix for CVE-2026-24343. The fix is included in Apache HertzBeat 1.9.1. Users should upgrade to 1.9.1 or a later version. | ||||
| CVE-2026-80742 | 1 Linux | 1 Linux Kernel | 2026-11-06 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: af_packet: Don't send zero-byte data in tpacket_snd(). syzbot reported a WARNING in __dev_queue_xmit() triggered via tpacket_snd(): skb_assert_len WARNING: at include/linux/skbuff.h:2753 skb_assert_len WARNING: at __dev_queue_xmit+0x21bc/0x4970 net/core/dev.c:4781 Call Trace: <TASK> dev_queue_xmit include/linux/netdevice.h:3448 [inline] packet_xmit+0x243/0x310 net/packet/af_packet.c:276 tpacket_snd net/packet/af_packet.c:2907 [inline] packet_sendmsg+0x28d6/0x4eb0 net/packet/af_packet.c:3134 When sending 0-byte packets via TPACKET ring buffer on devices with no hard header (e.g. dev->hard_header_len == 0), tpacket_fill_skb() populates an skb with skb->len == 0 and returns 0. tpacket_snd() then forwards this empty skb to packet_xmit(), causing __dev_queue_xmit() to hit skb_assert_len(skb). Similar checks exist in packet_snd() via commit dc633700f00f ("net/af_packet: check len when min_header_len equals to 0") and in packet_sendmsg_spkt() via commit 6a341729fb31 ("af_packet: Don't send zero-byte data in packet_sendmsg_spkt()."). Return -EINVAL in tpacket_fill_skb() when skb->len is zero to reject zero-length packets in tpacket_snd(). | ||||
| CVE-2026-16437 | 2026-11-05 | N/A | ||
| Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, MC Works64 all versions, GENESIS32 all versions, BizViz all versions, Mitsubishi Electric Iconics Digital Solutions GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versions 10.97.3 and prior, AnalytiX versions 10.97.3 and prior, MobileHMI 10.97.3 and prior, IoTWorX 10.97.3 and prior, GENESIS32 all versions, and BizViz all versions allows an authenticated local user with administrative privileges to unlock the system by tampering with the management file that stores the challenge response. Administrators are able to read and write the management file. But the management file is protected by Windows. As a result, the attacker may disclose, tamper with, destroy, or delete internal information, or cause the affected system to enter a denial-of-service (DoS) condition. | ||||