Export limit exceeded: 425933 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425933 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125850 | 2 Webriti, Wordpress-extensions | 2 Appointment Dark, Appointment Dark | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Appointment Dark appointment-dark allows Cross Site Request Forgery.This issue affects Appointment Dark: from n/a through 1.3.4. | ||||
| CVE-2026-125849 | 2 Webriti, Wordpress-extensions | 2 Shk Corporate, Shk Corporate | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Shk Corporate shk-corporate allows Cross Site Request Forgery.This issue affects Shk Corporate: from n/a through 2.4.3. | ||||
| CVE-2026-125848 | 2 Webriti, Wordpress-extensions | 2 Leo, Leo | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Leo leo allows Cross Site Request Forgery.This issue affects Leo: from n/a through 1.7.4. | ||||
| CVE-2026-125847 | 2 Webriti, Wordpress-extensions | 2 Vdperanto, Vdperanto | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti vdperanto vdperanto allows Cross Site Request Forgery.This issue affects vdperanto: from n/a through 2.2. | ||||
| CVE-2026-125846 | 2 Webriti, Wordpress-extensions | 2 Mazino, Mazino | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Mazino mazino allows Cross Site Request Forgery.This issue affects Mazino: from n/a through 1.1. | ||||
| CVE-2026-125845 | 2 Webriti, Wordpress-extensions | 2 Vdequator, Vdequator | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti vdequator vdequator allows Cross Site Request Forgery.This issue affects vdequator: from n/a through 1.2.7. | ||||
| CVE-2026-125844 | 2 Webriti, Wordpress-extensions | 2 Vice, Vice | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti vice vice allows Cross Site Request Forgery.This issue affects vice: from n/a through 1.4. | ||||
| CVE-2026-125843 | 2 Webriti, Wordpress-extensions | 2 Spasalon, Spasalon | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Spasalon spasalon allows Cross Site Request Forgery.This issue affects Spasalon: from n/a through 3.0. | ||||
| CVE-2026-125842 | 2 Webriti, Wordpress-extensions | 2 Wallstreet Agency, Wallstreet Agency | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Wallstreet Agency wallstreet-agency allows Cross Site Request Forgery.This issue affects Wallstreet Agency: from n/a through 1.3.4. | ||||
| CVE-2026-125841 | 2 Webriti, Wordpress-extensions | 2 Heroic, Heroic | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Heroic heroic allows Cross Site Request Forgery.This issue affects Heroic: from n/a through 1.4.2. | ||||
| CVE-2026-125840 | 2 Webriti, Wordpress-extensions | 2 Rambo, Rambo | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Rambo rambo allows Cross Site Request Forgery.This issue affects Rambo: from n/a through 3.0. | ||||
| CVE-2026-125839 | 2 Webriti, Wordpress-extensions | 2 Elitepress, Elitepress | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1. | ||||
| CVE-2026-125838 | 2 Webriti, Wordpress-extensions | 2 Quality, Quality | 2026-11-15 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in webriti Quality quality allows Cross Site Request Forgery.This issue affects Quality: from n/a through 3.3. | ||||
| CVE-2026-126325 | 1 Ptc | 2 Flexplm, Windchill | 2026-11-15 | 9 Critical |
| A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | ||||
| CVE-2026-64855 | 1 Hitoshyamamoto | 1 Soapbar | 2026-11-15 | 8.2 High |
| soapbar is a SOAP library for Python — client, server, and WSDL handling. Prior to version 0.13.0, verify_envelope_bsp() derived its trust anchor from the message it was verifying. It read the X.509 certificate out of the caller-untrusted wsse:BinarySecurityToken, validated only that certificate's not-before / not-after dates, and then verified the signature against that same certificate. There was no CA-chain validation, no issuer/subject allowlist, and no pinning. A successful verify_envelope_bsp() therefore proved only that the envelope was signed by whoever supplied the embedded certificate — never that it was signed by a trusted party. An attacker who mints their own certificate, signs a forged envelope, and embeds that certificate in the token passes verification. Any consumer that treats a successful BSP verification as authentication can be impersonated (signature forgery / authentication bypass). verify_envelope() (which pins a caller-supplied x509_cert) was not affected — the flaw was specific to the BSP variant whose trust anchor came from the message. This issue has been patched in version 0.13.0. | ||||
| CVE-2026-126720 | 1 Rooxis | 1 Rooxis Rxr-12 | 2026-11-15 | N/A |
| Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen(), enabling arbitrary command execution as root over cleartext HTTP when an attacker is positioned on-path and has access to the hard-coded cloud endpoint. Firmware 20260813_c2169ea5 fixes the vulnerability, and your router can be updated through the local web interface. | ||||
| CVE-2026-126724 | 1 Rooxis | 1 Rooxis Rxr-12 | 2026-11-15 | N/A |
| Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password (ivanlee) and interactive shell (/bin/ash), allowing authentication as root via SSH or local console without device-specific secrets. Firmware 20260813_c2169ea5 removes the account from the shipped root filesystem and disables root password authentication in SSH. Users can update their router can be through the local web interface. | ||||
| CVE-2026-126723 | 1 Rooxis | 1 Rooxis Rxr-12 | 2026-11-15 | N/A |
| Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler (/usr/lib/lua/luci/data/white_list_plt.lua), where unsanitized user-supplied MAC addresses are concatenated into os.execute() without validation, yielding root command execution via a malformed mac parameter. Firmware 20260813_c2169ea5 fixes the vulnerability, and users can update their router through the local web interface. | ||||
| CVE-2026-126722 | 1 Rooxis | 1 Rooxis Rxr-12 | 2026-11-15 | N/A |
| Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon receipt of a precomputed AES-128-CBC magic packet using a firmware-wide static key and IV, enables telnet service with default credentials, providing remote root access. Firmware 20260813_c2169ea5 removes the UDP listener entirely, and users can update through their local web interface. | ||||
| CVE-2026-91870 | 1 Dell | 1 Ansible Storage For Powerflex | 2026-11-15 | 7.4 High |
| Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability in the API client component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized access. | ||||