Export limit exceeded: 404678 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (404678 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-101890 | 2 Codexonics, Wordpress-extensions | 2 Prime Mover, Prime Mover | 2026-10-02 | 5.4 Medium |
| The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary JavaScript by injecting an unescaped site_title value in a package's footprint.json file. Attackers can place a crafted package under the prime-mover-export-files directory so that the malicious value renders unescaped in the column_site_title() method of PrimeMoverBackupMenuListTable.php, triggering script execution in an administrator's browser when they view the Prime Mover Packages list table without needing to restore the package. | ||||
| CVE-2026-102294 | 1 Tp-link | 1 Tl-wr841n V14 | 2026-10-02 | N/A |
| TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful exploitation may allow unauthorized access to sensitive information, modification of device configuration or services, and disruption of device operation. | ||||
| CVE-2026-78577 | 1 Tp-link | 2 Tapo C120 V1, Tapo C200 V5 | 2026-10-02 | N/A |
| Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs, authentication and encryption modes, and signal-strength information. Successful exploitation may disclose information about the wireless environment surrounding the camera, allowing an attacker to learn elements of the local wireless topology. | ||||
| CVE-2026-104058 | 1 Akhilrex | 1 Podgrab | 2026-10-02 | 5.3 Medium |
| Podgrab contains a missing authentication vulnerability in which the /ws WebSocket route is registered on the root gin engine instead of the BasicAuth-protected router group, allowing unauthenticated network clients to connect even when PASSWORD is configured. Attackers can join the allConnections set, capture PlayerExists broadcasts containing client-supplied player identifiers, and replay them in a RegisterPlayer message to hijack queue payloads intended for authenticated users, exposing episode IDs, titles, and server-side file paths while potentially disrupting legitimate playback. | ||||
| CVE-2026-82357 | 1 Rt-labs Ab | 1 C-open | 2026-10-02 | 6.5 Medium |
| RT-Labs AB C-Open CANopen contains a NULL pointer dereference if the LSS protocol is used to configure the device. An object defined by the user application may not have all required subindexes for object 0x1018. An unauthenticated, remote attacker with access to the CAN bus, through a compromised node for instance, can initiate the LSS protocol on a device with a misconfigured identity object and potentially crash the device. Fixed in 1.1.1. | ||||
| CVE-2026-102666 | 1 Joyland | 1 Joyland.ai | 2026-10-02 | 6.5 Medium |
| The Joyland AI app contains hard-coded credentials for the GeTui push notification service, allowing an attacker to access the GeTui REST API and send push notifications containing arbitrary content to any user, group of users, or all users of the app at once. | ||||
| CVE-2026-102668 | 1 Joyland | 1 Joyland.ai | 2026-10-02 | 5.3 Medium |
| The Joyland AI app accepts any TLS certificates from any server without validation. | ||||
| CVE-2026-14984 | 1 Teledyne Flir | 1 Aware2 | 2026-10-02 | N/A |
| Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic. | ||||
| CVE-2026-14983 | 1 Teledyne Flir | 1 Aware2 | 2026-10-02 | N/A |
| Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint. | ||||
| CVE-2026-55394 | 1 Teledyne Flir | 1 Aware2 | 2026-10-02 | N/A |
| Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic. | ||||
| CVE-2026-55393 | 1 Teledyne Flir | 1 Aware2 | 2026-10-02 | N/A |
| Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal. | ||||
| CVE-2026-55395 | 1 Teledyne Flir | 1 Aware2 | 2026-10-02 | N/A |
| Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or documentation. | ||||
| CVE-2026-55396 | 1 Teledyne Flir | 1 Aware2 | 2026-10-02 | N/A |
| Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic. | ||||
| CVE-2026-55252 | 1 Openrundev | 1 Openrun | 2026-10-02 | N/A |
| OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version 0.17.7. | ||||
| CVE-2026-96780 | 1 Patorjk | 1 Figlet.js | 2026-10-02 | N/A |
| figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3. | ||||
| CVE-2026-102370 | 1 Tp-link | 2 Kasa Ec70 V4, Kasa Ec71 V4 | 2026-10-02 | N/A |
| Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to enter a non-standard initialization path that exposes an unauthenticated root shell during startup. Successful exploitation may allow an attacker with physical access to obtain root-level command access during device startup, resulting in loss of confidentiality, integrity, and availability for the affected device. Exploitation requires device disassembly, restoration of the severed debug connection, and manipulation of the boot process. | ||||
| CVE-2026-34175 | 1 Intel | 2 Hardware-aware-automated-machine-learning, Hardware-aware-automated-machinelearning | 2026-10-02 | 6.7 Medium |
| Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. | ||||
| CVE-2026-81740 | 2 Paytm, Wordpress-extensions | 2 Payment Gateway, Paytm Payment Gateway | 2026-10-02 | 5.3 Medium |
| The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock. | ||||
| CVE-2026-85004 | 1 Wordpress-extensions | 1 Popup Maker | 2026-10-02 | 4.3 Medium |
| The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators. | ||||
| CVE-2026-90988 | 1 Wordpress-extensions | 1 Request A Quote | 2026-10-02 | 5.3 Medium |
| The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published. | ||||