Export limit exceeded: 425024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-6793 | 1 Ni | 1 Veristand | 2026-11-11 | 9.8 Critical |
| A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions. | ||||
| CVE-2024-6791 | 1 Ni | 1 Veristand | 2026-11-11 | 7.8 High |
| A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted .vsmodel file. This vulnerability affects VeriStand 2024 Q2 and prior versions. | ||||
| CVE-2024-6675 | 1 Ni | 1 Veristand | 2026-11-11 | 7.8 High |
| A deserialization of untrusted data vulnerability exists in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects VeriStand 2024 Q2 and prior versions. | ||||
| CVE-2024-6638 | 1 Ni | 1 Labview | 2026-11-11 | 5.5 Medium |
| An integer overflow vulnerability due to improper input validation when reading TDMS files in LabVIEW may result in an infinite loop. Successful exploitation requires an attacker to provide a user with a specially crafted TDMS file. This vulnerability affects LabVIEW 2024 Q1 and prior versions. | ||||
| CVE-2024-6122 | 1 Ni | 2 Flexlogger, Systemlink | 2026-11-11 | 5.5 Medium |
| An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service. | ||||
| CVE-2024-6121 | 1 Ni | 2 Flexlogger, Systemlink | 2026-11-11 | 7.8 High |
| An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834. This affects NI SystemLink Server 2024 Q1 and prior versions. It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service. | ||||
| CVE-2026-19697 | 1 Wordpress-extensions | 1 Gutenkit | 2026-11-11 | 6.8 Medium |
| The GutenKit WordPress plugin before 2.5.0 does not sanitise uploaded SVG files on all of the upload paths it enables, allowing users with the file upload capability, such as Author, to upload a malicious SVG and perform Stored Cross-Site Scripting attacks against any user opening it, including administrators. | ||||
| CVE-2026-19699 | 1 Wordpress-extensions | 1 Gutenkit | 2026-11-11 | 2.7 Low |
| The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account. | ||||
| CVE-2026-75860 | 1 Wordpress-extensions | 1 Json Options | 2026-11-11 | 9.8 Critical |
| The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover. | ||||
| CVE-2026-13736 | 1 Wordpress-extensions | 1 Newpath Wildapricotpress Add-on | 2026-11-11 | 5.3 Medium |
| The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only. | ||||
| CVE-2026-15046 | 1 Wordpress-extensions | 1 Store To Woocommerce Migration | 2026-11-11 | 4.2 Medium |
| The LitExtension WordPress plugin through 1.2.5 does not verify a nonce before an administrative action that overwrites the store-migration connector's authentication token, allowing attackers to take over the connector token by tricking a logged-in administrator into clicking a crafted link (CSRF). | ||||
| CVE-2026-14187 | 1 Wordpress-extensions | 1 Tutor Lms | 2026-11-11 | 2.7 Low |
| The Tutor LMS WordPress plugin before 4.0.6 does not enforce per-object ownership checks on its course content type, allowing any user with the instructor role to read the content of private courses belonging to other instructors. | ||||
| CVE-2026-2811 | 1 Wordpress-extensions | 1 Ajaxify Comments | 2026-11-11 | 5.4 Medium |
| The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers. | ||||
| CVE-2025-15691 | 1 Wordpress-extensions | 1 Wpfunnels | 2026-11-11 | 5.3 Medium |
| The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths. | ||||
| CVE-2026-16281 | 1 Wordpress-extensions | 1 Classified Listing | 2026-11-11 | 7.1 High |
| The Classified Listing WordPress plugin before 6.1.1 does not verify that the caller owns or can edit the target listing before its AI image-editing AJAX action deletes or attaches media, allowing any authenticated user, including a subscriber, to permanently delete attachments from, and attach files to, any listing owned by another user. | ||||
| CVE-2026-17517 | 1 Wordpress-extensions | 1 Content Views | 2026-11-11 | 5.3 Medium |
| The Content Views WordPress plugin before 4.5.1.2 does not check whether the user requesting a view is allowed to read the posts it returns, allowing unauthenticated attackers to obtain the title and content of non-public posts, such as draft, pending, private and scheduled posts, when a view has been configured to include them. | ||||
| CVE-2026-19224 | 1 Wordpress-extensions | 1 Hummingbird | 2026-11-11 | 7.2 High |
| The Hummingbird Performance WordPress plugin before 3.21.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-74853 | 1 Wordpress-extensions | 1 Pods | 2026-11-11 | 6.8 Medium |
| The Pods WordPress plugin before 3.3.9.2 does not restrict which functions a display callback may resolve to, allowing users with the author role and above to read arbitrary files from the server, including files outside the web root. Only sites using the restricted display-callback mode are affected, which is the automatic default on installations whose first Pods version predates 3.1. | ||||
| CVE-2026-82186 | 1 Wordpress-extensions | 1 Wplp Cookie Consent | 2026-11-11 | 4.1 Medium |
| The WPLP Cookie Consent WordPress plugin before 4.4.2 does not properly validate a pagination parameter before using it in a SQL query, allowing users with administrator privileges to perform SQL injection attacks. | ||||
| CVE-2026-84066 | 1 Wordpress-extensions | 1 Directorist | 2026-11-11 | 3.1 Low |
| The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users. | ||||