Export limit exceeded: 385664 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385664 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-9637 | 1 Rockwell Automation | 1 Compactlogix 5380 Controllogix 5580 | 2026-09-01 | N/A |
| A denial-of-service security issue exists in the affected Logix platforms listed in the table above. The security issue stems from improper validation of input length during CIP message processing. This can result in a major nonrecoverable fault (MNRF), requiring a power cycle to recover | ||||
| CVE-2026-9634 | 1 Rockwell Automation | 1 Redundancy Module Configuration Tool | 2026-09-01 | N/A |
| A security issue exists within the Redundancy Module Configuration Tool. The RMConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. If a local attacker places a malicious DLL in such a directory and an administrator subsequently runs the tool, the malicious DLL is loaded into the elevated process and executes with Administrator/SYSTEM privileges. | ||||
| CVE-2026-9622 | 2 Rockwell Automation, Rockwellautomation | 2 Rslinx Classic , Rslinx Classic | 2026-09-01 | N/A |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover. | ||||
| CVE-2025-12768 | 1 Rockwell Automation | 1 Factorytalk Historian Machine Edition | 2026-09-01 | N/A |
| A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device. | ||||
| CVE-2026-12663 | 1 Rockwell Automation | 1 Controlflash | 2026-09-01 | N/A |
| A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level. | ||||
| CVE-2026-16675 | 2 Rockwell Automation, Rockwellautomation | 2 Factorytalk Activation Manager, Factorytalk Activation Manager | 2026-09-01 | N/A |
| A privilege escalation security issue exists within FactoryTalk® Activation Manager. The security issue stems from custom actions in the installer that spawn visible console windows running with SYSTEM privileges during installation or repair operations. An authenticated attacker with Windows credentials could hijack these console windows to obtain a SYSTEM-level command prompt, allowing full access to all files, processes, and system resources. | ||||
| CVE-2026-81278 | 2 Wordpress, Wpexperts | 2 Wordpress, Post Smtp | 2026-09-01 | 5.4 Medium |
| Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1. | ||||
| CVE-2026-84109 | 1 Xinhu | 1 Rainrock Rockoa | 2026-09-01 | 6.3 Medium |
| A weakness has been identified in Xinhu Rainrock RockOA up to 2.7.6. Affected by this issue is the function getOrder of the file webmain/webmainAction.php. Executing a manipulation of the argument highorder can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-81293 | 2 Passionate Programmer Peter, Wordpress | 2 Wp Data Access, Wordpress | 2026-09-01 | 9.3 Critical |
| Unauthenticated SQL Injection in WP Data Access <= 5.5.81 versions. | ||||
| CVE-2026-81280 | 2 Ukr Solution, Wordpress | 2 Print Barcode Labels For Your Woocommerce Products/orders, Wordpress | 2026-09-01 | 6.5 Medium |
| Subscriber Sensitive Data Exposure in Print Barcode Labels for your WooCommerce products/orders <= 4.0.0 versions. | ||||
| CVE-2026-81758 | 2 Ownerrez, Wordpress | 2 Ownerrez Api, Wordpress | 2026-09-01 | 6.3 Medium |
| Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. | ||||
| CVE-2026-81768 | 2 Highwarden, Wordpress | 2 Super Store Finder, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. | ||||
| CVE-2026-82225 | 2 Metagauss, Wordpress | 2 Registrationmagic, Wordpress | 2026-09-01 | 7.4 High |
| Unauthenticated Broken Authentication in RegistrationMagic <= 6.0.9.8 versions. | ||||
| CVE-2026-82551 | 1 Linux Foundation | 1 Magma | 2026-09-01 | 5.3 Medium |
| A weakness has been identified in Linux Foundation Magma 1.9.0. Affected is an unknown function of the file ngap_amf_handlers.c of the component NGSetup Handler. Executing a manipulation can lead to state issue. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-77823 | 2 Thimpress, Wordpress | 2 Learnpress – Wordpress Lms Plugin For Create And Sell Online Courses, Wordpress | 2026-09-01 | 4.9 Medium |
| The LearnPress plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the export_order_csv AJAX action in versions up to, and including, 4.4.4. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query in the LP_Order::handle_params_query_list_orders() and DataBase::execute() functions — only the literal values 'date' and 'title' are normalized, while any other attacker-controlled string is assigned directly to the filter's order_by property and concatenated into the ORDER BY clause without $wpdb->prepare() or an identifier whitelist. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-77194 | 2 Wordpress, Wpinsider-1 | 2 Wordpress, Simple Membership | 2026-09-01 | 5.3 Medium |
| The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1. | ||||
| CVE-2026-82921 | 1 Shopex | 1 Ecshop | 2026-09-01 | 7.3 High |
| A weakness has been identified in ShopEx ECShop up to 2.5.1. This affects the function check_img_type of the file admin/pack.php. Executing a manipulation of the argument pack_img can lead to unrestricted upload. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-83524 | 1 Redport | 3 Optimizer Wxa-203, Optimizer Wxa-213, Optimizer Wxa-223 | 2026-09-01 | 9.9 Critical |
| A security vulnerability has been detected in RedPort Optimizer wXa-203, Optimizer wXa-213 and Optimizer wXa-223 up to 20260704. This impacts the function exec of the file /xgatev1/system/datetime.php of the component System Clock. The manipulation leads to command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-83772 | 1 Cobham | 1 Satcom Vsat7090 Maritime Satellite Router | 2026-09-01 | 9.9 Critical |
| A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function c_set_reports_decode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84061 | 1 Zhongyu09 | 1 Openchatbi | 2026-09-01 | 6.3 Medium |
| A security flaw has been discovered in zhongyu09 OpenChatBI up to 0.3.0. Affected by this vulnerability is the function _validate_sql_safety of the file openchatbi/text2sql/generate_sql.py. Performing a manipulation results in sql injection. The attack can be initiated remotely. Versions v0.2.0 through v0.2.2 have no SQL safety validation at all, while v0.3.0 introduced a validator and v1.0.0b1/main kept the same incomplete one with an optional stricter mode. The vendor was contacted early about this disclosure but did not respond in any way. | ||||