Export limit exceeded: 361044 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (361044 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-54848 | 2026-06-25 | 8.3 High | ||
| Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3. | ||||
| CVE-2026-54828 | 2026-06-25 | 7.5 High | ||
| Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. | ||||
| CVE-2026-56005 | 2026-06-25 | 7.1 High | ||
| Subscriber Cross Site Scripting (XSS) in WP Activity Log <= 5.6.3.1 versions. | ||||
| CVE-2026-47154 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, a malformed GetProfileResponse message can trigger out-of-bounds reads while iterating interval entries and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Simple Metering cluster may be impacted. | ||||
| CVE-2026-47153 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, a malformed Level Control Step command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | ||||
| CVE-2026-47152 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, a malformed Level Control Move command can terminate the process through a divide-by-zero fault. This command must come from a device that has already joined the network. Only devices supporting the Level Control cluster may be impacted. | ||||
| CVE-2026-47151 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed ClearWeekdaySchedule messages can trigger out-of-bounds writes into Door Lock schedule state. The size and location of this data is limited. These messages must come from a device that has already joined the network. Only devices supporting the Door Lock cluster may be impacted. | ||||
| CVE-2026-56049 | 2026-06-25 | 8.5 High | ||
| Contributor Remote Code Execution (RCE) in Post Snippets <= 4.0.19 versions. | ||||
| CVE-2026-47150 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed IAS Zone enrollment messages can trigger an out-of-bounds state-table write and terminate the process. The size and location of this write is limited. These messages must come from a device that has already joined the network. Only devices supporting the IAS Zone cluster may be impacted. | ||||
| CVE-2026-47148 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed GetGroupMembership commands can trigger repeated reads past the end of the message payload and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Groups cluster may be impacted. | ||||
| CVE-2026-57429 | 2026-06-25 | 6.5 Medium | ||
| Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. | ||||
| CVE-2026-47147 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed OTA requests can drive the OTA server parser into out-of-bounds reads. A limited amount of data from RAM is read back to the requester. The size and location of this data is limited. These requests must come from a device that has already joined the network. Only devices supporting the OTA Server cluster may be impacted. | ||||
| CVE-2026-56122 | 2026-06-25 | 7.5 High | ||
| Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the configured webroot. Attackers can traverse outside the webroot directory using traversal-prefixed paths in a single HTTP request to read any file accessible to the servlet engine process, including sensitive system files when the service runs with elevated privileges. | ||||
| CVE-2026-47146 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. | ||||
| CVE-2026-47145 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed Color Control messages can lead to asserts that terminate the process. These messages must come from a device that has already joined the network. Only devices supporting the Color Control cluster may be impacted. | ||||
| CVE-2026-47149 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed or out-of-range Door Lock user identifiers can trigger out-of-bounds table reads and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. Only devices supporting the Door Lock cluster may be impacted. | ||||
| CVE-2026-4526 | 2026-06-25 | N/A | ||
| In EmberZNet v9.0.2 and earlier, malformed global ZCL messages can trigger out-of-bounds reads in framework parsing logic and terminate the process. These messages must come from a device that has already joined the network, and no information leakage back to the sender was observed. | ||||
| CVE-2026-2815 | 2026-06-25 | N/A | ||
| Incorrect use of the PUF key for user key generation in EFR32xG27 results in predictable keys | ||||
| CVE-2026-56050 | 2026-06-25 | 6.5 Medium | ||
| Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18. | ||||
| CVE-2026-54843 | 2026-06-25 | 9.3 Critical | ||
| Unauthenticated SQL Injection in MDTF <= 1.3.7 versions. | ||||