Archive
13 November 2026
Vulnerabilities first published on this day (UTC), newest first.
771 results · Feed
-
Medium 6.5
WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.
-
Medium 6.5
AI Command Filters On Any Property Bypassing Column Allowlist
In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.
-
Medium 5.3
WordPress Gutenberg Blocks plugin <= 3.7.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenberg Blocks: from n/a through 3.7.6.
-
High 7.5
In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration exampl…
-
Medium 6.8
Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00…
-
High 8.8
Improper verification of cryptographic signature (CWE-347) in the firmware update handler of the management service (ua…
-
High 8.8
Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerabil…
-
High 8.8
OS command injection (CWE-78) in the network-configuration handling of the management service (uavmonitor_usbv1) of the…
-
High 7.7
In Eclipse AAS4J before 3.0.1, `XmlSchemaValidator.validateSchema()` (and `AASXValidator.validateSchema()`, which calls…
-
Medium 4.3
Missing authentication for a critical function (CWE-306) in the management service (uavmonitor_usbv1) of the 1300 commu…
-
Medium 5.4CVE-2026-128970 Public exploit
Missing membership acceptance check permits group share-right deletion by invitees in Psono Server
Psono Server Community Edition versions 1.12.6 through 7.5.0 and Psono Server Enterprise Edition before 7.5.1 do not require accepted group membership when authorizing deletion of group share-rights. The DELETE /share/right/ endpoint checks for a membership m…
-
High 8.5
A stack buffer overflow in ProcXTestFakeInput DeviceValuator handling in X.Org xwayland before 24.1.15 and X server be…
-
High 7.1
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository …
-
High 8.5
A integer overflow that can lead to a buffer overrread in the XRes QueryResourceBytes Swap Path in the X.Org xwayland b…
-
High 7.2
Dell PowerStore contains an OS Command Injection vulnerability. A high-privileged attacker could exploit this vulnerabi…
-
High 7.1
In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository …
-
Medium 6.5
Improper handling of highly compressed data (data amplification) vulnerability in Fileorbis Bilişim Hizmetleri Ticaret …
-
Medium 5.7
The AVRCP browsing channel's L2CAP receive-buffer callback, browsing_avrcp_l2cap_alloc_buf() in subsys/bluetooth/host/c…
-
High 8.8
Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability. An authenticated user with limited privile…
-
Unscored —
A directory traversal bug was discovered when unpacking 3.0 (quilt) source packages, where the packaging tarball could …
-
Medium 6.9
X.Org Server glamor Xv Image Size Integer Overflow
A integer overflow in glamor Xv Image Size handling in X.Org xwayland before 24.1.15 and X server before 21.1.26 could be used by authenticated clients to crash the X server or leak out data.
-
Medium 4.9
Dell PowerStore contains an authorization bypass vulnerability. An authenticated administrator could exploit this vulne…
-
Medium 5.5
Dell PowerStore contains an insecure-file-permissions vulnerability. A local low-privileged attacker could exploit this…
-
Medium 6.0
NULL pointer dereference when a response fragment is not acknowledged
P-Net before 1.0.4 aborts the Application Relationship of an RPC session when a fragment of a response has been resent without being acknowledged, without checking that the session has an Application Relationship. A request for an existing Application Relatio…
-
High 7.1
Dell PowerStore contains a use-of-broken-cryptography vulnerability. A low-privileged attacker could exploit it to impe…
-
High 7.1
RPC session pool exhausted by unfinished fragmented requests
P-Net before 1.0.4 keeps the RPC session that is allocated for a fragment of a request with an unknown activity UUID, without a timeout, when the rest of the request never arrives. A session that does not get an Application Relationship is also kept after the…
-
Medium 6.0
Fragment with another data representation releases an Application Relationship
P-Net before 1.0.4 releases the Application Relationship of an RPC session, without the abort procedure, when a fragment of a request has another data representation (endianness) than the first fragment of the call. The application is not told that the Applic…
-
High 7.2
Out-of-bounds write with too many MCR blocks in a Connect request
P-Net before 1.0.4 does not check the number of MCR request blocks in a Connect request against the number of multicast communication relations that an Application Relationship has room for (PNET_MAX_MC_CR, 1 by default). Each further block is written past th…
-
Medium 6.0
RPC reject, fault and cancel PDUs abort an Application Relationship
P-Net before 1.0.4 finds the RPC session of a received PDU by its activity UUID only, and a reject, fault or cancel PDU for the session aborts the Application Relationship, without checking that the PDU is the answer to a call of the device or where it comes …
-
High 7.1
P-Net before 1.0.4 copies the IP suite of a DCP Set request to the current and the non-volatile configuration, and star…
-
Low 2.3
Alarm receiver stops delivering alarms after a malformed alarm notification
P-Net before 1.0.4 sets the alarm receiver state to waiting for confirmation before the data of a received alarm notification is parsed. If the parsing fails the state is not restored, and later alarm notifications of the same priority are discarded without a…
-
Low 2.3
Integer underflow of the record data length in IODWrite requests
P-Net before 1.0.4 does not check the record data length of an IODWrite request to a non-user record index against the size of the record block header. The 32-bit length is reduced by the header size before it is passed to the record handlers, so a length sma…
-
Medium 5.5
Incorrect handling of negative returns from ddQueryImageAttributes() when processing XvPutImage requests in X.Org xwayl…
-
High 7.1
P-Net before 1.0.4 routes a received RTA alarm frame to an Application Relationship using only the destination alarm re…
-
Medium 6.5
WordPress Spectra plugin <= 2.20.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Stored XSS.This issue affects Spectra: from n/a through 2.20.5.
-
Medium 5.0
Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existi…
-
Medium 5.3
Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulner…
-
Medium 6.5
WordPress WooCommerce plugin 11.0.0-11.2.2 - Race Condition vulnerability
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.
-
Medium 5.3
Authorization Bypass Through User-Controlled Key vulnerability in Tobias WebinarIgnition webinar-ignition allows Exploi…
-
Medium 5.3
WordPress Brizy plugin <= 2.8.25 - Broken Access Control vulnerability
Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through 2.8.25.