Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2026-0942 2026-01-16 MEDIUM 5.3 The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check…
CVE-2026-0939 2026-01-16 MEDIUM 5.3 The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including,…
CVE-2026-0916 2026-01-16 MEDIUM 6.4 The Related Posts by Taxonomy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'related_posts_by_tax' shortcode in all versions up to, and including, 2.7.6 due…
CVE-2025-14853 2026-01-16 MEDIUM 4.3 The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions
CVE-2025-14793 2026-01-16 MEDIUM 5.0 The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.0 via the 'addContentToMpdf' function.…
CVE-2026-23769 2026-01-16 MEDIUM 6.5 lucy-xss-filter before commit e5826c0 allows an attacker to execute malicious JavaScript due to improper sanitization caused by misconfigured default superset rule files.
CVE-2026-0975 2026-01-16 HIGH 7.8 Delta Electronics DIAView has Command Injection vulnerability.
CVE-2026-1000 2026-01-16 MEDIUM 6.5 The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to…
CVE-2026-0858 2026-01-16 MEDIUM 6.1 Versions of the package net.sourceforge.plantuml:plantuml before 1.2026.0 are vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams. As a result, a crafted PlantUML…
CVE-2025-15527 2026-01-16 MEDIUM 4.3 The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api_get_post_summary function due to insufficient restrictions on…
CVE-2025-15526 2026-01-16 MEDIUM 5.3 The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper error handling…
CVE-2025-15370 2026-01-16 MEDIUM 4.3 The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 21.0.9…
CVE-2025-14982 2026-01-16 MEDIUM 4.3 The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including, 10.14.11. This makes it possible…
CVE-2025-14384 2026-01-16 MEDIUM 4.3 The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to…
CVE-2025-12957 2026-01-16 HIGH 8.8 The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficient file type…
CVE-2025-12641 2026-01-16 MEDIUM 6.5 The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions up to, and including,…
CVE-2026-1023 2026-01-16 HIGH 7.5 Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly exploit a specific functionality to query database contents.
CVE-2026-1022 2026-01-16 HIGH 7.5 Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files.
CVE-2026-1021 2026-01-16 CRITICAL 9.8 Police Statistics Database System developed by Gotac has an Arbitrary File Upload vulnerability, allowing unauthenticated remote attacker to upload and execute web shell backdoors, thereby enabling arbitrary code…
CVE-2026-1020 2026-01-16 MEDIUM 5.3 Police Statistics Database System developed by Gotac has a Absolute Path Traversal vulnerability, allowing unauthenticated remote attackers to enumerate the system file directory.
CVE-2026-1019 2026-01-16 CRITICAL 9.8 Police Statistics Database System developed by Gotac has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to read, modify, and delete database contents by using a specific functionality.
CVE-2026-1018 2026-01-16 HIGH 7.5 Police Statistics Database System developed by Gotac has an Arbitrary File Read vulnerability, allowing Unauthenticated remote attacker to exploit Absolute Path Traversal to download arbitrary system files.
CVE-2025-62582 2026-01-16 CRITICAL 9.8 Delta Electronics DIAView has multiple vulnerabilities.
CVE-2025-62581 2026-01-16 CRITICAL 9.8 Delta Electronics DIAView has multiple vulnerabilities.
CVE-2025-65118 2026-01-16 HIGH 8.8 The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code and escalate privileges to OS System, potentially…
CVE-2025-65117 2026-01-16 HIGH 7.4 The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate their privileges to the identity of a…
CVE-2025-64769 2026-01-16 HIGH 7.1 The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or data leakage in certain man-in-the-middle or passive inspection…
CVE-2025-64729 2026-01-16 HIGH 8.1 The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and escalate their privileges to the identity…
CVE-2025-64691 2026-01-16 HIGH 8.8 The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS system, potentially resulting in complete…
CVE-2025-61943 2026-01-16 HIGH 8.4 The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and achieve code execution under SQL Server administrative…
CVE-2025-61937 2026-01-16 CRITICAL 10.0 The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, potentially resulting in complete compromise of the …
CVE-2026-1011 2026-01-16 MEDIUM 6.1 A stored cross-site scripting (XSS) vulnerability exists in the Altium Support Center AddComment endpoint due to missing server-side input sanitization. Although the client interface applies HTML escaping, the…
CVE-2025-14237 2026-01-16 CRITICAL 9.8 Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected…
CVE-2025-14236 2026-01-16 CRITICAL 9.8 Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigger the affected product being…
CVE-2025-14235 2026-01-16 CRITICAL 9.8 Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the…
CVE-2025-14234 2026-01-16 CRITICAL 9.8 Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected product…
CVE-2025-14233 2026-01-16 CRITICAL 9.8 Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the affected…
CVE-2025-14232 2026-01-16 CRITICAL 9.8 Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the…
CVE-2025-14231 2026-01-16 CRITICAL 9.8 Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trigger the…
CVE-2021-47815 2026-01-16 HIGH 7.5 Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can paste a large buffer of…
CVE-2021-47814 2026-01-16 HIGH 7.5 NBMonitor 1.6.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Attackers can paste a 256-character buffer…
CVE-2021-47813 2026-01-16 HIGH 7.5 Backup Key Recovery 2.2.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Attackers can paste a…
CVE-2021-47805 2026-01-16 HIGH 7.8 Disk Savvy 13.6.14 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted…
CVE-2021-47804 2026-01-16 HIGH 7.8 Wise Care 365 5.6.7.568 contains an unquoted service path vulnerability in the WiseBootAssistant service running with LocalSystem privileges. Attackers can exploit this by inserting a malicious executable in…
CVE-2021-47803 2026-01-16 HIGH 7.8 iFunbox 4.2 contains an unquoted service path vulnerability in the Apple Mobile Device Service that allows local attackers to execute code with elevated privileges. Attackers can insert a…
CVE-2021-47801 2026-01-16 HIGH 8.2 Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login_user' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with…
CVE-2021-47800 2026-01-16 MEDIUM 5.3 b2evolution 7.2.2 contains a cross-site request forgery vulnerability that allows attackers to modify admin account details without authentication. Attackers can craft a malicious HTML form to submit unauthorized…
CVE-2021-47798 2026-01-16 CRITICAL 9.8 NoteBurner 2.35 contains a buffer overflow vulnerability in the license code input field that allows attackers to crash the application. Attackers can generate a 6000-byte payload and paste…
CVE-2021-47797 2026-01-16 HIGH 7.5 Leawo Prof. Media 11.0.0.1 contains a denial of service vulnerability that allows attackers to crash the application by supplying an oversized payload in the activation keycode field. Attackers…
CVE-2021-47796 2026-01-16 CRITICAL 9.8 Denver SHC-150 Smart Wifi Camera contains a hardcoded telnet credential vulnerability that allows unauthenticated attackers to access a Linux shell. Attackers can connect to port 23 using the…
« Anterior Página 90 de 3928 Siguiente »