Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,824

CVE-2026-14983

Missing Authentication in Teledyne FLIR Robots running Aware2

Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endpoint.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-55393

Local File Inclusion in Teledyne FLIR Robots running Aware2

Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-55395

Hardcoded Passwords in Teledyne FLIR Robots running Aware2

Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this software via reading the passwords from the firmware or documentation.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-14984

Cleartext HTTP for Control Traffic in Teledyne FLIR Robots running Aware2

Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-55396

Unencrypted UDP Control Traffic in Teledyne FLIR Robots running Aware2

Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hijack, or modify control traffic against Teledyne FLIR PackBot and FirstLook robots running this software via sniffing or hijacking network traffic.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Teledyne Flir
Products
Aware2
CVE-2026-96780

figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Patorjk
Products
Figlet.js
CVE-2026-102370

Physical UART Access Leading to an Unauthenticated Root Shell in TP-Link Kasa EC70 and EC71

Kasa EC70 v4 and EC71 v4 do not logically disable the production debug interface at the firmware or chip level and do not lock the bootloader.  Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to enter a non-standard initialization path that exposes an unauthenticated root shell during startup. Successful exploitation may allow an attacker with physical access to obtain root-level command access during device startup, resulting in loss of confidentiality, integrity, and availability for the affected device. Exploitation requires device disassembly, restoration of the severed debug connection, and manipulation of the boot process.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tp-link
Products
Kasa Ec70 V4 Kasa Ec71 V4
CVE-2026-34175

Privilege Escalation via Uncontrolled Search Path in Intel Hardware‑Aware‑Automated‑MachineLearning

Uncontrolled search path for some Hardware-Aware-Automated-MachineLearning NA before version 45cd723 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVSS 4.0 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Intel
Products
Hardware-aware-automated-machine-learning Hardware-aware-automated-machinelearning
CVE-2026-81740

Paytm Payment Gateway < 2.8.9 - Unauthenticated Order Status Manipulation via Payment Callback

The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider when its secret key has not been configured, which is its state immediately after activation, allowing unauthenticated attackers to change the status of arbitrary orders, including marking unpaid orders as paid and reducing stock.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Paytm Wordpress-extensions
Products
Payment Gateway Paytm Payment Gateway
CVE-2026-85004

Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect

The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying a nonce, allowing authenticated users with minimal privileges such as Subscribers to overwrite a site-wide Popup Maker WordPress plugin through 1.4.5 option (the linked service account and API configuration) that should only be modifiable by administrators.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Popup Maker
CVE-2026-90988

Request a Quote <= 2.5.6 - Unauthenticated Quote Request Contact Record Disclosure via emd_get_std_pagenum

The Request a Quote WordPress plugin through 2.5.6 does not perform an authorization check on one of its unauthenticated AJAX handlers, allowing unauthenticated users to read the contact records of quote-request submissions, including records the site has not published.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Request A Quote
CVE-2026-13718

Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content

The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it, allowing a shop manager to store JavaScript that executes when any user, including an administrator, views the product page.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Tabs Responsive
CVE-2026-91828

OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. WordPress plugin before 6.3.11 does not require authentication or a valid nonce on an action that issues a slow server-side loopback request, allowing unauthenticated attackers to exhaust the site's PHP worker pool and make the entire site unavailable.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Omgf
CVE-2026-85016

Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter

The Unlimited Elements for Elementor WordPress plugin before 2.0.21 does not escape an icon value before concatenating it into an HTML attribute in its shared widget-parameter processor, allowing users with Contributor access (who do not hold unfiltered_html) to store a payload that executes when the page is rendered.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Unlimited Elements For Elementor
CVE-2026-91022

Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color

The Motors WordPress plugin before 1.4.124 does not sanitise and escape a listing badge setting before outputting it inside an HTML attribute, allowing users with a custom, administrator-assigned listing-management role to inject arbitrary web scripts that execute when a listing is viewed by any visitor, including an administrator.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Motors
CVE-2026-91023

Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured

The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and above to set metadata on posts they do not own, including overwriting product prices. Exploitation is possible only when WooCommerce is active and the Motors WordPress plugin before 1.4.124's paid featured-listing option is enabled, neither of which is a default configuration.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Motors
CVE-2026-94298

BuildKit < 1.0.29 - Contributor+ Stored SQLi via list_content Parameter

The BuildKit WordPress plugin before 1.0.29 does not properly sanitise and escape data submitted by contributor-level users before storing it and later using it in a SQL query, allowing a Contributor to inject SQL that runs against the database once the resulting content is published and viewed by any unauthenticated visitor.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Buildkit
CVE-2026-97317

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated reCAPTCHA Secret Key Disclosure via Giveaway Page

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not remove the reCAPTCHA secret key from the giveaway settings it embeds in public giveaway pages, allowing unauthenticated visitors to retrieve the secret key of any active giveaway that has reCAPTCHA configured.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rafflepress Wordpress-extensions
Products
Giveaways And Contests By Rafflepress Giveaways And Contests By Rafflepress
CVE-2026-97318

Giveaways and Contests by RafflePress < 1.12.27 - Unauthenticated Stored Open Redirect via 'parent_url' Parameter

The Giveaways and Contests by RafflePress WordPress plugin before 1.12.27 does not properly validate a giveaway's parent page URL before saving it and later redirecting visitors to it, allowing unauthenticated attackers to make the site's own giveaway confirmation and referral links redirect visitors to an arbitrary external site.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Rafflepress Wordpress-extensions
Products
Giveaways And Contests By Rafflepress Giveaways And Contests By Rafflepress
CVE-2026-80464

API Tool Runner SSRF in HAVELSAN's Sef - AI Chatbot Platform

Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the product is not supported.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Havelsan
Products
Sef - Ai Chatbot Platform