Latest CVE Vulnerabilities – Page 2

7.1 HIGH

CVE-2026-111734 — Missing length validation of EtherType, VLAN and FrameID fields in pf_eth_recv()

P-Net before 1.0.3 does not validate the length of a received Ethernet frame in pf_eth_recv() before reading the EtherType, any VLAN tags and the PROFINET FrameID. The VLAN tag loop had no upper boun…

p-net | Memory Corruption

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.7 HIGH

CVE-2026-111733 — NULL pointer dereference on implicit read of AR specific record index

P-Net before 1.0.3 dereferences a NULL AR pointer when handling an implicit read request without a valid target AR UUID for a record index that requires an AR (AR specific indices 0xE000-0xEFFF, and …

p-net | Remote | Denial of Service

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

9.3 CRITICAL

CVE-2026-111732 — Out-of-bounds write when parsing AR Vendor Block requests

P-Net before 1.0.3, when built with PNET_OPTION_AR_VENDOR_BLOCKS enabled, parses a data length from a field of the ARVendorBlock request that is not part of the block definition and uses it as the nu…

p-net | Remote | Memory Corruption

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.7 HIGH

CVE-2026-111731 — Infinite loop when reading PDPortDataCheck record of subslot 0

P-Net before 1.0.3 enters an infinite loop when handling a read request for the PDPortDataCheck record with subslot 0 (whole module). The loop over the ports never advanced to the next port, so the r…

p-net | Remote | Denial of Service

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

7.2 HIGH

CVE-2026-111730 — Out-of-bounds write in CheckPeers block parser due to unvalidated peer station name length

P-Net before 1.0.3 does not validate the LengthPeerStationName field of a CheckPeers block in get_check_peer(). The received length (up to 255) was used to copy data into the 241-byte peer station na…

p-net | Memory Corruption

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

9.2 CRITICAL

CVE-2026-112256 — Logon bypass (trust of attacker-controlled completed-methods list)

Acceptance of extraneous untrusted data with trusted data vulnerability in OpenText Advanced Authentication Server allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects…

Remote | Authorization

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

2.9 LOW

CVE-2026-112255 — Endpoint credential minting (insecure default allow-list)

Initialization of a resource with an insecure default vulnerability in OpenText Advanced Authentication Server allows Excessive Allocation. This issue affects Advanced Authentication Server: from 6.…

Remote | Misconfiguration

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

6.5 MEDIUM

CVE-2026-118084 — WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerab…

Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.

hotel_booking | Remote | Authorization

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

7.5 HIGH

CVE-2026-118083 — WordPress WP Crowdfunding plugin <= 2.2.2 - Sensitive Data Exposure vulnerability

Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.

wp_crowdfunding | Remote | Information Disclosure

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.8 HIGH

CVE-2026-118082 — WordPress Buddyboss Platform plugin <= 3.5.0 - Privilege Escalation vulnerability

Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions.

Remote | Authorization

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.8 HIGH

CVE-2026-118081 — WordPress 10Web Social Photo Feed plugin <= 1.5.6 - PHP Object Injection vulnerability

Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.

Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.8 HIGH

CVE-2026-118080 — WordPress Social Snap plugin <= 1.5.4 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Social Snap <= 1.5.4 versions.

Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

7.2 HIGH

CVE-2026-118079 — WordPress FV Flowplayer Video Player plugin <= 8.3.4 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in FV Flowplayer Video Player <= 8.3.4 versions.

fv_flowplayer_video_player | Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

7.2 HIGH

CVE-2026-118078 — WordPress Product Catalog Feed by PixelYourSite plugin <= 3.1.4 - PHP Object Injection vu…

Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions.

product_catalog_feed | Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

7.2 HIGH

CVE-2026-118077 — WordPress Sastra Essential Addons for Elementor plugin <= 1.2.3 - PHP Object Injection vu…

Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions.

Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.8 HIGH

CVE-2026-118076 — WordPress Frisbii Pay plugin <= 1.8.19 - PHP Object Injection vulnerability

Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.

Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.8 HIGH

CVE-2026-118075 — WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions.

Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

7.2 HIGH

CVE-2026-118074 — WordPress Finale Lite plugin <= 2.21.0 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions.

Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

8.8 HIGH

CVE-2026-118073 — WordPress News Kit Elementor Addons plugin <= 1.5.0 - PHP Object Injection vulnerability

Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions.

news_kit_elementor_addons | Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

7.2 HIGH

CVE-2026-116869 — WordPress myPOS Checkout plugin <= 1.4.5 - PHP Object Injection vulnerability

Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions.

Remote | Injection

Oct 29, 2026 Oct 29, 2026

Oct 29, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences