Filtered by vendor Subscriptions
Total 339425 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-69614 1 Deutsche Telekom 1 Account Management Portal 2026-03-11 9.4 Critical
Incorrect Access Control via activation token reuse on the password-reset endpoint allowing unauthorized password resets and full account takeover. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-27, fixed 2025-10-31.
CVE-2025-41712 2 Janitza, Weidmueller 4 Umg 96rm-e 230v(5222062), Umg 96rm-e 24v(5222063), Energy Meter 750-230 (2540910000) and 1 more 2026-03-11 6.5 Medium
An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server.
CVE-2025-13902 1 Schneider-electric 2 Modicon Controllers M241/m251, Modicon Controllers M258/lmc058 2026-03-11 N/A
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.
CVE-2025-70025 1 Benkeen 1 Generatedata 2026-03-11 6.1 Medium
An issue pertaining to CWE-79: Improper Neutralization of Input During Web Page Generation was discovered in benkeen generatedata 4.0.14.
CVE-2026-1286 1 Schneider-electric 1 Foxboro Dcs 2026-03-11 N/A
CWE-502: Deserialization of untrusted data vulnerability exists that could lead to loss of confidentiality, integrity and potential remote code execution on workstation when an admin authenticated user opens a malicious project file.
CVE-2026-24316 1 Sap 1 Netweaver Application Server For Abap 2026-03-11 6.4 Medium
SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.
CVE-2026-30913 1 Flarum 1 Nicknames 2026-03-11 4.6 Medium
Flarum is open-source forum software. When the flarum/nicknames extension is enabled, a registered user can set their nickname to a string that email clients interpret as a hyperlink. The nickname is inserted verbatim into plain-text notification emails, and recipients may be misled into visiting attacker-controlled domains.
CVE-2026-27688 1 Sap 1 Netweaver Application Server For Abap 2026-03-11 5 Medium
Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with user privileges could read Database Analyzer Log Files via a specific RFC function module. The attacker with the necessary privileges to execute this function module could potentially escalate their privileges and read the sensitive data, resulting in a limited impact on the confidentiality of the information stored. However, the integrity and availability of the system are not affected.
CVE-2026-1261 2 Wordpress, Wpmet 2 Wordpress, Metform Pro 2026-03-11 7.2 High
The MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2025-36173 1 Ibm 2 Infosphere Data Architect, Infosphere Data Replication 2026-03-11 6.1 Medium
Affected Product(s)Version(s)InfoSphere Data Architect9.2.1
CVE-2026-24317 1 Sap Se 1 Sap Gui For Windows With Active Guixt 2026-03-11 5 Medium
SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could exploit this vulnerability by persuading a victim to place a malicious DLL within one of these directories. The malicious command is executed in the victim user's context provided GuiXT is enabled. This vulnerability has a low impact on confidentiality, integrity, and availability.
CVE-2026-22614 1 Eaton 1 Easysoft 2026-03-11 6.1 Medium
The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre.
CVE-2026-21791 1 Hcltech 1 Sametime 2026-03-11 3.3 Low
HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL
CVE-2026-1920 2 Arraytics, Wordpress 2 Booktics – Booking Calendar For Appointments And Service Businesses, Wordpress 2026-03-11 5.3 Medium
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
CVE-2025-41710 2 Janitza, Weidmueller 4 Umg 96rm-e 230v(5222062), Umg 96rm-e 24v(5222063), Energy Meter 750-230 (2540910000) and 1 more 2026-03-11 6.5 Medium
An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.
CVE-2025-27769 1 Siemens 2 Heliox Flex 180 Kw Ev Charging Station, Heliox Mobile Dc 40 Kw Ev Charging Station 2026-03-11 2.6 Low
A vulnerability has been identified in Heliox Flex 180 kW EV Charging Station (All versions < F4.11.1), Heliox Mobile DC 40 kW EV Charging Station (All versions < L4.10.1). Affected devices contain improper access control that could allow an attacker to reach unauthorized services via the charging cable.
CVE-2025-2399 1 Mitsubishi Electric 20 Cnc C80 Series C80, Cnc E70 Series E70, Cnc E80 Series E80 and 17 more 2026-03-11 5.9 Medium
Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70, and Software Tools NC Trainer2 and NC Trainer2 plus allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683.
CVE-2026-24309 1 Sap 1 Netweaver Application Server For Abap 2026-03-11 6.4 Medium
Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute specific ABAP function module to read, modify or insert entries into the database configuration table of the ABAP system. This unauthorized content change could lead to reduced system performance or interruptions. The vulnerability has low impact on the application's integrity and availability, with no effect on confidentiality.
CVE-2026-1919 2 Arraytics, Wordpress 2 Booktics – Booking Calendar For Appointments And Service Businesses, Wordpress 2026-03-11 5.3 Medium
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.
CVE-2025-54659 1 Fortinet 1 Fortisoaragentcommunicationbridge 2026-03-11 5.5 Medium
An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability [CWE-22] vulnerability in Fortinet FortiSOAR Agent Communication Bridge 1.1.0, FortiSOAR Agent Communication Bridge 1.0 all versions may allow an unauthenticated attacker to read files accessible to the fortisoar user on a system where the agent is deployed, via sending a crafted request to the agent port.