CVE-2022-4993 | Critical | 9.1 | 2026-08-13 | HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use er… |
CVE-2022-50997 | High | 7.5 | 2026-08-11 | Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attack… |
CVE-2022-4995 | Critical | 9.8 | 2026-08-07 | Weaver (Fanwei) E-cology 9.0 versions prior to 10.52 contain a file upload vulnerability that allows a remote, unauthenticated attacker to upload arbitrary fil… |
CVE-2022-4994 | | | 2026-07-30 | In the Linux kernel, the following vulnerability has been resolved:
KVM: x86: wean fast IN from emulator_pio_in
Use __emulator_pio_in() directly for fast PIO… |
CVE-2022-4990 | | | 2026-07-03 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to bypass security validat… |
CVE-2022-4989 | | | 2026-07-03 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Validation of Specified Quantity in Input in the ASUS AI Suite 3 driver allows a local user to access unintended memor… |
CVE-2022-50973 | Critical | 9.8 | 2026-07-02 | Yonyou KSOA 9.0 contains an unauthenticated arbitrary file upload vulnerability in the com.sksoft.bill.ImageUpload servlet that allows unauthenticated attacker… |
CVE-2022-50972 | Critical | 9.8 | 2026-06-20 | WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by injecting shell commands through the pr… |
CVE-2022-50971 | High | 7.8 | 2026-06-19 | Malwarebytes 4.5 contains an unquoted service path vulnerability in the MBAMService executable that allows local attackers to escalate privileges by injecting… |
CVE-2022-47150 | Medium | 4.3 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in weDevs WooCommerce Conversion Tracking allows Cross Site Request Forgery.
This issue affects WooCommerce Co… |
CVE-2022-45813 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in BeRocket Advanced AJAX Product Filters allows Exploiting Incorrectly Configured Access Control Security Levels.
This is… |
CVE-2022-44630 | Medium | 4.6 | 2026-06-11 | Cross-Site request forgery (CSRF) vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery.
This issue affects YITH Wo… |
CVE-2022-42479 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in TemplateHouse Soledad allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects Soledad: from… |
CVE-2022-48575 | Low | 3.5 | 2026-06-10 | A person with access to a Mac may be able to bypass Login Window. A consistency issue was addressed with improved state handling. This issue is fixed in macOS… |
CVE-2022-26758 | High | 7.1 | 2026-06-10 | A malicious application may cause unexpected changes in memory shared between processes. A memory corruption issue was addressed with improved state management… |
CVE-2022-50953 | Medium | 6.2 | 2026-06-08 | WordPress Plugin admin-word-count-column 2.2 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploiti… |
CVE-2022-31114 | | | 2026-06-03 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2022-49042 | High | 7.8 | 2026-06-03 | An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows loc… |
CVE-2022-49036 | High | 7.8 | 2026-06-03 | An inclusion of functionality from untrusted control sphere vulnerability in OpenSSL configuration in Synology Active Backup for Business Recovery Media Creato… |
CVE-2022-4992 | High | 8.6 | 2026-06-02 | Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a… |
CVE-2022-4991 | High | 7.4 | 2026-06-01 | Tychon includes an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory that may be controllable by an unprivileged user on Windows. Tycho… |
CVE-2022-41656 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in Bizswoop Account Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.
This… |
CVE-2022-34363 | Medium | 6.5 | 2026-05-22 | Dell Unisphere for PowerMax vApp version prior to 10.0.0.2, contains an authorization bypass vulnerability in the Unisphere for VMAX application running in vA… |
CVE-2022-31231 | Medium | 5.9 | 2026-05-22 | Dell ECS, versions 3.5 and 3.6, contain an Improper Access Control in the Identity and Access Management (IAM) module. A remote unauthenticated attacker may po… |
CVE-2022-23826 | | | 2026-05-15 | A TOCTOU (Time-Of-Check to Time-Of-Use) in the graphics interface may allow an attacker to load registers repeatedly creating a race condition potentially lead… |
CVE-2022-4988 | High | 7.3 | 2026-05-11 | Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries.
Alien::FreeImage contains version 3.17.0 of the FreeImage library from… |
CVE-2022-50970 | Medium | 5.4 | 2026-05-10 | WordPress Plugin AAWP 3.16 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by manipulat… |
CVE-2022-50969 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the backend/mailingLog/manage module. The date_created, date_from, date_to, and cr… |
CVE-2022-50968 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/manage module. The date_created, date_from, date_to, and created_at p… |
CVE-2022-50967 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the tickets/manage module. The date_created, date_from, date_to, and created_at pa… |
CVE-2022-50966 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the news/manage module. The date_created, date_from, date_to, and created_at param… |
CVE-2022-50965 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the posts/manage module. The date_created, date_from, date_to, and created_at para… |
CVE-2022-50964 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/loose module. The date_created, date_from, date_to… |
CVE-2022-50963 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the auctions/myAuctions/status/active module. The date_created, date_from, date_to… |
CVE-2022-50962 | Medium | 6.1 | 2026-05-10 | uBidAuction 2.0.1 contains a reflected cross-site scripting vulnerability in the orders/myOrders module. The date_created, date_from, date_to, and created_at p… |
CVE-2022-50961 | Medium | 6.4 | 2026-05-10 | WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary Ja… |
CVE-2022-50960 | Medium | 6.1 | 2026-05-10 | WordPress International SMS for Contact Form 7 Integration version 1.2 contains a reflected cross-site scripting vulnerability in the page parameter of the adm… |
CVE-2022-50959 | Medium | 6.1 | 2026-05-10 | WordPress Contact Form Builder 1.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts… |
CVE-2022-50958 | Medium | 6.1 | 2026-05-10 | WordPress Plugin Jetpack 9.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by manip… |
CVE-2022-50957 | Medium | 6.1 | 2026-05-10 | Drupal avatar_uploader 7.x-1.0-beta8 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts… |
CVE-2022-50956 | Medium | 6.2 | 2026-05-10 | WordPress Plugin amministrazione-aperta 3.7.3 contains a local file read vulnerability that allows unauthenticated attackers to read arbitrary files by exploit… |
CVE-2022-50955 | Medium | 4.3 | 2026-05-10 | WordPress Plugin Curtain 1.0.2 contains a cross-site request forgery vulnerability that allows attackers to activate or deactivate site maintenance mode by cra… |
CVE-2022-50954 | Medium | 6.2 | 2026-05-10 | WordPress Plugin cab-fare-calculator 1.0.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by manip… |
CVE-2022-50949 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Videos sync PDF 1.7.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by… |
CVE-2022-50948 | Medium | 6.4 | 2026-05-10 | Motopress Hotel Booking Lite 4.2.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by subm… |
CVE-2022-50947 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Testimonial Slider and Showcase 2.2.6 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicio… |
CVE-2022-50946 | Medium | 6.4 | 2026-05-10 | WordPress Plugin Netroics Blog Posts Grid 1.0 contains a stored cross-site scripting vulnerability that allows authenticated editors to inject malicious script… |
CVE-2022-50945 | Medium | 6.4 | 2026-05-10 | WordPress 3dady Real-Time Web Stats plugin 1.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious Jav… |
CVE-2022-50944 | High | 8.8 | 2026-05-10 | Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files throu… |
CVE-2022-50943 | Medium | 6.1 | 2026-05-10 | Moodle LMS 4.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by submitting payloads through t… |
CVE-2022-50994 | High | 8.1 | 2026-05-08 | DrayTek Vigor 2960 firmware versions prior to 1.5.1.4 contain an OS command injection vulnerability in the CGI login handler that allows unauthenticated remote… |
CVE-2022-45899 | Medium | 6.5 | 2026-05-08 | Nokia Broadcast Message Center (BMC) before 13.1 allows an unauthenticated remote attacker to do OS command injection as root via shell metacharacters in the L… |
CVE-2022-26523 | Medium | 5.3 | 2026-05-08 | The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in… |
CVE-2022-26522 | High | 7.8 | 2026-05-08 | The socket connection handler in aswArPot.sys in the Avast and AVG Windows Anti Rootkit driver before 22.1 allows local attackers to execute arbitrary code in… |
CVE-2022-23961 | Medium | 6.1 | 2026-05-08 | In Thruk Monitoring through 2.46.3, the login field of the login form is vulnerable to reflected XSS. This vulnerability can be exploited by unauthenticated re… |
CVE-2022-50993 | Critical | 9.8 | 2026-04-30 | Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that a… |
CVE-2022-50992 | High | 7.5 | 2026-04-30 | Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that a… |
CVE-2022-4987 | High | 7.3 | 2026-04-03 | Hirschmann Industrial HiVision version 08.1.03 prior to 08.1.04 and 08.2.00 contains a vulnerability in the execution of user-configured external applications… |
CVE-2022-4986 | High | 7.5 | 2026-04-02 | Hirschmann EagleSDV version 05.4.01 prior to 05.4.02 contains a denial-of-service vulnerability that causes the device to crash during session establishment wh… |
CVE-2022-41650 | Medium | 6.5 | 2026-02-17 | Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Custom Content by Count… |
CVE-2022-50981 | Critical | 9.8 | 2026-02-02 | An unauthenticated remote attacker can gain full access on the affected devices as they are shipped without a password by default and setting one is not enforc… |
CVE-2022-50980 | Medium | 6.5 | 2026-02-02 | A unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via CAN. |
CVE-2022-50979 | Medium | 6.5 | 2026-02-02 | An unauthenticated adjacent attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (RS485). |
CVE-2022-50978 | High | 7.5 | 2026-02-02 | An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via Modbus (TCP). |
CVE-2022-50977 | High | 7.5 | 2026-02-02 | An unauthenticated remote attacker could potentially disrupt operations by switching between multiple configuration presets via HTTP. |
CVE-2022-50976 | High | 7.7 | 2026-02-02 | A local attacker could cause a full device reset by resetting the device passwords using an invalid reset file via USB. |
CVE-2022-50975 | High | 8.8 | 2026-02-02 | An unauthenticated remote attacker is able to use an existing session id of a logged in user and gain full access to the device if configuration via ethernet i… |
CVE-2022-50952 | Medium | 6.4 | 2026-02-01 | Banco Guayaquil 8.0.0 mobile iOS application contains a persistent cross-site scripting vulnerability in the TextBox Name Profile input. Attackers can inject m… |
CVE-2022-50951 | Medium | 6.4 | 2026-02-01 | WiFi File Transfer 1.0.8 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through file an… |
CVE-2022-50950 | Medium | 6.5 | 2026-02-01 | Webile 1.0.1 contains a directory traversal vulnerability that allows remote attackers to manipulate file system paths without authentication. Attackers can ex… |
CVE-2022-50942 | Medium | 5.4 | 2026-02-01 | Incinga Web 2.8.2 contains a client-side cross-site scripting vulnerability that allows remote attackers to inject malicious script codes through the icinga.mi… |
CVE-2022-50941 | Medium | 6.4 | 2026-02-01 | BootCommerce 3.2.1 contains persistent input validation vulnerabilities that allow remote attackers to inject malicious script code through guest order checkou… |
CVE-2022-50940 | Medium | 6.4 | 2026-02-01 | Knap Advanced PHP Login 3.1.3 contains a persistent cross-site scripting vulnerability that allows remote attackers to inject malicious script code in the name… |
CVE-2022-50797 | Medium | 6.4 | 2026-02-01 | Stripe Green Downloads Wordpress Plugin 2.03 contains a persistent cross-site scripting vulnerability allowing remote attackers to inject malicious scripts in… |
CVE-2022-40620 | High | 7.7 | 2026-01-28 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, does not properly validate TLS certificates when downloading update pack… |
CVE-2022-40619 | High | 7.7 | 2026-01-28 | FunJSQ, a third-party module integrated on some NETGEAR routers and Orbi WiFi Systems, exposes an HTTP server over the LAN interface of affected devices. This… |
CVE-2022-25369 | Critical | 9.8 | 2026-01-23 | An issue was discovered in Dynamicweb before 9.12.8. An attacker can add a new administrator user without authentication. This flaw exists due to a logic issue… |
CVE-2022-50939 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a critical file upload vulnerability that allows authenticated administrators to override arbitrary server files through path t… |
CVE-2022-50938 | High | 8.4 | 2026-01-13 | CONTPAQi AdminPAQ 14.0.0 contains an unquoted service path vulnerability in the AppKeyLicenseServer service running with LocalSystem privileges. Attackers can… |
CVE-2022-50937 | Medium | 6.1 | 2026-01-13 | Ametys CMS v4.4.1 contains a persistent cross-site scripting vulnerability in the link directory's input fields for external links. Attackers can inject malici… |
CVE-2022-50936 | High | 8.8 | 2026-01-13 | WBCE CMS version 1.5.2 contains an authenticated remote code execution vulnerability that allows attackers to upload malicious droplets through the admin panel… |
CVE-2022-50935 | Critical | 9.8 | 2026-01-13 | Flame II HSPA USB Modem contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path in 'C:\Pr… |
CVE-2022-50933 | High | 7.8 | 2026-01-13 | Cain & Abel 4.9.56 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges… |
CVE-2022-50932 | High | 7.5 | 2026-01-13 | Kyocera Command Center RX ECOSYS M2035dn contains a directory traversal vulnerability that allows unauthenticated attackers to read sensitive system files by m… |
CVE-2022-50931 | High | 7.8 | 2026-01-13 | TeamSpeak 3.5.6 contains an insecure file permissions vulnerability that allows local attackers to replace executable files with malicious binaries. Attackers… |
CVE-2022-50930 | High | 8.4 | 2026-01-13 | Emerson PAC Machine Edition 9.80 contains an unquoted service path vulnerability in the TrapiServer service that allows local users to potentially execute code… |
CVE-2022-50929 | High | 8.4 | 2026-01-13 | Connectify Hotspot 2018 contains an unquoted service path vulnerability in its ConnectifyService executable that allows local attackers to potentially execute… |
CVE-2022-50928 | High | 7.8 | 2026-01-13 | BlueSoleilCS 5.4.277 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute ar… |
CVE-2022-50927 | Medium | 6.2 | 2026-01-13 | Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin… |
CVE-2022-50926 | Critical | 9.8 | 2026-01-13 | WAGO 750-8212 PFC200 G2 2ETH RS firmware contains a privilege escalation vulnerability that allows attackers to manipulate user session cookies. Attackers can… |
CVE-2022-50925 | Critical | 9.8 | 2026-01-13 | Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on… |
CVE-2022-50924 | High | 8.4 | 2026-01-13 | Private Internet Access 3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system… |
CVE-2022-50923 | High | 7.8 | 2026-01-13 | Cobian Backup 0.9 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers… |
CVE-2022-50922 | Critical | 9.8 | 2026-01-13 | Audio Conversion Wizard v2.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting memory with a specially c… |
CVE-2022-50921 | High | 7.8 | 2026-01-13 | WOW21 5.0.1.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges… |
CVE-2022-50920 | High | 8.4 | 2026-01-13 | Sandboxie-Plus 5.50.2 contains an unquoted service path vulnerability in the SbieSvc Windows service that allows local attackers to potentially execute arbitra… |
CVE-2022-50919 | Critical | 9.8 | 2026-01-13 | Tdarr 2.00.15 contains an unauthenticated remote code execution vulnerability in its Help terminal that allows attackers to inject and chain arbitrary commands… |
CVE-2022-50918 | High | 8.4 | 2026-01-13 | VIVE Runtime Service 1.0.0.4 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges… |
CVE-2022-50917 | High | 7.8 | 2026-01-13 | ProtonVPN 1.26.0 contains an unquoted service path vulnerability in its WireGuard service configuration that allows local attackers to potentially execute arbi… |
CVE-2022-50916 | High | 7.2 | 2026-01-13 | e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrators to override server files through the Media Manager import… |