Total
3563 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-50677 | 1 Netgear | 2 Dgnd4000, Dgnd4000 Firmware | 2026-06-17 | N/A | 8.8 HIGH |
| An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.cgi component. | |||||
| CVE-2023-50450 | 1 Sensopart | 2 Visor Vision Sensors, Visor Vision Sensors Firmware | 2026-06-17 | N/A | 8.4 HIGH |
| An issue was discovered in Sensopart VISOR Vision Sensors before 2.10.0.2 allows local users to perform unspecified actions with elevated privileges. | |||||
| CVE-2023-50267 | 1 Metersphere | 1 Metersphere | 2026-06-17 | N/A | 4.3 MEDIUM |
| MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds. | |||||
| CVE-2023-4976 | 2026-06-17 | N/A | N/A | ||
| A flaw exists in FlashBlade whereby a local account is permitted to authenticate to the management interface using an unintended method that allows an attacker to gain privileged access to the array. | |||||
| CVE-2023-4936 | 1 Synaptics | 1 Displaylink | 2026-06-17 | N/A | 5.5 MEDIUM |
| It is possible to sideload a compromised DLL during the installation at elevated privilege. | |||||
| CVE-2023-4834 | 2 Helmholz, Mbconnectline | 4 Myrex24, Myrex24.virtual, Mbconnect24 and 1 more | 2026-06-17 | N/A | 4.3 MEDIUM |
| In Red Lion Europe mbCONNECT24 and mymbCONNECT24 and Helmholz myREX24 and myREX24.virtual up to and including 2.14.2 an improperly implemented access validation allows an authenticated, low privileged attacker to gain read access to limited, non-critical device information in his account he should not have access to. | |||||
| CVE-2023-4822 | 1 Grafana | 1 Grafana | 2026-06-17 | N/A | 6.7 MEDIUM |
| Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user with Organization Admin permissions in one organization to change the permissions associated with Organization Viewer, Organization Editor and Organization Admin roles in all organizations. It also allows an Organization Admin to assign or revoke any permissions that they have to any user globally. This means that any Organization Admin can elevate their own permissions in any organization that they are already a member of, or elevate or restrict the permissions of any other user. The vulnerability does not allow a user to become a member of an organization that they are not already a member of, or to add any other users to an organization that the current user is not a member of. | |||||
| CVE-2023-4697 | 1 Usememos | 1 Memos | 2026-06-17 | N/A | 8.8 HIGH |
| Improper Privilege Management in GitHub repository usememos/memos prior to 0.13.2. | |||||
| CVE-2023-4662 | 1 Adobe | 1 Connect | 2026-06-17 | N/A | 9.8 CRITICAL |
| Execution with Unnecessary Privileges vulnerability in Saphira Saphira Connect allows Remote Code Inclusion. This issue affects Saphira Connect: before 9. | |||||
| CVE-2023-4607 | 1 Lenovo | 231 Thinkagile Hx1021 Edg, Thinkagile Hx1021 Edg Firmware, Thinkagile Hx1320 and 228 more | 2026-06-17 | N/A | 7.5 HIGH |
| An authenticated XCC user can change permissions for any user through a crafted API command. | |||||
| CVE-2023-4404 | 1 Wpcharitable | 1 Charitable | 2026-06-17 | N/A | 9.8 CRITICAL |
| The Donation Forms by Charitable plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.7.0.12 due to insufficient restriction on the 'update_core_user' function. This makes it possible for unauthenticated attackers to specify their user role by supplying the 'role' parameter during a registration. | |||||
| CVE-2023-4293 | 1 Wpdownloadmanager | 1 Premium Packages - Sell Digital Products Securely | 2026-06-17 | N/A | 8.8 HIGH |
| The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.4 due to insufficient restriction on the 'wpdmpp_update_profile' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'profile[role]' parameter during a profile update. | |||||
| CVE-2023-4239 | 1 Webcodingplace | 1 Real Estate Manager | 2026-06-17 | N/A | 8.8 HIGH |
| The Real Estate Manager plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.2 due to insufficient restriction on the 'rem_save_profile_front' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to modify their user role by supplying the 'wp_capabilities' parameter during a profile update. | |||||
| CVE-2023-4140 | 1 Smackcoders | 1 Wp Ultimate Csv Importer | 2026-06-17 | N/A | 6.6 MEDIUM |
| The WP Ultimate CSV Importer plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 7.9.8 due to insufficient restriction on the 'get_header_values' function. This makes it possible for authenticated attackers, with minimal permissions such as an author, if the administrator previously grants access in the plugin settings, to modify their user role by supplying the 'wp_capabilities->cus1' parameter. | |||||
| CVE-2023-4009 | 1 Mongodb | 1 Ops Manager Server | 2026-06-17 | N/A | 7.2 HIGH |
| In MongoDB Ops Manager v5.0 prior to 5.0.22 and v6.0 prior to 6.0.17 it is possible for an authenticated user with project owner or project user admin access to generate an API key with the privileges of org owner resulting in privilege escalation. | |||||
| CVE-2023-49232 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of administrative users. | |||||
| CVE-2023-48902 | 1 Tramyardg | 1 Autoexpress | 2026-06-17 | N/A | 9.8 CRITICAL |
| An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php. | |||||
| CVE-2023-48757 | 2026-06-17 | N/A | 8.8 HIGH | ||
| Improper Privilege Management vulnerability in Crocoblock JetEngine allows Privilege Escalation.This issue affects JetEngine: from n/a through 3.2.4. | |||||
| CVE-2023-48419 | 1 Google | 8 Home, Home Firmware, Home Mini and 5 more | 2026-06-17 | N/A | 10.0 CRITICAL |
| An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege | |||||
| CVE-2023-48418 | 1 Google | 2 Pixel Watch, Pixel Watch Firmware | 2026-06-17 | N/A | 10.0 CRITICAL |
| In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation | |||||