Total
425020 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-4390 | 1 Netgear | 2 Ax2400, Ax2400 Firmware | 2026-06-17 | N/A | 10.0 CRITICAL |
| A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are firewall restrictions in place that define access restrictions for IPv4 traffic, these restrictions do not appear to be applied to the WAN interface for IPv6. This allows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network. | |||||
| CVE-2022-4386 | 1 Intuitive Custom Post Order Project | 1 Intuitive Custom Post Order | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack | |||||
| CVE-2022-4385 | 1 Intuitive Custom Post Order Project | 1 Intuitive Custom Post Order | 2026-06-17 | N/A | 4.3 MEDIUM |
| The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user (with roles as low as Subscriber) to update the menu order | |||||
| CVE-2022-4384 | 1 Xwp | 1 Stream | 2026-06-17 | N/A | 6.5 MEDIUM |
| The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionality, which may enable them to leak sensitive information. | |||||
| CVE-2022-4383 | 1 Codeboxr | 1 Cbx Petition For Wordpress | 2026-06-17 | N/A | 9.8 CRITICAL |
| The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection. | |||||
| CVE-2022-4382 | 1 Linux | 1 Linux Kernel | 2026-06-17 | N/A | 6.4 MEDIUM |
| A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device that is running the gadgetfs side. | |||||
| CVE-2022-4381 | 1 Code-atlantic | 1 Popup Maker | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks | |||||
| CVE-2022-4379 | 2 Fedoraproject, Linux | 2 Fedora, Linux Kernel | 2026-06-17 | N/A | 7.5 HIGH |
| A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial | |||||
| CVE-2022-4378 | 1 Linux | 1 Linux Kernel | 2026-06-17 | N/A | 7.8 HIGH |
| A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. This flaw allows a local user to crash or potentially escalate their privileges on the system. | |||||
| CVE-2022-4377 | 1 S-cms | 1 S-cms | 2026-06-17 | N/A | 3.5 LOW |
| A vulnerability was found in S-CMS 5.0 Build 20220328. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Contact Information Page. The manipulation of the argument Make a Call leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-215197 was assigned to this vulnerability. | |||||
| CVE-2022-4376 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 3.1 LOW |
| An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance. | |||||
| CVE-2022-4375 | 1 Mingsoft | 1 Mcms | 2026-06-17 | N/A | 6.3 MEDIUM |
| A vulnerability was found in Mingsoft MCMS up to 5.2.9. It has been classified as critical. Affected is an unknown function of the file /cms/category/list. The manipulation of the argument sqlWhere leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 5.2.10 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-215196. | |||||
| CVE-2022-4374 | 1 Bg Bible References Project | 1 Bg Bible References | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. | |||||
| CVE-2022-4373 | 1 Quote-o-matic Project | 1 Quote-o-matic | 2026-06-17 | N/A | 7.2 HIGH |
| The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin. | |||||
| CVE-2022-4372 | 1 Web Invoice Project | 1 Web Invoice | 2026-06-17 | N/A | 7.2 HIGH |
| The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well | |||||
| CVE-2022-4371 | 1 Mohanjith | 1 Web Invoice | 2026-06-17 | N/A | 7.2 HIGH |
| The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well | |||||
| CVE-2022-4370 | 1 Multimedial Images Project | 1 Multimedial Images | 2026-06-17 | N/A | 7.2 HIGH |
| The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin. | |||||
| CVE-2022-4369 | 1 Wplite | 1 Wp-lister Lite For Amazon | 2026-06-17 | N/A | 6.1 MEDIUM |
| The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin. | |||||
| CVE-2022-4368 | 1 Cpkwebsolutions | 1 Wp Csv | 2026-06-17 | N/A | 6.1 MEDIUM |
| The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting. | |||||
| CVE-2022-4366 | 1 Daloradius | 1 Daloradius | 2026-06-17 | N/A | 7.5 HIGH |
| Missing Authorization in GitHub repository lirantal/daloradius prior to master branch. | |||||