Total
413906 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-4821 | 1 Codedropz | 1 Drag And Drop Multiple File Uploader | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.1 does not filter all potentially dangerous file extensions. Therefore, an attacker can upload unsafe .shtml or .svg files containing malicious scripts. | |||||
| CVE-2023-4820 | 1 Blubrry | 1 Powerpress | 2026-06-17 | N/A | 5.4 MEDIUM |
| The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.0.12 does not sanitize and escape the media url field in posts, which could allow users with privileges as low as contributor to inject arbitrary web scripts that could target a site admin or superadmin. | |||||
| CVE-2023-4819 | 1 Tammersoft | 1 Shared Files | 2026-06-17 | N/A | 6.1 MEDIUM |
| The Shared Files WordPress plugin before 1.7.6 does not return the right Content-Type header for the specified uploaded file. Therefore, an attacker can upload an allowed file extension injected with malicious scripts. | |||||
| CVE-2023-4818 | 1 Paxtechnology | 2 A920, Paydroid | 2026-06-17 | N/A | 7.6 HIGH |
| PAX A920 device allows to downgrade bootloader due to a bug in its version check. The signature is correctly checked and only bootloader signed by PAX can be used. The attacker must have physical USB access to the device in order to exploit this vulnerability. | |||||
| CVE-2023-4817 | 1 Icpdas | 2 Et-7060, Et-7060 Firmware | 2026-06-17 | N/A | 7.2 HIGH |
| This vulnerability allows an authenticated attacker to upload malicious files by bypassing the restrictions of the upload functionality, compromising the entire device. | |||||
| CVE-2023-4816 | 1 Hitachienergy | 1 Asset Suite | 2026-06-17 | N/A | 6.9 MEDIUM |
| A vulnerability exists in the Equipment Tag Out authentication, when configured with Single Sign-On (SSO) with password validation in T214. This vulnerability can be exploited by an authenticated user per-forming an Equipment Tag Out holder action (Accept, Release, and Clear) for another user and entering an arbitrary password in the holder action confirmation dialog box. Despite entering an arbitrary password in the confirmation box, the system will execute the selected holder action. | |||||
| CVE-2023-4815 | 1 Answer | 1 Answer | 2026-06-17 | N/A | 8.8 HIGH |
| Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3. | |||||
| CVE-2023-4814 | 1 Trellix | 1 Data Loss Prevention | 2026-06-17 | N/A | 7.1 HIGH |
| A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for which the user does not have permission to. | |||||
| CVE-2023-4812 | 1 Gitlab | 1 Gitlab | 2026-06-17 | N/A | 7.6 HIGH |
| An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding changes to a previously approved merge request. | |||||
| CVE-2023-4811 | 1 Iptanus | 1 Wordpress File Upload | 2026-06-17 | N/A | 5.4 MEDIUM |
| The WordPress File Upload WordPress plugin before 4.23.3 does not sanitise and escape some of its settings, which could allow high privilege users such as contributors to perform Stored Cross-Site Scripting attacks. | |||||
| CVE-2023-4810 | 1 Wpdarko | 1 Responsive Pricing Table | 2026-06-17 | N/A | 4.8 MEDIUM |
| The Responsive Pricing Table WordPress plugin before 5.1.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-4809 | 1 Freebsd | 1 Freebsd | 2026-06-17 | N/A | 7.5 HIGH |
| In pf packet processing with a 'scrub fragment reassemble' rule, a packet containing multiple IPv6 fragment headers would be reassembled, and then immediately processed. That is, a packet with multiple fragment extension headers would not be recognized as the correct ultimate payload. Instead a packet with multiple IPv6 fragment headers would unexpectedly be interpreted as a fragmented packet, rather than as whatever the real payload is. As a result, IPv6 fragments may bypass pf firewall rules written on the assumption all fragments have been reassembled and, as a result, be forwarded or processed by the host. | |||||
| CVE-2023-4808 | 1 Allurewebsolutions | 1 Wp Post Popup | 2026-06-17 | N/A | 4.8 MEDIUM |
| The WP Post Popup WordPress plugin through 3.7.3 does not sanitise and escape some of its inputs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-4805 | 1 Themeum | 1 Tutor Lms | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Tutor LMS WordPress plugin before 2.3.0 does not sanitise and escape some of its settings, which could allow users such as subscriber to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) | |||||
| CVE-2023-4804 | 1 Johnsoncontrols | 12 Quantum Hd Unity Acuair, Quantum Hd Unity Acuair Firmware, Quantum Hd Unity Compressor and 9 more | 2026-06-17 | N/A | 10.0 CRITICAL |
| An unauthorized user could access debug features in Quantum HD Unity products that were accidentally exposed. | |||||
| CVE-2023-4803 | 1 Proofpoint | 1 Insider Threat Management | 2026-06-17 | N/A | 4.8 MEDIUM |
| A reflected cross-site scripting vulnerability in the WriteWindowTitle endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected. | |||||
| CVE-2023-4802 | 1 Proofpoint | 1 Insider Threat Management | 2026-06-17 | N/A | 4.8 MEDIUM |
| A reflected cross-site scripting vulnerability in the UpdateInstalledSoftware endpoint of the Insider Threat Management (ITM) Server's web console could be used by an authenticated administrator to run arbitrary javascript within another web console administrator's browser. All versions prior to 7.14.3.69 are affected. | |||||
| CVE-2023-4801 | 1 Proofpoint | 1 Insider Threat Management | 2026-06-17 | N/A | 7.5 HIGH |
| An improper certification validation vulnerability in the Insider Threat Management (ITM) Agent for MacOS could be used by an anonymous actor on an adjacent network to establish a man-in-the-middle position between the agent and the ITM server after the agent has registered. All versions prior to 7.14.3.69 are affected. Agents for Windows, Linux, and Cloud are unaffected. | |||||
| CVE-2023-4800 | 1 Wpdo | 1 Dologin Security | 2026-06-17 | N/A | 6.5 MEDIUM |
| The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users. | |||||
| CVE-2023-4799 | 1 Wpembedfb | 1 Magic Embeds | 2026-06-17 | N/A | 5.4 MEDIUM |
| The Magic Embeds WordPress plugin before 3.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks | |||||