Export limit exceeded: 16519 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16519 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-20470 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-08-04 | 6.2 Medium |
| In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11086431; Issue ID: MSV-8189. | ||||
| CVE-2026-16536 | 2026-08-04 | 5.3 Medium | ||
| The Simple Google Calendar Outlook Events Widget WordPress plugin before 3.1.0 does not validate a user-supplied URL before performing a server-side request, allowing unauthenticated attackers to perform Server-Side Request Forgery attacks and, in some cases, read the response of the internal request. | ||||
| CVE-2026-64633 | 1 Veeam | 1 One | 2026-08-04 | N/A |
| A vulnerability allowing remote unauthenticated code execution on the agent host. | ||||
| CVE-2026-18775 | 1 Nousresearch | 1 Hermes-agent | 2026-08-04 | 6.3 Medium |
| A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-48121 | 1 Langchain-ai | 1 Langgraphjs | 2026-08-04 | 6.7 Medium |
| @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from config.configurable are passed into MongoDB find() queries in MongoDBSaver.getTuple() without type enforcement. If an attacker supplies an object payload (such as MongoDB operators $gt or $ne) instead of a string, it can be interpreted as a query operator, bypassing thread scoping and leaking checkpoints, including pending writes, across tenants. Applications are at risk if they forward untrusted input into config.configurable without coercing it to strings or validating it against a schema, particularly in multi-tenant or user-isolated setups. Apps that only use server-issued, string-typed identifiers with schema validation rejecting non-string fields are not affected. This issue has been fixed in version 1.3.1. | ||||
| CVE-2026-58074 | 1 Veeam | 1 One | 2026-08-04 | N/A |
| A vulnerability allowing a high-privileged user to execute arbitrary code on the server. | ||||
| CVE-2026-12516 | 2026-08-04 | 5.3 Medium | ||
| The Fediverse Embeds WordPress plugin before 1.5.8 does not validate the destination of the server-side request performed by an unauthenticated media-proxying endpoint, allowing anonymous users to make the site fetch arbitrary URLs, including internal and private-network addresses, and read back the response body. This results in a full-read Server-Side Request Forgery and open proxy. | ||||
| CVE-2026-13461 | 1 Payrange | 1 Payrange | 2026-08-04 | 9.6 Critical |
| When coupled with the SSL bypass vulnerability, JavaScript can be injected into a WebView in the PayRange version 7.0.7 app. The injection of specific JavaScript function calls allows the attacker to escape the WebView sandbox and perform a number of dangerous actions on the user's device. | ||||
| CVE-2026-48818 | 2 Encode, Kludex | 2 Starlette, Starlette | 2026-08-04 | 7.5 High |
| Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as FastAPI; POSIX systems and follow_symlink=True are unaffected. The issue is fixed in 1.1.0. | ||||
| CVE-2026-9198 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-04 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network caller) with /api/v1/validate/code (executes user code via exec()) to achieve full RCE on default Langflow deployments | ||||
| CVE-2026-14939 | 2026-08-04 | 6.8 Medium | ||
| The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites. | ||||
| CVE-2026-16623 | 2026-08-04 | 8 High | ||
| The Create Block WordPress plugin before 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator (who holds the capability gating this action but is denied the capability that normally gates PHP file editing) to inject and execute arbitrary PHP code on the server. | ||||
| CVE-2026-69198 | 1 Beaugunderson | 1 Ip-address | 2026-08-04 | 5.3 Medium |
| ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.1.1 until 10.2.2, every special-use classification method is built on isInSubnet, which short-circuits to false whenever the address's own subnet mask is shorter than the reference range's mask. That mask comes verbatim from the CIDR suffix on the parsed input, so appending a suffix such as /0 suppresses classification entirely: isLoopback(), isPrivate(), isLinkLocal(), isCGNAT(), isMulticast(), isUnspecified(), isBroadcast(), isULA(), and getType() all report an internal address as unremarkable, while correctForm() and address still return the real internal target. An application that builds a network trust-boundary decision on these checks, for example a filter intended to block Server-Side Request Forgery, or SSRF, may therefore treat an internal target as external and allow the request. The underlying bit comparison is correct, and mask(n) already returns the first n bits of the full parsed address independently of subnetMask; the defect is solely that the containment guard sits in the classification path. This issue is fixed in version 10.2.2. | ||||
| CVE-2026-52439 | 1 Xiandafu | 1 Beetl | 2026-08-04 | 9.8 Critical |
| An issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mechanism | ||||
| CVE-2026-64802 | 1 Jetbrains | 1 Goland | 2026-08-04 | 7.8 High |
| In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration | ||||
| CVE-2026-64803 | 1 Jetbrains | 1 Goland | 2026-08-04 | 7.8 High |
| In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK | ||||
| CVE-2026-64815 | 1 Jetbrains | 1 Intellij Idea | 2026-08-04 | 8.1 High |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | ||||
| CVE-2026-65907 | 1 Jetbrains | 1 Teamcity | 2026-08-04 | 9.1 Critical |
| In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible | ||||
| CVE-2026-66325 | 1 Microsoft | 1 Edge Chromium | 2026-08-04 | 6.1 Medium |
| Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-18770 | 1 Vibesurf-ai | 1 Vibesurf | 2026-08-04 | 7.3 High |
| A vulnerability has been found in vibesurf-ai VibeSurf up to cd6e519d507cdd4d63061300bf60fb176e1f57e0. Impacted is an unknown function of the file /code of the component Python Validation Handler. The manipulation leads to code injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. | ||||