Export limit exceeded: 425471 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 111171 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (111171 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56846 | 2 Nodejs, Redhat | 2 Nodejs, Hummingbird | 2026-08-07 | 7.5 High |
| A flaw in Node.js HTTP/2 handling can cause HTTP/2 retained header blocks evade maxSessionMemory and enable remote memory exhaustion. This vulnerability affects Node.js **24.x** and **22.x**. | ||||
| CVE-2026-24079 | 1 Qualcomm | 287 Ar8035, Ar8035 Firmware, Csra6620 and 284 more | 2026-08-07 | 8.1 High |
| Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. | ||||
| CVE-2026-15372 | 2 Wordpress, Wp2fac | 2 Wordpress, Wp2fac | 2026-08-07 | 7.5 High |
| The WP 2FA WordPress plugin before 4.1.0 does not validate the second authentication factor when one of its supported methods is selected at login, allowing an attacker who already knows a user's password to bypass two-factor authentication and fully access the account, including administrator accounts. | ||||
| CVE-2026-16443 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid 8 and 5 more | 2026-08-07 | 7.4 High |
| A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier. | ||||
| CVE-2026-17617 | 1 Ibm | 2 Application Gateway, Application Gateway Operator | 2026-08-07 | 8.5 High |
| IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources. | ||||
| CVE-2026-13153 | 2 Wordpress, Wpdevteam | 2 Wordpress, Gutenberg Essential Blocks | 2026-08-07 | 7.5 High |
| The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response, allowing unauthenticated users to read the lifetime number of units sold for any published product. | ||||
| CVE-2026-13154 | 2 Wordpress, Wpdevteam | 2 Wordpress, Gutenberg Essential Blocks | 2026-08-07 | 7.5 High |
| The Gutenberg Essential Blocks WordPress plugin before 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes, allowing unauthenticated users to read published entries of custom post types that the site registered as non-public. | ||||
| CVE-2026-28082 | 2 Crocoblock. Jetimpex Inc., Wordpress | 2 Jetreviews, Wordpress | 2026-08-07 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.13.1 versions. | ||||
| CVE-2026-28111 | 2 Wordpress, Wpmudev | 2 Wordpress, Forminator Forms | 2026-08-07 | 8.8 High |
| Contributor Privilege Escalation in Forminator <= 1.56.0 versions. | ||||
| CVE-2026-19165 | 1 Google | 1 Chrome | 2026-08-07 | 7.5 High |
| Use after free in Extensions in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High) | ||||
| CVE-2026-57817 | 1 Apache | 1 Cxf | 2026-08-07 | 8.1 High |
| The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. | ||||
| CVE-2026-19155 | 1 Google | 1 Chrome | 2026-08-07 | 8.3 High |
| Use after free in Payments in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-19154 | 1 Google | 2 Android, Chrome | 2026-08-07 | 8.3 High |
| Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-19176 | 1 Google | 1 Chrome | 2026-08-07 | 7.5 High |
| Use after free in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-65668 | 1 Microsoft | 2 Office Purview Ediscovery, Purview Ediscovery | 2026-08-07 | 8.8 High |
| Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62918 | 1 Microsoft | 1 Teams | 2026-08-07 | 7.5 High |
| Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-57818 | 1 Apache | 1 Cxf | 2026-08-07 | 8.1 High |
| A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue. | ||||
| CVE-2026-68481 | 1 Apache | 1 Cxf | 2026-08-07 | 7.5 High |
| In Apache CXF's DefaultEncryptingOAuthDataProvider, revoked access tokens still decrypt successfully, and TokenIntrospectionService reports active:true. The same applies to refresh tokens. This violates the RFC stipulations that 'The authorization server MUST invalidate the token.' and 'introspection of a revoked token MUST return {"active":false}'. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. | ||||
| CVE-2026-66373 | 1 Redis | 1 Redis | 2026-08-07 | 7.5 High |
| Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer, because deleting both consumers via XGROUP DELCONSUMER leads to a double free. NOTE: this issue exists because of an incomplete fix for CVE-2026-25243. | ||||
| CVE-2026-15325 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-08-06 | 8.7 High |
| IBM WebSphere Application Server and IBM WebSphere Application Server - Liberty is vulnerable to HTTP request smuggling due to improper handling of TRACE requests. | ||||