Export limit exceeded: 384505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 384505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (384505 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59640 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 6 Bc-java, Bcpg-fips, Bouncy Castle For Java Lts and 3 more | 2026-08-28 | 5.3 Medium |
| In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). | ||||
| CVE-2026-51611 | 2026-08-28 | N/A | ||
| Incorrect access control in the startSlaveReboot function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force a reboot via sending a crafted MQTT message. | ||||
| CVE-2026-51610 | 2026-08-28 | N/A | ||
| Incorrect access control in the RebootSystem function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to arbitrarily force an immediate reboot via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-18374 | 1 The Gnu C Library | 1 Glibc | 2026-08-28 | 4.9 Medium |
| Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation. | ||||
| CVE-2026-81931 | 1 Roskus | 1 Prospero Flow Crm | 2026-08-28 | N/A |
| Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application origin. The photo validation rule classifies the file only by its content (magic bytes) and rejects only a fixed list of PHP extensions, while ProductSaveController::save() names the stored file using the client-supplied extension and copies it into the public web root. A file that begins with an image header and carries an HTML extension passes validation, is stored under public/asset/upload/product/, and is served with a text/html content type, turning the upload into first-party stored script execution. | ||||
| CVE-2026-77438 | 1 Triliumnext | 1 Trilium | 2026-08-28 | 7.5 High |
| Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and content of protected shared notes. The endpoint authorizes only the ancestor note supplied in the request and then runs a full-text search across the entire published subtree, returning each matching note's title, share identifier, and hierarchical path without re-checking whether that individual note requires a share password or is hidden from the navigation tree. Because the search matches note content, an attacker can enumerate protected notes and use the endpoint as a boolean oracle that confirms arbitrary substrings, recovering the full contents of notes that should be gated behind a password. This issue is fixed in version 0.104.0. | ||||
| CVE-2026-77218 | 2026-08-28 | 4.9 Medium | ||
| PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The web_login_first_post handler copies the usrPass POST parameter into a fixed-size stack buffer without length validation, the web_sys_enablePasswd_post handler copies the enbPass POST parameter into a fixed-size stack buffer without length validation, and the web_sys_localUser_post handler copies the usrName and usrPass POST parameters into fixed-size stack buffers without length validation. A remote authenticated attacker can send a crafted request to crash the CGI process or web management service, resulting in denial of service. | ||||
| CVE-2026-81847 | 1 Maa-ai | 1 Maamcp | 2026-08-28 | 5.5 Medium |
| A vulnerability was found in MAA-AI MaaMCP up to 1.1.1.dev6+g2e4a41287. The affected element is the function save_pipeline/load_pipeline of the file pipeline_tools.py. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named c93ef45cba75295eba26d9ff1ffb9202a91c6150. To fix this issue, it is recommended to deploy a patch. | ||||
| CVE-2026-77217 | 2026-08-28 | 4.9 Medium | ||
| PLANET GS-4210-16P2S firmware before 3.441b260626 contains authenticated stack buffer overflow and null pointer dereference vulnerabilities in /cgi-bin/dispatcher.cgi. The web_radiusSrv*_post family of handlers copies the radKey, radKey_0, radDftParamKey, radName, and radIp POST parameters into fixed-size stack buffers without length validation, and additionally dereferences radName and radIp without verifying their presence in the request. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service. | ||||
| CVE-2026-80179 | 1 Redhat | 4 Ansible Automation Platform, Enterprise Linux, Openshift Ai and 1 more | 2026-08-28 | 5.9 Medium |
| A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values. | ||||
| CVE-2026-75126 | 2026-08-28 | 4.9 Medium | ||
| PLANET GS-4210-16P2S firmware before 3.441b260626 contains multiple authenticated stack buffer overflow vulnerabilities in /cgi-bin/dispatcher.cgi. The following handlers copy attacker-controlled POST parameters into fixed-size stack buffers without length validation: web_vlan_membership_edit_dialog_post; web_dai_vlan_post; web_poe_alive_rmtip_post; web_sys_sntp_post; web_tool_upgradeManager_post; web_port_countersClr_post; web_rmon_statisticsClr_post; web_cablediag_copper_post; web_aaa_*Authlist* handlers; web_acl_mgmt_Rules_Apply_post; web_acl_mgmt_Rules_Edit_post; web_acl_*AceDel_post handlers; web_acl_*AceAdd/Edit_post handlers; web_acl_bindAdd_post; web_acl_bindEdit_post; web_snmp_v3view_add_post; web_snmp_v3group_add_post; web_snmp_v3community_add_post; web_snmp_v3host_add_post; web_snmp_notifyv3_add_post; web_snmp_v3user_add_post; web_snmpv3_remote_engineId_add_post; web_stp_globalSetting_post; web_isg_db_post; web_tacplus*_post handlers; web_dhcp_option82_post; and web_dhcp_port_option82_cid_post. A remote authenticated attacker can send crafted requests to crash the CGI process or web management service, resulting in denial of service. | ||||
| CVE-2026-59639 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 6 Bc-java, Bcpkix-fips, Bouncy Castle For Java Lts and 3 more | 2026-08-28 | 7.5 High |
| In Bouncy Castle for Java before 1.85, CMS verifySignatures returns true for SignedData with zero signers. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | ||||
| CVE-2026-75125 | 2026-08-28 | 4.9 Medium | ||
| PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated null pointer dereference vulnerability in /cgi-bin/dispatcher.cgi. The web_poe_alive_rmtip_post handler dereferences the rmtIP parameter without verifying its presence. A remote authenticated attacker can send a crafted request omitting the rmtIP parameter to cause the CGI process to dereference a null pointer and crash, resulting in denial of service of the web management interface. | ||||
| CVE-2026-81837 | 2 Roocode, Roocodeinc | 2 Roo-code, Roo-code | 2026-08-28 | 6.3 Medium |
| A flaw has been found in RooCodeInc Roo-Code up to 3.51.1. This issue affects the function path.resolve of the file src/core/tools/ApplyPatchTool.ts of the component ApplyPatchTool. This manipulation causes path traversal. It is possible to initiate the attack remotely. The exploit has been published and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-51376 | 2026-08-28 | N/A | ||
| An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache | ||||
| CVE-2026-75124 | 2026-08-28 | 7.5 High | ||
| PLANET GS-4210-16P2S firmware before 3.441b260626 contains a pre-authentication memory corruption vulnerability in the web management interface where the _readHttpParam function copies an oversized HTTP query string without guaranteeing NUL termination, allowing parse_query_string to process attacker-controlled data into a fixed-size stack buffer. An unauthenticated remote attacker can send an oversized GET request to dispatcher.cgi to cause denial of service of the web management interface and potentially trigger memory corruption. | ||||
| CVE-2026-81834 | 1 Roocodeinc | 1 Roo-code | 2026-08-28 | 6.3 Medium |
| A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-75123 | 2026-08-28 | 7.2 High | ||
| PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/dispatcher.cgi. The web_smtp_test_post handler incorporates a caller-supplied SMTP server value directly into a shell command without sanitization. A remote attacker with administrator web credentials can send a crafted SMTP server value to execute arbitrary operating-system commands on the device. | ||||
| CVE-2026-75122 | 2026-08-28 | 7.2 High | ||
| PLANET GS-4210-16P2S firmware before 3.441b260626 contains an authenticated OS command injection vulnerability in /cgi-bin/httpuploadcert.cgi. The certificate password field in a certificate upload request is incorporated into a shell command without sanitization of shell metacharacters. A remote attacker with administrator web credentials can submit a crafted certificate upload request to execute arbitrary operating-system commands on the device. | ||||
| CVE-2026-80551 | 1 Linux | 1 Linux Kernel | 2026-08-28 | 9.3 Critical |
| In the Linux kernel, the following vulnerability has been resolved: s390/vfio_ccw: Ensure first IDAW remains constant The first IDAW in a list does not need to be on a 2K/4K boundary like all others, and so is read separately to accurately calculate the size of the buffer needed to read the full IDAL. Verify that the address found in the first IDAW is unchanged between reads, to ensure a consistent set of IDAWs being worked with. | ||||