Export limit exceeded: 43929 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 91444 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (91444 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48098 | 1 0x5t4l1n | 1 Nextor Ip Changer | 2026-08-08 | 7.3 High |
| NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (`NOPASSWD`) is enabled, privileged commands may execute silently without explicit user confirmation. Version 2.0.0 fixes the issue. | ||||
| CVE-2026-19173 | 1 Google | 1 Chrome | 2026-08-08 | 8.3 High |
| Out of bounds write in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-19159 | 1 Google | 1 Chrome | 2026-08-08 | 7.5 High |
| Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-19156 | 1 Google | 1 Chrome | 2026-08-08 | 7.5 High |
| Heap buffer overflow in Base in Google Chrome prior to 151.0.7922.109 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) | ||||
| CVE-2026-19148 | 2 Google, Linux | 2 Chrome, Linux Kernel | 2026-08-08 | 8.3 High |
| Out of bounds write in GPU in Google Chrome on Linux prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-19207 | 1 Phpgurukul | 1 Company Visitor Management System | 2026-08-08 | 2.4 Low |
| A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2025-6946 | 1 Watchguard | 29 Firebox M270, Firebox M290, Firebox M370 and 26 more | 2026-08-08 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management ninterface of another management user. | ||||
| CVE-2026-71435 | 1 Statamic | 1 Cms | 2026-08-08 | 6.1 Medium |
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2. | ||||
| CVE-2025-1910 | 1 Watchguard | 1 Mobile Vpn With Ssl Client | 2026-08-08 | N/A |
| The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN Client is installed. | ||||
| CVE-2025-4805 | 1 Watchguard | 1 Fireware Os | 2026-08-08 | N/A |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2025-4804 | 1 Watchguard | 1 Fireware Os | 2026-08-08 | N/A |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. | ||||
| CVE-2026-19067 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-08 | 6.3 Medium |
| A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2025-1239 | 1 Watchguard | 1 Fireware Os | 2026-08-08 | N/A |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2026-19047 | 1 Noctedefensor | 1 Ludusmcp | 2026-08-08 | 5.3 Medium |
| A vulnerability was detected in NocteDefensor LudusMCP up to 1.0.24. This affects the function executeArbitraryCommand/executeCommand of the file src/ludusMCP/cliWrapper.ts of the component ludus_cli_execute. Performing a manipulation of the argument command/args results in command injection. The attack needs to be approached locally. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2025-1071 | 1 Watchguard | 29 Firebox M270, Firebox M290, Firebox M370 and 26 more | 2026-08-07 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2024-6594 | 1 Watchguard | 2 Single Sign-on Client, Sso Client | 2026-08-07 | 7.5 High |
| Improper Handling of Exceptional Conditions vulnerability in the WatchGuard Single Sign-On Client on Windows causes the client to crash while handling malformed commands. An attacker with network access to the client could create a denial of service condition for the Single Sign-On service by repeatedly issuing malformed commands. | ||||
| CVE-2025-6947 | 1 Watchguard | 3 Firebox, Fireware, Fireware Os | 2026-08-07 | N/A |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2024-4944 | 2 Microsoft, Watchguard | 3 Windows, Mobile Vpn With Ssl, Mobile Vpn With Ssl Client | 2026-08-07 | 7.8 High |
| A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileged. | ||||
| CVE-2025-63235 | 2026-08-07 | 7.5 High | ||
| In sol commit 373d848 (2024-12-12), the broker does not fully release resources when handling malformed or duplicate CONNECT packets. When clients send invalid CONNECT packets - either due to repeated attempts or failed authentication - the server may silently drop the connection or send a CONNACK but fail to close the session or deallocate internal resources. This behavior allows an attacker to create numerous half-open connections that consume memory and file descriptors indefinitely, potentially triggering the Linux OOM killer and causing a denial of service. | ||||
| CVE-2026-19230 | 1 Sourcecodester | 1 Photo Share Website | 2026-08-07 | 3.5 Low |
| A vulnerability was identified in SourceCodester Photo Share Website 1.0. This affects an unknown part of the file /social/ajax.php?action=save_upload of the component Comment Input Box. The manipulation of the argument content leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||