Export limit exceeded: 396493 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396493 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396493 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 16429 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16429 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81704 | 1 Jahlives | 1 Openssl Encrypt | 2026-09-03 | 7.5 High |
| openssl_encrypt versions before 1.4.9 contain a weak key derivation vulnerability in the D-Bus CryptoService.EncryptFile handler that uses unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files roughly six to seven orders of magnitude faster than documented protection by exploiting the missing key stretching and hash rounds. | ||||
| CVE-2026-81689 | 1 Jahlives | 1 Openssl Encrypt | 2026-09-03 | 7.5 High |
| openssl_encrypt versions before 1.4.9 derive the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords. | ||||
| CVE-2026-71572 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 5.4 Medium |
| Joomla! Core - [20260801] - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion. | ||||
| CVE-2026-71573 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 8.3 High |
| Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests. | ||||
| CVE-2026-76218 | 2 Gitpython-developers, Gitpython Project | 2 Gitpython, Gitpython | 2026-09-03 | 7.5 High |
| GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository. | ||||
| CVE-2026-50237 | 1 Redhat | 2 Openshift, Openshift Container Platform | 2026-09-03 | 7.4 High |
| A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation. | ||||
| CVE-2026-50236 | 1 Redhat | 2 Openshift, Openshift Container Platform | 2026-09-03 | 7.4 High |
| An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position. | ||||
| CVE-2026-85089 | 1 Freerdp | 1 Freerdp | 2026-09-03 | 6.5 Medium |
| FreeRDP versions 3.0.0 through 3.30.0 (before 3.31.0) transmit uninitialized heap memory in Save Session Info PDU reserved padding fields. Three PDU writers in libfreerdp/core/info.c (rdp_write_logon_info_v2, rdp_write_logon_info_plain, and rdp_write_logon_info_ex) use Stream_Seek instead of Stream_Zero for reserved pad bytes (up to 576 bytes), leaving previously freed heap contents in the outgoing PDU. Because the send buffer is allocated with malloc (not zeroed), stale heap data — which may include cleartext credentials from prior sessions — can be sent to the receiving peer. FreeRDP-based servers using rdpUpdate::SaveSessionInfo and freerdp-proxy (which forwards these PDUs) are affected, allowing disclosure of server/proxy process memory to a downstream client. | ||||
| CVE-2026-85022 | 1 Langgenius | 1 Dify | 2026-09-03 | 3.5 Low |
| A vulnerability was identified in langgenius dify 1.13.0. Affected by this vulnerability is the function router.replace of the file web/app/(shareLayout)/webapp-signin/components/mail-and-password-auth.tsx of the component WebApp Sign-In. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-84772 | 2 Wordpress, Wpmudev | 2 Wordpress, Broken Link Checker | 2026-09-03 | 5.5 Medium |
| Editor Server Side Request Forgery (SSRF) in Broken Link Checker <= 2.4.14 versions. | ||||
| CVE-2025-12107 | 1 Wso2 | 1 Identity Server | 2026-09-03 | 8.4 High |
| The Velocity template engine, utilized by the affected product, accepts and processes template syntax without sufficient sanitization or validation of user-controlled input. This allows an authenticated administrator to inject arbitrary template syntax. Successful exploitation enables an attacker with administrative privileges to execute arbitrary template code on the server. This can lead to significant security consequences, including remote code execution, manipulation of data, and unauthorized access to sensitive information. | ||||
| CVE-2026-51974 | 1 Lllyasviel | 1 Fooocus | 2026-09-03 | 8.8 High |
| An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remote attackers to execute arbitrary Python code via a crafted styles payload in the EXIF metadata of an uploaded image file. | ||||
| CVE-2026-76177 | 1 Ocs Inventory Ng | 1 Ocsreports | 2026-09-03 | N/A |
| Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the HTTPS_SERV and FILE_SERV parameters. An authenticated user with operator privileges can provide arbitrary values for these parameters, causing the OCS Inventory server to make HTTP/HTTPS requests to external systems or internal resources, which could allow access to internal network services or metadata resources of cloud services. | ||||
| CVE-2026-74768 | 1 Dell | 1 Powerprotect Data Manager | 2026-09-03 | 4.1 Medium |
| Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. | ||||
| CVE-2026-41523 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-09-03 | 7.5 High |
| vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0. | ||||
| CVE-2026-52833 | 1 Nuclio | 1 Nuclio | 2026-09-03 | 8 High |
| Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.5, Nuclio's Java runtime generates a build.gradle file during function builds using Go's text/template package. The template renders runtimeAttributes.repositories[] values with the {{ . }} action, which performs no escaping. An attacker can embed a closing brace (}) to break out of the repositories {} block and append arbitrary Groovy statements that execute unconditionally during the Gradle configuration phase. This issue has been patched in version 1.16.5. | ||||
| CVE-2026-66842 | 1 F5 | 2 Big-ip, Big-iq | 2026-09-03 | 8.8 High |
| BIG-IP has a vulnerability where an authenticated user of any role may be able to create administrative user accounts through an undisclosed request to Traffic Management User Interface (TMUI). Impact: This vulnerability may allow an authenticated attacker with network access to the BIG-IP management interface to escalate privileges by creating administrative accounts on the BIG-IP system. There is no data plane exposure; this is a control plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | ||||
| CVE-2026-49869 | 2 Kestra, Kestra-io | 2 Kestra, Kestra | 2026-09-03 | 10 Critical |
| Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials. Because Kestra ships with script execution plugins (plugin-script-shell, plugin-script-python, etc.) enabled by default, this directly results in unauthenticated Remote Code Execution as root inside the Kestra worker container. This vulnerability is fixed in 1.0.45 and 1.3.21. | ||||
| CVE-2026-4813 | 1 Lutece | 2 Lutece, Lutece Core | 2026-09-02 | N/A |
| A vulnerability in the Lutece Core XSL export management module up to version 7.1.7, which allows authenticated administrators to execute code remotely. The XML/XSLT processing configuration does not enable secure processing mode (FEATURE_SECURE_PROCESSING), allowing Java extension functions to be executed from malicious XSL stylesheets. An attacker with administrator privileges can upload a manipulated XSL transformation file and trigger its execution during user export operations, resulting in the execution of arbitrary code on the server. | ||||
| CVE-2026-84175 | 1 Eclipse | 1 Eclipse Ditto | 2026-09-02 | N/A |
| In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network — including to cloud instance-metadata endpoints and other internal services — and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions. | ||||