Export limit exceeded: 397035 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 16464 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (16464 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-29202 | 1 Webpros | 3 Cpanel, Cpanel (centos 6, Cloudlinux 6), Wp Sqaured | 2026-08-24 | 8.8 High |
| Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user. | ||||
| CVE-2026-15410 | 1 Sonicwall | 6 Sma1000, Sma6210, Sma6210 Firmware and 3 more | 2026-08-24 | 7.2 High |
| Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands. | ||||
| CVE-2026-15409 | 1 Sonicwall | 6 Sma1000, Sma6210, Sma6210 Firmware and 3 more | 2026-08-24 | 10 Critical |
| A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location. | ||||
| CVE-2026-77648 | 1 Openstack | 1 Glance | 2026-08-24 | 2.2 Low |
| In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass import_filtering_opts, allowing an admin to fetch internal URLs from the Glance service network (aka SSRF), as long as https:// or http:// is used. This API has been available only to admins since Xena, and it has been deprecated for several releases. | ||||
| CVE-2026-16827 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-08-24 | 5.9 Medium |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to the use of an uninitialized stack pointer. | ||||
| CVE-2026-78179 | 1 Rexrainbow | 1 Phaser3-rex-notes | 2026-08-24 | 6.3 Medium |
| A vulnerability was identified in rexrainbow phaser3-rex-notes up to 1.80.17. This vulnerability affects the function SetValue of the file plugins/utils/object/SetValue.js of the component BehaviorTree Blackboard Data Interface. Such manipulation of the argument key leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely. | ||||
| CVE-2026-28152 | 2 Select-themes, Wordpress | 2 Tonda Core, Wordpress | 2026-08-24 | 8.1 High |
| Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | ||||
| CVE-2026-78136 | 1 Chirpmyradio | 1 Chirp | 2026-08-24 | 7.8 High |
| chirpmyradio CHIRP before 39178db allows eval injection via crafted CSV data. This occurs in _clean_tmode in drivers/kenwood_itm.py. | ||||
| CVE-2026-76605 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Remote code execution via image element in Fabrik < 4.7.2. | ||||
| CVE-2024-31823 | 1 Ecommerce-codeigniter-bootstrap Project | 1 Ecommerce-codeigniter-bootstrap | 2026-08-24 | 9.8 Critical |
| An issue in Ecommerce-CodeIgniter-Bootstrap commit v. d22b54e8915f167a135046ceb857caaf8479c4da allows a remote attacker to execute arbitrary code via the removeSecondaryImage method of the Publish.php component. | ||||
| CVE-2026-19200 | 1 Rapid7 | 1 Velociraptor | 2026-08-24 | 8.9 High |
| The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existing artifacts without the required permissions. The attacker need only have the NOTEBOOK_EDIT permission (e.g. an analyst role) to be able to call this function. | ||||
| CVE-2026-77992 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks. | ||||
| CVE-2026-76604 | 1 Fabrikar.com | 1 Fabrik Extension For Joomla | 2026-08-24 | N/A |
| Joomla Extension - fabrikar.com - Unauthenticated remote code execution via PHP form element in Fabrik < 4.7.2 - The PHP form element is vulnerable to the execution of user provided codes. | ||||
| CVE-2026-78269 | 2 Tammersoft, Wordpress | 2 Shared Files, Wordpress | 2026-08-24 | 6.4 Medium |
| Contributor Server Side Request Forgery (SSRF) in Shared Files <= 1.7.69 versions. | ||||
| CVE-2026-67340 | 1 Arcadedata | 1 Arcadedb | 2026-08-24 | 7.2 High |
| ArcadeDB before 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires. | ||||
| CVE-2026-68508 | 1 Facebookresearch | 1 Hydra | 2026-08-23 | 7.8 High |
| Hydra is a framework for elegantly configuring complex applications. Prior to 1.3.4, hydra.utils.instantiate() resolves and calls Python objects selected by configuration through _resolve_target() in hydra/_internal/instantiate/_instantiate2.py, allowing attacker-controlled target values and arguments to choose dangerous callables. A consuming application, library, CLI workflow, or model loader that passes untrusted configuration, CLI overrides, or model metadata into hydra.utils.instantiate() can therefore execute arbitrary code in its own process, including reading or modifying files and credentials or terminating the process. Version 1.3.4 adds target blocking with an explicit HYDRA_INSTANTIATE_ALLOWLIST_OVERRIDE escape hatch. This issue is fixed in version 1.3.4. | ||||
| CVE-2026-53656 | 1 Voxel51 | 1 Fiftyone | 2026-08-23 | 6.3 Medium |
| FiftyOne is an open-source platform for refining high-quality datasets and visual AI models. Prior to 1.17.0, the FiftyOne App/API server in fiftyone/server/app.py and the /media route in fiftyone/server/routes/media.py unconditionally return Access-Control-Allow-Origin: *. Because the embedded server is local and unauthenticated, a malicious website visited by the user can read cross-origin responses. The /media endpoint accepts a filesystem path, allowing a drive-by page to read files accessible to the server process and exfiltrate them without additional clicks. The allowed_origins configuration and FIFTYONE_ALLOWED_ORIGINS environment variable now make cross-origin access explicit, while the default policy is same-origin. This issue is fixed in version 1.17.0. | ||||
| CVE-2026-19221 | 2026-08-23 | 7.2 High | ||
| The Forminator Forms WordPress plugin before 1.57.0.5 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-74514 | 1 Linux | 1 Linux Kernel | 2026-08-23 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The account_mem() and unaccount_mem() functions call get_uid() which increments the reference count of struct user_struct on every invocation. But we don't decrement the count by calling free_uid(). It also accounted/unaccounted the pages against the current->mm. But its possible the unaccount_mem() can be called from a different process context than the one that originally pinned the pages. Let's fix this by storing the pinning process user_struct and mm_struct when accounting for pinned pages, and subsequently free these resources when the pages are unpinned. [borntraeger@linux.ibm.com: Fixed whitespace] | ||||
| CVE-2026-74486 | 1 Linux | 1 Linux Kernel | 2026-08-23 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: binfmt_misc: use exe_file_deny_write_access() for the interpreter clone For MISC_FMT_OPEN_FILE entries load_misc_binary() clones the registered interpreter file and denies write access to the clone via plain deny_write_access(). The clone is installed as bprm->interpreter and later released by the exec machinery through exe_file_allow_write_access() which skips the i_writecount increment for files with FMODE_FSNOTIFY_HSM set. The deny and allow side can therefore come to different conclusions when pre-content watches are in play: if a pre-content watch is added to the interpreter after registration every subsequent exec through that entry takes a write denial on the clone that is never paired with a write allowance, driving the interpreter inode's i_writecount further down with each exec and leaving the interpreter unwritable even after the entry and all its users are gone. Take the write denial via exe_file_deny_write_access() so both sides of the pairing base their decision on the same file mode, and propagate failure instead of silently ignoring it: an interpreter that is concurrently open for writing now fails the exec with ETXTBSY, exactly like an interpreter freshly opened via open_exec() would. | ||||