Export limit exceeded: 107878 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (107878 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82808 | 1 Inbox Foundry | 1 Activeinbox Extension | 2026-08-31 | 7.3 High |
| A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports." | ||||
| CVE-2026-82281 | 1 Cinnamon | 1 Kotaemon | 2026-08-31 | 7.4 High |
| Kotaemon through 0.12.0 fails to properly validate conversation ownership in select_conv, delete_conv, rename_conv, and on_set_public_conversation functions in control.py. Attackers can read other users' chat histories, delete conversations, or rename conversations by supplying arbitrary conversation identifiers without proper authorization checks. | ||||
| CVE-2026-75486 | 1 Snyk | 1 Sweater-comb | 2026-08-31 | 8 High |
| Synk Sweater Comb before 3.8.8 contains a command injection vulnerability that allows an attacker who controls the .vervet.yaml configuration file to execute arbitrary OS commands by injecting malicious input into the linters.<key>.optic-ci.original branch name field. The expectGitBranch() function in src/lint.ts passes the unsanitized branch name directly into child_process.exec() via an unescaped template literal, enabling arbitrary command execution when the lint command is run against the repository. | ||||
| CVE-2026-13753 | 1 Hp | 1 Hp 2800 Printer Series | 2026-08-31 | 7.5 High |
| Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to access sensitive information through exposed APIs. | ||||
| CVE-2026-26456 | 2026-08-31 | 7.5 High | ||
| A null pointer dereference vulnerability exists in the server-side session management logic of ccoap 77f55c4b466e99327c24ace8a2913d3ba7e2ccd5. The issue is caused by a race condition between the request dispatch thread and the session cleanup thread when accessing shared session list nodes without proper synchronization. | ||||
| CVE-2026-30067 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| An issue in the complexQueryFilterSubprocess function in the NRF Discovery service of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-5674 | 2 Pipewire, Redhat | 5 Pipewire, Enterprise Linux, Enterprise Linux Eus and 2 more | 2026-08-31 | 8.8 High |
| A flaw was found in PipeWire, a multimedia server. This vulnerability allows an attacker to escape sandboxed applications, such as Flatpak, by exploiting PipeWire's PulseAudio compatibility layer. An attacker with minimal permissions within a sandboxed environment can load a malicious library, leading to arbitrary code execution outside the sandbox and potential compromise of the user's system. | ||||
| CVE-2026-52489 | 1 Gpac | 1 Gpac | 2026-08-31 | 7.8 High |
| Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function | ||||
| CVE-2026-30051 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| An issue in the CreateUEContextProcedure function (/v1/ue-contexts/{supi}) of free5gc v4.1.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted PUT request. | ||||
| CVE-2026-30059 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| An issue in the NAS decoder component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted Registration Request message. | ||||
| CVE-2026-82869 | 1 Tooljet | 1 Tooljet | 2026-08-31 | 7.7 High |
| ToolJet Database versions before v3.16.44 contain a privilege escalation vulnerability in the join_tables endpoint that grants JOIN_TABLES ability to all authenticated users without role or workspace membership validation. Attackers can read arbitrary ToolJet Database tables from any workspace by supplying victim workspace identifiers in the request path while authenticating with their own workspace credentials. | ||||
| CVE-2026-82659 | 1 Nodemailer | 1 Nodemailer | 2026-08-31 | 7.1 High |
| nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients. | ||||
| CVE-2026-82472 | 1 Documenso | 1 Documenso | 2026-08-31 | 7.5 High |
| Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records. | ||||
| CVE-2026-82466 | 1 Jeremyevans | 1 Rodauth | 2026-08-31 | 8.7 High |
| Rodauth before 2.46.0 contains an authentication bypass vulnerability in the webauthn_login route that allows logged-in users to authenticate as any other account. Attackers can exploit improper account resolution logic that falls back to session account identifiers instead of validating the credential binding to complete authentication as arbitrary users. | ||||
| CVE-2026-82461 | 1 Pac4j | 1 Pac4j | 2026-08-31 | 8.1 High |
| pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation. | ||||
| CVE-2026-82453 | 1 Iot-ecology | 1 Rust-iot-platform | 2026-08-31 | 7.5 High |
| rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts. | ||||
| CVE-2026-82450 | 1 Bookstackapp | 1 Bookstack | 2026-08-31 | 8.8 High |
| BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests. | ||||
| CVE-2026-82291 | 1 Heyform | 1 Heyform | 2026-08-31 | 8.1 High |
| HeyForm before 3.0.0-rc.8 reflects the request Origin header in CORS responses while allowing credentials, enabling cross-origin requests with authentication. Attackers can execute authenticated GraphQL queries from malicious pages visited by logged-in users to access workspaces, projects, forms, submissions, and respondent data, or modify account settings. | ||||
| CVE-2026-82287 | 1 Rybbit-io | 1 Rybbit | 2026-08-31 | 8.1 High |
| Rybbit before 2.7.0 contains a CORS misconfiguration vulnerability that allows attackers to bypass origin restrictions by reflecting any request origin in Access-Control-Allow-Origin responses while credentials are enabled. Attackers can issue credentialed cross-origin requests from any website to read analytics data, account information, and perform authenticated state-changing operations as the victim user. | ||||
| CVE-2026-82285 | 1 Dataelement | 1 Bisheng | 2026-08-31 | 8.2 High |
| bisheng through 2.6.0-fix2 contains a server-side request forgery vulnerability in the POST /api/v1/workflow/report/callback endpoint that lacks authentication and applies no URL scheme restrictions or host filtering. Unauthenticated attackers can supply arbitrary URLs to enumerate internal network services and cloud metadata endpoints, then retrieve captured responses from object storage using caller-supplied object names. | ||||