Export limit exceeded: 390745 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (9637 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-60412 | 1 Oracle | 1 Outside In Technology | 2026-08-21 | 7.8 High |
| Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-63125 | 1 Lxc | 1 Incus | 2026-08-21 | 9.9 Critical |
| Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user (a non-admin TLS/RBAC identity with `can_create_images` and `can_create_instances`) can execute arbitrary code as root on the host. A crafted image ships `backup.yaml` as a symlink to a host file. When the root daemon writes the instance's backup file, it follows the symlink. Version 7.3.0 patches the issue. | ||||
| CVE-2026-76799 | 1 Code-projects | 1 Login Registration System | 2026-08-21 | 5.3 Medium |
| A weakness has been identified in code-projects Login Registration System 1.0. This affects an unknown function of the file /loginsystem/database/login_registration_system.sql of the component SQL Database Backup Handler. This manipulation causes files or directories accessible. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-33694 | 1 Tenable | 2 Nessus, Nessus Agent | 2026-08-21 | 7.8 High |
| This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYSTEM privileges. As a result, this condition potentially facilitates arbitrary code execution, whereby an attacker may exploit the vulnerability to execute malicious code with elevated SYSTEM privileges. | ||||
| CVE-2025-15621 | 1 Sparxsystems | 1 Enterprise Architect | 2026-08-21 | 6.0 Medium |
| Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication | ||||
| CVE-2026-60392 | 1 Oracle | 1 Outside In Technology | 2026-08-21 | 7.8 High |
| Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK). The supported version that is affected is 8.5.8. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where Oracle Outside In Technology executes to compromise Oracle Outside In Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle Outside In Technology. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-77645 | 1 Ptc | 2 Flexplm, Windchill Pdmlink | 2026-08-21 | N/A |
| A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | ||||
| CVE-2026-50192 | 1 Kerberos-io | 1 Agent | 2026-08-21 | N/A |
| Kerberos Agent is an open source video (surveillance) management agent. Prior to version 3.6.26, the Kerberos Hub upload path sends the agent's Hub credentials in the custom `X-Kerberos-Hub-PrivateKey` and `X-Kerberos-Hub-PublicKey` request headers to the operator-configured Hub URL (`config.HubURI`). The HTTP client used (`&http.Client{}` in `UploadKerberosHub`) is constructed without a `CheckRedirect` policy, so it follows HTTP redirects automatically. Go's `net/http` strips only sensitive headers (`Authorization`, `Cookie`, `WWW-Authenticate`) on a cross-host redirect; it does not strip custom headers such as `X-Kerberos-Hub-PrivateKey`. As a result, if the configured `HubURI` returns a cross-host 30x redirect, the Hub private key is forwarded verbatim to the redirect target, disclosing the credential to an unintended third party. Version 3.6.26 fixes the issue by implementing the `CheckRedirect` strip plus a cross-host regression test is provided to the maintainer through the advisory's private temporary fork. | ||||
| CVE-2026-77651 | 1 Droundy | 1 Arrayref | 2026-08-21 | 9.8 Critical |
| The arrayref crate 0.3.10 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution. | ||||
| CVE-2026-77650 | 1 Droundy | 1 Append-only-vec | 2026-08-21 | 9.8 Critical |
| The append-only-vec crate 0.1.9 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution. | ||||
| CVE-2026-77649 | 1 Droundy | 1 Internment | 2026-08-21 | 9.8 Critical |
| The internment crate 0.8.7 for Rust can trigger execution of malicious code when compiling a project that uses the crate, because it has a rogue dependency that registers with a command-and-control server to offer arbitrary code execution. | ||||
| CVE-2026-56796 | 1 Dell | 2 Command Update, Dell Command Update (dcu) | 2026-08-21 | 6.6 Medium |
| Dell Command Update (DCU), versions prior to 5.7.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||
| CVE-2026-49817 | 1 Dell | 2 Command Update, Dell Command Update (dcu) | 2026-08-21 | 7.8 High |
| Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||
| CVE-2026-49816 | 1 Dell | 2 Command Update, Dell Command Update (dcu) | 2026-08-21 | 7.8 High |
| Dell Command Update (DCU), versions prior to 5.7.1, contain a Deserialization of Untrusted Data vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||
| CVE-2026-14564 | 1 Innotim Software Telecommunications And Consulting Trade Ltd. Co. | 1 Logsign Siem | 2026-08-21 | 9 Critical |
| Insufficiently Protected Credentials vulnerability in Innotim Software Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Retrieve Embedded Sensitive Data. This issue affects Logsign SIEM: from 6.4.97 before 6.4.114. | ||||
| CVE-2026-66620 | 2 Derek Herman, Wordpress | 2 Optiontree, Wordpress | 2026-08-21 | 7.2 High |
| Editor PHP Object Injection in OptionTree <= 2.7.3 versions. | ||||
| CVE-2026-73376 | 2 Supsystic, Wordpress | 2 Ultimate Maps By Supsystic, Wordpress | 2026-08-21 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | ||||
| CVE-2026-73397 | 2 Wordpress, Youzify | 2 Wordpress, Youzify | 2026-08-21 | 9.8 Critical |
| Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions. | ||||
| CVE-2026-53456 | 1 Ha-china | 1 Blueprint-studio | 2026-08-21 | N/A |
| Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio terminal SSH key authentication in custom_components/blueprint_studio/backend/terminal_manager.py wrote SSH private-key material to a file under the Home Assistant configuration directory before applying restrictive permissions and relied on best-effort cleanup. The key could temporarily remain on disk and could persist if cleanup failed or Home Assistant crashed. A user or process with filesystem access to the Home Assistant configuration directory could obtain the residual private key. This issue is fixed in version 2.5.2. | ||||
| CVE-2026-8810 | 1 Insyde | 1 Insydeh2o | 2026-08-21 | 6.9 Medium |
| On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables. | ||||