Export limit exceeded: 395710 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395710 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93894 | 2 Varnish-software, Vinyl-cache | 2 Varnish Cache, Vinyl Cache | 2026-09-19 | N/A |
| In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This can be used as a remote denial of service (DoS) vector to make the child process segfault or assert, and then restart. Effectively exploiting this vulnerability requires prior knowledge about the VCL in use and the ability to craft a request that contains a string that is long enough to fill the remaining workspace at the call site while staying under the different request size limits (http_req_size, http_req_hdr_len, etc.). | ||||
| CVE-2026-18911 | 1 Zohocorp | 1 Manageengine Datasecurity Plus | 2026-09-19 | 7.5 High |
| ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication. | ||||
| CVE-2026-84909 | 2 Smub, Wordpress | 2 Custom Twitter Feeds – A Tweets Widget Or X Feed Widget, Wordpress | 2026-09-19 | 6.4 Medium |
| The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable on common installs where the admin has configured access tokens with zero or multiple legacy feeds, as this causes the ctf_statuses support_legacy_shortcode option to be set to boolean true by default, activating the unfiltered legacy shortcode attribute code path. | ||||
| CVE-2026-92561 | 2 Wordpress, Wpdevelop | 2 Wordpress, Booking Calendar | 2026-09-19 | 6.1 Medium |
| The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The nonce check is bypassed by default because the 'booking_is_nonce_at_front_end' option ships disabled, allowing unauthenticated requests to reach the vulnerable sink without any verification. | ||||
| CVE-2026-93292 | 1 Signoz | 1 Signoz | 2026-09-19 | 8.5 High |
| SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. Authenticated attackers can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses. | ||||
| CVE-2026-15579 | 1 Moxa | 1 Tn-4500b Series | 2026-09-19 | N/A |
| An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length during Web login processing. This may allow a remote attacker to submit a specially crafted overly long input, triggering a buffer overflow that can cause the authentication process to crash and result in a Denial of Service (DoS) attack. | ||||
| CVE-2026-93383 | 1 Google | 1 Chrome | 2026-09-19 | 4.3 Medium |
| Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-93385 | 1 Google | 1 Chrome | 2026-09-19 | 6.5 Medium |
| Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-18912 | 1 Zohocorp | 1 Manageengine Datasecurity Plus | 2026-09-19 | 7.7 High |
| ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL queries through the Reports module. | ||||
| CVE-2026-87915 | 2 Danieliser, Wordpress | 2 Popup Maker – Boost Sales, Conversions, Optins, Subscribers With The Ultimate Wp Popup Builder, Wordpress | 2026-09-19 | 7.2 High |
| The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via values[Name] Parameter in all versions up to, and including, 1.24.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses sanitization applied on output is insufficient in this context because HTML entities within allowed attribute values survive normalization intact and are later evaluated by the jQuery(link.attr('href')) sink in wp-admin/js/common.js when a contextual help tab anchor is clicked. | ||||
| CVE-2026-93492 | 1 Redhat | 11 Amq Broker, Apicurio Registry, Build Keycloak and 8 more | 2026-09-19 | 5.3 Medium |
| A flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS). | ||||
| CVE-2026-93589 | 1 Imagemagick | 1 Imagemagick | 2026-09-19 | 3.7 Low |
| ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56. | ||||
| CVE-2026-93372 | 1 Google | 1 Chrome | 2026-09-19 | 9.6 Critical |
| Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-93375 | 1 Google | 1 Chrome | 2026-09-19 | 8.1 High |
| Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | ||||
| CVE-2026-93373 | 1 Google | 1 Chrome | 2026-09-19 | 9.6 Critical |
| Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High) | ||||
| CVE-2026-93381 | 1 Google | 1 Chrome | 2026-09-19 | 8.8 High |
| Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High) | ||||
| CVE-2026-93377 | 1 Google | 1 Chrome | 2026-09-19 | 8.8 High |
| Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-93378 | 1 Google | 1 Chrome | 2026-09-19 | 3.1 Low |
| Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium) | ||||
| CVE-2026-93386 | 1 Google | 1 Chrome | 2026-09-19 | 5.4 Medium |
| UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-93374 | 1 Google | 1 Chrome | 2026-09-19 | 9.6 Critical |
| Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||