Export limit exceeded: 390074 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 390074 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390074 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81905 | 1 Concretecms | 1 Concrete Cms | 2026-09-11 | N/A |
| Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent login) in a single table with a type column, but the redemption path resolves a hash by value alone and does not verify its type. As a result, a hash issued for one purpose can be redeemed for another: a long-lived registration hash (60-day expiry) can be submitted to the password-change endpoint to set a new password on the target account, and a password-reset hash can be submitted to the email-validation endpoint to activate an account. Exploitation requires the attacker to first obtain a valid hash through a separate channel (for example email interception, log exposure, or SSRF against an internal mail relay), so the flaw amplifies the impact of any hash disclosure rather than creating a standalone entry point. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 6.3 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting. | ||||
| CVE-2026-77807 | 2 Acyba, Wordpress | 2 Acymailing – An Ultimate Newsletter Plugin And Marketing Automation Solution For Wordpress, Wordpress | 2026-09-11 | 7.5 High |
| The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the `user[name]` Parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires "Embed images" option in AcyMailing configuration being enabled. | ||||
| CVE-2026-73784 | 2026-09-11 | 8.8 High | ||
| A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate another user. | ||||
| CVE-2026-62437 | 1 Xen | 1 Xen | 2026-09-11 | 6.5 Medium |
| When guests are terminated, various pieces of cleanup need carrying out. The cleaning up of PCI devices which were assigned to guests, and the associated removal of tracking structures for IRQs used by the devices occurs relatively early in the process. Unfortunately after that point the guest about to be terminated could cause its device model (DM) to re-establish such tracking structures, by having it bind one or more IRQs anew. While some of those tracking structures would still be cleaned up later on, at least one would not be. | ||||
| CVE-2026-79602 | 1 Xen | 1 Xen | 2026-09-11 | 8.8 High |
| A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen. | ||||
| CVE-2026-28623 | 2026-09-11 | 3.3 Low | ||
| In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28627 | 2026-09-11 | 4.3 Medium | ||
| In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-21088 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-09-11 | 7.8 High |
| Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-71645 | 2026-09-11 | N/A | ||
| An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the exploration state machine | ||||
| CVE-2026-89156 | 1 Pcre | 1 Pcre2 | 2026-09-11 | 2.9 Low |
| PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. | ||||
| CVE-2026-89157 | 1 Pcre | 1 Pcre2 | 2026-09-11 | 5.7 Medium |
| PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. | ||||
| CVE-2026-86840 | 1 Bitfrost.io | 1 Bifrost | 2026-09-11 | 9.1 Critical |
| The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying that the caller is authorized to mint on behalf of that channel. This allows an attacker to inflate a channel's recorded mint volume and cause protocol commission payments to be disproportionately distributed to that channel during commission settlement. | ||||
| CVE-2026-0084 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In multiple functions of HostEmulationManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28572 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28596 | 2026-09-11 | 5.5 Medium | ||
| In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28600 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28611 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28616 | 2026-09-11 | 7.8 High | ||
| In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28622 | 2026-09-11 | 3.3 Low | ||
| In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28671 | 2026-09-11 | 3.3 Low | ||
| In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||