Export limit exceeded: 397061 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (397061 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96892 | 1 Edimax | 1 Br-6428nc | 2026-09-24 | 4.3 Medium |
| A flaw has been found in Edimax BR-6428nC 1.16. The impacted element is the function websRedirect of the component goform Handler. Executing a manipulation of the argument submit-url can lead to open redirect. The attack may be launched remotely. The exploit has been published and may be used. Multiple endpoints are affected. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-96884 | 1 Mantiszip | 1 Mantiszip | 2026-09-24 | 6.3 Medium |
| A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-96880 | 1 Talelin | 1 Lin-cms-spring-boot | 2026-09-24 | 5.3 Medium |
| A vulnerability was found in TaleLin lin-cms-spring-boot up to 0.2.1. This impacts the function getBook of the file src/main/java/io/github/talelin/latticy/controller/v1/BookController.java of the component book Endpoint. Performing a manipulation of the argument ID results in improper authorization. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-94097 | 1 Netcore | 1 Nbr200v2 | 2026-09-24 | 10 Critical |
| A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-94092 | 1 Dmlc | 1 Dgl | 2026-09-24 | 5.5 Medium |
| A vulnerability was detected in dmlc dgl up to 2.1.0. This impacts the function load_info/_read_torch_data of the file utils.py. Performing a manipulation of the argument path results in deserialization. The attack can be initiated remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-94050 | 1 D-link | 1 Dir-x1860z | 2026-09-24 | 4.3 Medium |
| A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfg_get/routerd.get_rand_key of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network. Upgrading to version 1.0.7.260821.161908 is able to address this issue. It is suggested to upgrade the affected component. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-92905 | 1 Zohocorp | 2 Manageengine Eventlog Analyzer, Manageengine Log360 | 2026-09-24 | 5.3 Medium |
| ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash the log collector using malformed syslog packets. | ||||
| CVE-2026-88410 | 2026-09-24 | 7.1 High | ||
| The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the application. | ||||
| CVE-2026-88405 | 2026-09-24 | 9.8 Critical | ||
| A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of Univer v1.0.0-alpha.2 allows attackers to execute arbitrary code via a crafted payload. | ||||
| CVE-2026-87739 | 1 Papercut | 1 Papercut Mf | 2026-09-24 | N/A |
| An improper authentication vulnerability in PaperCut MF/NG allows an unauthenticated, remote attacker to trigger report generation. By submitting report generation requests without valid credentials, an attacker can generate reports and gain unauthorized access to sensitive information. | ||||
| CVE-2026-82077 | 1 Papercut | 1 Papercut Mf | 2026-09-24 | N/A |
| An improper limitation of a pathname to a restricted directory (path traversal) vulnerability in the Scan-to-Fax component of PaperCut NG and PaperCut MF allows an authenticated administrator to execute arbitrary commands on the underlying host via crafted fax provider settings. | ||||
| CVE-2026-7169 | 1 Evope Collector | 1 Evope Collector | 2026-09-24 | N/A |
| a vulnerability involving an unchecked search path element in Evope Collector, versions prior to 1.1.7.13, allows a local attacker without privileges to load a malicious DLL by placing a ‘wtsapi32.dll’ file in the ‘C:\ProgramData\Evope\’ directory. The ‘Evope.Service.exe’ component, which runs with ‘NT AUTHORITY\SYSTEM’ privileges, loads this DLL without properly verifying its integrity or origin. Successful exploitation could allow code execution with SYSTEM privileges and result in local privilege escalation. | ||||
| CVE-2026-79680 | 1 Qt | 1 Qt | 2026-09-24 | N/A |
| Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modified VNC client that violates the RFB protocol can bypass Qt VNC Server's password authentication and gain unauthorized remote access to the shared application, compromising the confidentiality and integrity of the session. | ||||
| CVE-2026-79320 | 2026-09-24 | 6.1 Medium | ||
| Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime. When a downstream application enables the experimental slot fixes option and uses scoped components, assigning a string to the textContent property of such a component's host element causes the value to be parsed as HTML instead of being inserted as text. If an application writes attacker-controlled data to these host elements, the data can be interpreted as markup and script can execute in the context of the application's origin. | ||||
| CVE-2026-78313 | 1 Deltaww | 1 Diaenergie | 2026-09-24 | 6.5 Medium |
| Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | ||||
| CVE-2026-78311 | 1 Deltaww | 1 Diaenergie | 2026-09-24 | 8.8 High |
| SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | ||||
| CVE-2026-78309 | 1 Deltaww | 1 Diaenergie | 2026-09-24 | 8.8 High |
| SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | ||||
| CVE-2026-78308 | 1 Deltaww | 1 Diaenergie | 2026-09-24 | 9.8 Critical |
| Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022. | ||||
| CVE-2026-77193 | 2026-09-24 | 7.5 High | ||
| The eesy_ID2WP – Publish InDesign HTML5 plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.0.3 via the `id2wp_path` parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. | ||||
| CVE-2026-67827 | 1 Zlmediakit | 1 Zlmediakit | 2026-09-24 | 9.8 Critical |
| Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE) via unauthenticated access to the setServerConfig API endpoint, which permits overwriting the ffmpeg.snap configuration parameter with arbitrary shell commands. These commands are subsequently executed through the getSnap API endpoint with the privileges of the ZLMediaKit process. | ||||