Export limit exceeded: 395610 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395610 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92785 | 1 Angel-ml | 1 Angel | 2026-09-18 | 8.1 High |
| Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint. | ||||
| CVE-2026-92786 | 1 Lightgbm-org | 1 Lightgbm | 2026-09-18 | 7.8 High |
| LightGBM through 4.7.0 fails to validate child and split array values when parsing text models, allowing attackers to write out-of-bounds memory during SHAP prediction. Attackers can craft malicious model files with invalid node references that trigger out-of-bounds writes at attacker-chosen offsets in the leaf_depth_ buffer during feature contribution computation. | ||||
| CVE-2026-92790 | 1 Higress-group | 1 Higress | 2026-09-18 | 6.5 Medium |
| Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and return a continue action that bypasses AI token rate limiting. Unauthenticated attackers can craft a malformed Cookie header to skip rate limit checks and exceed thresholds intended to restrict costly model backend calls. | ||||
| CVE-2026-92796 | 1 Manticoresoftware | 1 Manticore Search | 2026-09-18 | 8.8 High |
| Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing read-only users to execute unauthorized queries. Attackers can append additional SELECT statements after the first statement to read credential tables and obtain password hashes that authenticate as administrators without plaintext recovery. | ||||
| CVE-2026-92809 | 1 Prestashop | 2 Prestashop, Psgdpr | 2026-09-18 | 4.3 Medium |
| PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authenticated attackers can submit arbitrary customer identifiers to create forged consent records for other customers, corrupting audit logs. | ||||
| CVE-2026-92811 | 1 Browserless | 2 Browserless, Chrome | 2026-09-18 | 6.5 Medium |
| browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authenticated token holders to read arbitrary files. Attackers can navigate Playwright-driven browsers to file scheme URLs and access files accessible to the container process despite the ALLOW_FILE_PROTOCOL setting defaulting to false. | ||||
| CVE-2026-50604 | 1 Acer | 1 Agent Service | 2026-09-18 | N/A |
| A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The socket handshake process does not properly require authentication before granting access to the service. Under certain circumstances, an unauthorized connection may be established, potentially allowing access to functionality that should be restricted. | ||||
| CVE-2026-87935 | 2 Ichurakov, Wordpress | 2 Paid Downloads, Wordpress | 2026-09-18 | 8.1 High |
| The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_request_handler function. This is due to missing authorization and file type validation in the admin_request_handler function, which is reachable unauthenticated via is_admin() returning true for /wp-admin/admin-post.php. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. On Apache servers where AllowOverride is enabled, an .htaccess file placed in the upload directory may block direct HTTP retrieval of uploaded files, limiting exploitability to stacks that do not honor .htaccess directives such as nginx, LiteSpeed, and Apache with AllowOverride None. | ||||
| CVE-2026-44940 | 1 Suse | 1 Suse Observability | 2026-09-18 | 5.7 Medium |
| The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment. | ||||
| CVE-2026-50606 | 1 Acer | 1 System Monitoring | 2026-09-18 | N/A |
| A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions. | ||||
| CVE-2026-50607 | 1 Acer | 1 System Monitoring | 2026-09-18 | N/A |
| A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access. | ||||
| CVE-2026-50608 | 1 Acer | 1 System Monitoring | 2026-09-18 | N/A |
| A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible. | ||||
| CVE-2026-50609 | 1 Acer | 1 System Monitoring | 2026-09-18 | N/A |
| A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. Insufficient access controls within a privileged Named Pipe service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system. | ||||
| CVE-2026-50610 | 1 Acer | 1 System Monitoring | 2026-09-18 | N/A |
| A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense due to insufficient access controls in a privileged service. An authenticated local user may be able to access the service and perform unauthorized registry modifications, potentially resulting in local privilege escalation. | ||||
| CVE-2026-78425 | 1 Neuvector | 1 Neuvector | 2026-09-18 | N/A |
| Authorised users of outside applications behind the same corporate identity provider (IdP), for example, a wiki, a ticketing system, an expenses tool, or anything they legitimately hold an account on can log into their system via SAML SSO. The IdP issues an assertion to them. If that assertion is presented to NeuVector, NeuVector accepts it because the only thing distinguishing "an assertion for NeuVector" from "an assertion for the wiki" is the element, and the `NotInAudience` warning that reports the mismatch is never read. | ||||
| CVE-2026-78427 | 1 Neuvector | 1 Neuvector | 2026-09-18 | 4.3 Medium |
| The NeuVector admission webhook silently excludes containers from policy evaluation when their image path matches one of three hardcoded service mesh sidecar images. Since the image path is entirely controlled by the workload author, any user capable of deploying workloads can evade admission deny rules simply by naming their image path after one of these sidecar images. | ||||
| CVE-2026-90823 | 1 Fatpipe Networks | 3 Ipvpn, Mpvpn, Warp | 2026-09-18 | 9.8 Critical |
| FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /usr/sbin/auth_user_pass. An unauthenticated remote attacker with access to the affected management interface can submit a crafted authentication request that reaches an unchecked copy into a fixed-size stack buffer, potentially allowing arbitrary code execution as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3). | ||||
| CVE-2026-92918 | 1 Cjbi | 1 Admin3 | 2026-09-18 | 8.8 High |
| admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log:view permission can read the JSON response from the GET /logs endpoint to harvest session tokens and replay them as bearer credentials for full user access. | ||||
| CVE-2026-92919 | 1 Cjbi | 1 Admin3 | 2026-09-18 | 8.1 High |
| admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on Windows deployments. Attackers can use dot-dot path segments in filenames to escape the configured storage directory and overwrite arbitrary files accessible to the server process. | ||||
| CVE-2026-92920 | 1 Cjbi | 1 Admin3 | 2026-09-18 | 5.4 Medium |
| admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access with original permissions. Attackers can continue using bearer tokens issued before account disablement to authenticate requests, as the AuthInterceptor never re-validates the user's locked status and session expiry resets on each request. | ||||