Export limit exceeded: 389874 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389874 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-69854 | 1 Microsoft | 2 Azure Spring Cloud, Spring Cloud Azure | 2026-09-10 | 9 Critical |
| Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-11363 | 2 Kstover, Wordpress | 2 Ninja Forms – The Contact Form Builder That Grows With You, Wordpress | 2026-09-10 | 6.6 Medium |
| The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.6 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. The deserialization is triggered automatically during form import when WPN_Helper::build_nf_cache() invokes $action->get_settings() immediately after the crafted form is imported, requiring no further interaction beyond the import action itself. | ||||
| CVE-2026-87735 | 1 Ocaml | 1 Mirage-crypto-pk | 2026-09-10 | 4.3 Medium |
| An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption. | ||||
| CVE-2025-7062 | 1 Lumi Education Ug | 1 H5p-nodejs-library | 2026-09-10 | N/A |
| A stored cross-site scripting (XSS) vulnerability has been identified in the H5P module `h5p-nodejs-library` by Lumi Education UG in versions up to and including 10.0.4. The library allows users to upload H5P content that contains malicious JavaScript. This code is then executed in the browsers of other users who view the affected H5P content. | ||||
| CVE-2026-16272 | 1 Paytr | 1 Paytr Virtual Pos Iframe Api (v9x) Whmcs Module | 2026-09-10 | 9.1 Critical |
| Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Exploitation of Trusted Identifiers. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3. | ||||
| CVE-2026-87795 | 1 Luben | 1 Zstd-jni | 2026-09-10 | 8.2 High |
| zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds memory reads. Attackers can supply untrusted offset or length values to read native heap memory into the compression dictionary, typically causing JVM crashes. | ||||
| CVE-2026-15140 | 1 Everpure | 1 Portworx Operator | 2026-09-10 | N/A |
| A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access than intended, potentially resulting in elevated privileges within the Kubernetes cluster. | ||||
| CVE-2026-64857 | 1 Tirrenotechnologies | 1 Tirreno | 2026-09-10 | N/A |
| tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's credentials and establishes the authenticated session, but it does not call `session_regenerate_id()` afterward. As a result, the session identifier is not rotated on login, it stays the same before and after authentication. An attacker able to fix a known session identifier in a victim's browser (for example through a network man-in-the-middle position, or a separate cross-site scripting or subdomain cookie-injection issue) could then gain access to the victim's authenticated session. The issue is fixed in v0.10.0. The session identifier is now regenerated on successful authentication, and the previous session is destroyed. There is no configuration-level workaround. | ||||
| CVE-2026-87822 | 1 Tdunning | 1 T-digest | 2026-09-10 | 7.5 High |
| t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to inject NaN values that bypass validation checks. Attackers can craft malicious serialized digests containing NaN centroids that degrade sorting performance from O(n log n) to O(n squared), causing severe processing delays during merge operations. | ||||
| CVE-2026-87823 | 1 Luben | 1 Zstd-jni | 2026-09-10 | 8.2 High |
| zstd-jni before 1.5.7-14 performs 32-bit signed bounds checks on three direct-ByteBuffer frame-size native methods, allowing out-of-bounds memory reads via negative or overflowing offsets. Attackers can supply negative offset values near Integer.MIN_VALUE to read unmapped memory, causing JVM termination or extracting arbitrary frame size data from unintended memory locations. | ||||
| CVE-2026-87824 | 1 Luben | 1 Zstd-jni | 2026-09-10 | 7.5 High |
| zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer boundaries by supplying oversized per-sample lengths. Attackers can trigger out-of-bounds memory access by providing crafted sample length arrays that cause the native implementation to walk past the buffer allocation, resulting in JVM termination. | ||||
| CVE-2026-87825 | 1 Luben | 1 Zstd-jni | 2026-09-10 | 7.7 High |
| zstd-jni before 1.5.7-14 contains a use-after-free vulnerability where streams and contexts hold a dictionary's shared lock only during the load call, allowing the dictionary to be closed while still referenced. Attackers can close a dictionary after associating it with a stream or context, causing subsequent read or write operations to access freed native memory, resulting in silent data corruption or JVM crashes. | ||||
| CVE-2026-87877 | 1 Luben | 1 Zstd-jni | 2026-09-10 | 7.7 High |
| zstd-jni versions before 1.5.7-14 fail to validate closed state in setDict, setLongMax, setLevel and setRefMultipleDDicts methods of stream classes. Attackers can call these methods on closed streams to write through freed native pointers, corrupting unrelated objects or crashing the JVM. | ||||
| CVE-2026-81330 | 1 Softish | 2 C6 Ear Camera, Earvision Android Application | 2026-09-10 | 6.5 Medium |
| The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits cleartext traffic, and captured network traffic contains reconstructable JPEG or WEBP video frames transmitted over UDP. An attacker within local wireless range may capture and reconstruct the live video stream without transport encryption. | ||||
| CVE-2026-82563 | 1 Softish | 2 C6 Ear Camera, Earvision Android Application | 2026-09-10 | 7.6 High |
| An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation of device status responses, observation of application requests, and potential triggering of firmware-update behavior. | ||||
| CVE-2026-81640 | 1 Softish | 2 C6 Ear Camera, Earvision Android Application | 2026-09-10 | 8.8 High |
| An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of the access-point password and may expose the live video stream, device services, status interfaces, and firmware-update functionality. | ||||
| CVE-2026-77974 | 1 Softish | 2 C6 Ear Camera, Earvision Android Application | 2026-09-10 | 8 High |
| After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through an unauthenticated and unsigned update channel. | ||||
| CVE-2026-67403 | 1 Sage | 1 Sage Ar Automation | 2026-09-10 | N/A |
| Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predictable tenant identifier. | ||||
| CVE-2026-68484 | 1 Sage | 1 Sage Ar Automation | 2026-09-10 | N/A |
| Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privileges. | ||||
| CVE-2026-87874 | 1 Redhat | 3 Ceph Storage, Openstack, Openstack Platform | 2026-09-10 | 8.1 High |
| A flaw was found in the memcached cache plugin of the community.general Ansible collection. Although its documentation states that records are stored in JSON format, the plugin performs no explicit serialization and relies on python-memcached, which pickles values on write and unpickles them on read. Because memcached is unauthenticated and cache keys are predictable, an attacker able to reach a network-exposed or shared memcached instance can write a crafted pickle payload that is deserialized and executed on the Ansible controller when the poisoned fact cache is next read, leading to remote code execution. | ||||