Export limit exceeded: 393113 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (393113 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-67390 | 1 Microsoft | 12 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 9 more | 2026-09-15 | 6.5 Medium |
| Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-90647 | 1 Kalkitech | 1 Ase2000 V2 Communication Test Set | 2026-09-15 | 7.4 High |
| ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications. | ||||
| CVE-2026-90648 | 1 Webassembly | 1 Wabt | 2026-09-15 | N/A |
| wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-tableops.inc). When the funcref table allocation fails, table->data is left NULL while table->size keeps the guest-declared element count; thus, bounds checks still pass and table element accesses resolve to absolute memory addresses (i * sizeof(wasm_rt_funcref_t)). This gives arbitrary read and write of host process memory and - via table.get, table.set, and call_indirect - arbitrary code execution, defeating the isolation that wasm2c exists to provide (a full sandbox escape). wasm2c is used as an in-process sandboxing boundary by RLBox and WasmBoxC, including in Firefox, which compiles the Graphite, Hunspell, Ogg, Expat, and Woff2 libraries via wasm2c to contain untrusted font, media, and XML input. Therefore, sandboxing in these applications is potentially affected. Exploitation requires the funcref table allocation to fail, for example under an address-space limit (RLIMIT_AS), on 32-bit hosts, with vm.overcommit_memory=2, or under memory pressure. On 64-bit Linux with default overcommit the allocation succeeds and the defect is not triggered. The wasm2c memory allocator aborts on calloc failure in the same runtime; the table allocator lacks this abort behavior. This was introduced in commit ab9e0b55 (PR #813). | ||||
| CVE-2026-29812 | 1 Cyberpanel | 1 Cyberpanel | 2026-09-15 | 4.3 Medium |
| CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. | ||||
| CVE-2026-37008 | 1 Crewai | 1 Crewai | 2026-09-15 | 8.1 High |
| CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter. | ||||
| CVE-2026-38332 | 2026-09-15 | 2.9 Low | ||
| TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. | ||||
| CVE-2025-64059 | 1 Getgrav | 1 Grav | 2026-09-15 | 1.8 Low |
| Grav 1.7.50.2 allows admins to enter JavaScript via the Home Page editor. NOTE: the relevance of this for stored XSS is disputed because admins are allowed to modify templates, install plugins, and upload other executable content. | ||||
| CVE-2026-29811 | 1 Cyberpanel | 1 Cyberpanel | 2026-09-15 | 7.7 High |
| CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement. | ||||
| CVE-2026-29810 | 1 Cyberpanel | 1 Cyberpanel | 2026-09-15 | 4.3 Medium |
| CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. | ||||
| CVE-2025-45480 | 1 Projectfloodlight | 1 Floodlight | 2026-09-15 | 3 Low |
| Floodlight 71fe8a7 allows disruption of host communication via link spoofing. A port is misclassified as a non-boundary. | ||||
| CVE-2025-63842 | 2026-09-15 | 5.4 Medium | ||
| A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field. | ||||
| CVE-2026-91950 | 1 Freerdp | 1 Freerdp | 2026-09-15 | 6.5 Medium |
| FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs. | ||||
| CVE-2026-91970 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-09-15 | 6.5 Medium |
| Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budgets during migration jobs. Authenticated attackers can submit migration requests pointing to attacker-controlled servers advertising numerous size-compliant attachments, exhausting worker memory and causing denial of service for all users. | ||||
| CVE-2026-19780 | 1 Koha | 1 Koha | 2026-09-15 | N/A |
| Koha Eval Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Koha. Authentication is required to exploit this vulnerability. The specific flaw exists within the web service, which listens on TCP port 8081 by default. The issue results from the lack of proper validation of a user-supplied string before passing it to the eval function. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-29165. | ||||
| CVE-2026-91853 | 1 Totolink | 2 X5000r, X5000r Firmware | 2026-09-15 | 7.4 High |
| A vulnerability has been found in TOTOLINK X5000R 9.1.0cu.2089_B20211224. The impacted element is the function exportOvpn of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user of the component Export Ovpn Handler. The manipulation of the argument filetype leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-11918 | 1 Ibm | 2 Contextforge-mcp-gateway, Contextforge Mcp Gateway | 2026-09-15 | 5.4 Medium |
| IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomplete recursive inspection of nested payload content. | ||||
| CVE-2026-19654 | 2 Redhat, Rsyslog | 3 Enterprise Linux, Enterprise Linux Eus, Rsyslog | 2026-09-15 | 7.5 High |
| A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. | ||||
| CVE-2026-90533 | 1 Flowiseai | 1 Flowise | 2026-09-15 | 6.5 Medium |
| Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrieve the organization owner's full user record including bcrypt password hash and temporary tokens. Attackers can query the endpoint with any user ID to obtain the owner's credential hash for offline cracking, enabling account takeover of the highest-privileged account. | ||||
| CVE-2026-14199 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-09-15 | 7.1 High |
| Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. The Auth Proxy cache key concatenated the username and forwarded identity attributes without a delimiter, so distinct identities could collide on one key. An authenticated user who shapes their own attributes to collide with a higher-privileged user's, while that user's cache entry is live, is authenticated as that user, up to Administrator (authentication bypass by spoofing). | ||||
| CVE-2026-91855 | 1 Open5gs | 1 Open5gs | 2026-09-15 | 5.3 Medium |
| A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFCP Message Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71. Applying a patch is the recommended action to fix this issue. CVE-2025-29339 describes a different assertion failure vulnerability in Open5GS UPF. | ||||