Export limit exceeded: 393084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 393084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 393084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 393084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 393084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 393084 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (393084 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-11921 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-09-15 | N/A |
| IBM Verify Identity Access containers may not apply management password change operations correctly. | ||||
| CVE-2026-39038 | 2026-09-15 | N/A | ||
| BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx. | ||||
| CVE-2026-87511 | 1 Google | 1 Chrome | 2026-09-15 | 4.3 Medium |
| Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-87473 | 1 Google | 1 Chrome | 2026-09-15 | 6.5 Medium |
| Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87469 | 1 Google | 1 Chrome | 2026-09-15 | 4.3 Medium |
| Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low) | ||||
| CVE-2026-11927 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-09-15 | N/A |
| IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services. | ||||
| CVE-2026-11928 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-09-15 | N/A |
| IBM Verify Identity Access is vulnerable to a buffer overflow attack. | ||||
| CVE-2026-85025 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-09-15 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an unauthenticated attacker to execute arbitrary code and access or modify chat sessions through publicly shared MCP project endpoints due to improper enforcement of public-flow security restrictions and session isolation controls. | ||||
| CVE-2026-91990 | 1 Tornadoweb | 1 Tornado | 2026-09-15 | 7.5 High |
| Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit. Attackers can send crafted multipart requests with many parts to create large transient lists, exhausting server memory and causing denial of service. | ||||
| CVE-2026-91980 | 1 Vikunja | 1 Vikunja | 2026-09-15 | 4.3 Medium |
| vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for unauthorized teams. | ||||
| CVE-2026-91948 | 1 Freerdp | 1 Freerdp | 2026-09-15 | 7.5 High |
| FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution. | ||||
| CVE-2026-91943 | 1 Unclecode | 1 Crawl4ai | 2026-09-15 | 7.7 High |
| Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results. | ||||
| CVE-2026-91932 | 1 Flowiseai | 1 Flowise | 2026-09-15 | 8.5 High |
| Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code. | ||||
| CVE-2026-90537 | 1 Wwbn | 1 Avideo | 2026-09-15 | 8.2 High |
| WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages. | ||||
| CVE-2026-90474 | 1 Samanhappy | 1 Mcphub | 2026-09-15 | 6.8 Medium |
| MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges. | ||||
| CVE-2026-89267 | 2 Encode, Jowilf | 2 Starlette, Starlette-admin | 2026-09-15 | 4.3 Medium |
| starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns. | ||||
| CVE-2026-89263 | 2 Mogublog Project, Moxi624 | 2 Mogublog, Mogu Blog V2 | 2026-09-15 | 5.3 Medium |
| MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to suppress reply notifications without authorization. | ||||
| CVE-2026-89257 | 1 Wwbn | 1 Avideo | 2026-09-15 | 5.4 Medium |
| AVideo through 29.0 contains an insecure direct object reference (IDOR) vulnerability in objects/categoryDeleteAssets.json.php. The endpoint validates only the Category::canCreateCategory() capability and a CSRF nonce before passing the attacker-supplied $_REQUEST['id'] to Category::deleteAssets(), which recursively removes {systemRootPath}videos/categories/assets/{id}/. It omits the Category::userCanEditCategory() ownership check enforced by the sibling Category::delete(). On installations where the non-default usersCanCreateNewCategories setting is enabled, an authenticated non-admin user with the canUpload capability can send a POST request with an arbitrary category ID and recursively delete any category's on-disk asset directory (icons/images). Category records and videos are not deleted. As of the advisory publication no patched version was available. | ||||
| CVE-2026-89252 | 1 Wwbn | 1 Avideo | 2026-09-15 | 6.5 Medium |
| AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to verify ownership in addLiveLink.php when updating LiveLinks, allowing authenticated users to modify other users' links. A canStream user can overwrite another user's LiveLink HLS source and metadata by supplying an existing linkId, redirecting viewers to attacker-controlled media. | ||||
| CVE-2026-89247 | 1 Wwbn | 1 Avideo | 2026-09-15 | 6.1 Medium |
| WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/AD_Server/VMAP.php, which is reachable without authentication when the AD_Server plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset and idTag values returned by AD_Server::getVMAPSFromRequest() directly into VMAP attributes without encoding. Those values originate from the base64- and JSON-decoded $_REQUEST['vmaps'] parameter, which is not covered by $securityFilter in objects/security.php. A remote attacker can craft a vmaps value (containing a non-empty VAST.campaing entry) and induce a user to open the resulting VMAP URL or a video page using it, injecting arbitrary <vmap:AdBreak> and <vmap:AdTagURI>/AdSource nodes into the generated XML. The player's IMA path (afterVideoJS -> PlayerSkins::setIMAADTag) then requests the attacker-supplied ad URLs, resulting in ad injection and cross-origin requests from the victim's playback session. The issue was unfixed at the time of reporting. | ||||