Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413505 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66589 | 2 Kings Plugins, Wordpress | 2 B2bking, Wordpress | 2026-08-19 | 5.4 Medium |
| Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKing: from n/a through 5.2.30. | ||||
| CVE-2026-76164 | 1 Ail-project | 1 Ail-framework | 2026-08-19 | N/A |
| AIL Framework contains a server-side request forgery (SSRF) vulnerability in its crawler submission functionality. A low-privileged authenticated user with access to the crawler interface can submit an arbitrary URL for crawling without adequate validation of the destination host. The crawler can therefore be instructed to make direct HTTP(S) requests to addresses that should not be reachable by application users, including loopback addresses, RFC1918 private networks, link-local addresses, and cloud metadata services such as 169.254.169.254. Manual crawler tasks bypass the existing domain blacklist because they are assigned a non-zero priority, and ordinary IP literals are classified as web targets and fetched directly rather than through Tor or another proxy. Consequently, an attacker can use the AIL server as a network pivot to access services available from the server's network context. Responses generated by these requests, including captured HTML, screenshots, and HAR data, can subsequently be accessed through the crawler interface. This makes the SSRF non-blind and may allow an attacker to disclose sensitive internal application data, service information, or cloud instance metadata and credentials. The patch introduces validation that resolves crawler destinations and rejects URLs resolving to non-global IP addresses, addressing localhost, private-network, and link-local targets. | ||||
| CVE-2024-3884 | 1 Redhat | 19 Amq Streams, Apache Camel Hawtio, Build Keycloak and 16 more | 2026-08-19 | 7.5 High |
| A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack. | ||||
| CVE-2026-64158 | 1 Linux | 1 Linux Kernel | 2026-08-19 | 5.5 Medium |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-56684 | 1 Valkey-io | 1 Valkey | 2026-08-19 | 7.5 High |
| Valkey is a distributed key-value database. Prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached next node and producing a use-after-free that can crash the server or potentially allow remote code execution when TLS is enabled. This issue is fixed in versions 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1. | ||||
| CVE-2026-34399 | 1 Freecad | 1 Freecad | 2026-08-19 | 7.8 High |
| FreeCAD is a free and open-source multiplatform 3D parametric modeler. From 0.19 until 1.1.1, FreeCAD's BIM Workbench contains an eval() call on untrusted data from SVG template files. When a user creates a TechDraw page from a malicious SVG template, arbitrary Python code executes. The vulnerable code is in src/Mod/BIM/bimcommands/BimTDPage.py (line 87). This issue is fixed in version 1.1.1. | ||||
| CVE-2026-18751 | 1 Citrix | 1 Workspace App | 2026-08-19 | N/A |
| External control of file name or path vulnerability in Citrix WorkSpace App on MacOS. This issue affects WorkSpace App: 2607. | ||||
| CVE-2026-76008 | 1 Comfast | 1 Cf-n1-s | 2026-08-19 | 10 Critical |
| A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely. | ||||
| CVE-2026-76004 | 1 Utt | 1 Hiper 1250gw | 2026-08-19 | 9.9 Critical |
| A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected by this vulnerability is the function strcpy of the file /goform/aspApBasicConfigUrcp of the component HTTP Handler. The manipulation of the argument pvid leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-56089 | 1 Dell | 1 Objectscale | 2026-08-19 | 3.3 Low |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. | ||||
| CVE-2026-56090 | 1 Dell | 1 Objectscale | 2026-08-19 | 7.3 High |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | ||||
| CVE-2026-56685 | 1 Dell | 1 Objectscale | 2026-08-19 | 7.3 High |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution. | ||||
| CVE-2026-56686 | 1 Dell | 1 Objectscale | 2026-08-19 | 7.8 High |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | ||||
| CVE-2026-59909 | 1 Dell | 1 Objectscale | 2026-08-19 | 7.1 High |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. | ||||
| CVE-2026-59910 | 1 Dell | 1 Objectscale | 2026-08-19 | 7.8 High |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | ||||
| CVE-2026-59911 | 1 Dell | 1 Objectscale | 2026-08-19 | 5.5 Medium |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Insertion of Sensitive Information into Log File vulnerability in the svc_tools. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure. | ||||
| CVE-2026-21070 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-08-19 | 4.6 Medium |
| Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information. | ||||
| CVE-2026-21058 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-08-19 | 7.1 High |
| Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | ||||
| CVE-2026-21059 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-08-19 | 7.1 High |
| Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege. | ||||
| CVE-2026-21060 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-08-19 | 4.6 Medium |
| Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to access data across multiple user profiles. | ||||