Export limit exceeded: 392110 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (392110 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84523 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | 5.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or write kernel memory. | ||||
| CVE-2026-84519 | 1 Apple | 2 Ios And Ipados, Macos | 2026-09-15 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a disk image with maliciously crafted files may lead to unexpected system termination. | ||||
| CVE-2026-84489 | 1 Apple | 2 Ios And Ipados, Macos | 2026-09-15 | 5.5 Medium |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to cause a denial of service. | ||||
| CVE-2026-81551 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-15 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability. | ||||
| CVE-2026-81540 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-15 | 8.5 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability. | ||||
| CVE-2026-81210 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-15 | 7.7 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs routinely carry connection strings, {dsnextenc} ciphertexts (decryptable via d2-f023), and customer-data row samples. This is the operator's tenant-to-tenant PVC-leakage threat verbatim; MEDIUM→HIGH via threat match. | ||||
| CVE-2026-80424 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-09-15 | 9.1 Critical |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction. | ||||
| CVE-2026-79394 | 1 Xiongmai | 1 Ip Camera Xm530 | 2026-09-15 | 7.5 High |
| An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP. | ||||
| CVE-2026-79035 | 1 Zetamarketingplatform | 1 Zmp | 2026-09-15 | 6.1 Medium |
| A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted URL into the ca parameter. | ||||
| CVE-2026-78135 | 1 Strongswan | 1 Strongswan | 2026-09-15 | 5.6 Medium |
| libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are mishandled, there can be an authentication bypass. | ||||
| CVE-2026-78130 | 1 Strongswan | 1 Strongswan | 2026-09-15 | 7.5 High |
| strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. | ||||
| CVE-2026-78123 | 1 Strongswan | 1 Strongswan | 2026-09-15 | 5.9 Medium |
| strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. | ||||
| CVE-2026-77159 | 1 Redhat | 2 Enterprise Linux, Libvirt | 2026-09-15 | 5.5 Medium |
| A symlink-following flaw was found in libvirt's qemuTPMEmulatorPrepareHost() function. The function uses a path-based chown() on the swtpm logfile without checking for symbolic links. A local attacker with access to the swtpm account can replace the logfile with a symlink, causing libvirtd (running as root) to transfer ownership of an arbitrary file to the swtpm user. | ||||
| CVE-2026-71641 | 1 Zju-fast-lab | 1 Ego Planner V2 | 2026-09-15 | 7.5 High |
| An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via thenteraction between traj_server, poscmd_2_odom, and the EGOReplanFSM emergency recovery logic | ||||
| CVE-2026-65831 | 2026-09-15 | 7.7 High | ||
| ArcadeDB is a Multi-Model DBMS. Prior to 26.7.1, a reader-role user can submit POST /api/v1/command/{database} with language: js because PolyglotQueryEngine.command, PolyglotQueryEngine.analyze, and PolyglotQueryEngine.registerFunctions do not enforce database-administrator authorization. GraalPolyglotEngine also permits scripts to bypass the allowedPackages whitelist by reflecting from the bound database object through database.getClass().getClassLoader().loadClass to arbitrary host classes. These cooperating defects allow a read-only database user to read arbitrary host files outside the database scope. Process creation is already blocked, so OS command execution is not confirmed. The issue is distinct from CVE-2026-44221, CVE-2026-54076, and CVE-2026-54077. This issue is fixed in version 26.7.1. | ||||
| CVE-2026-65415 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | 8.1 High |
| A race condition was addressed with additional validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A local user may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2026-65401 | 1 Apple | 1 Macos | 2026-09-15 | 5.5 Medium |
| A race condition was addressed with improved state handling. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-65395 | 1 Apple | 4 Ios And Ipados, Macos, Tvos and 1 more | 2026-09-15 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27. Processing a maliciously crafted image may result in memory corruption. | ||||
| CVE-2026-64736 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | 7.1 High |
| An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Sequoia 15.8, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-59971 | 1 Designcomputer | 1 Mysql-mcp-server | 2026-09-15 | 10 Critical |
| MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or enable_dns_rebinding_protection, while the Starlette routes /, /sse, and /messages/ have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql, or can use DNS rebinding to make a victim's browser relay same-origin requests to a locally bound service, and supply a query that reaches cursor.execute(query). This allows unauthenticated disclosure and modification of the configured database; when the MySQL account has FILE privileges, the same access can read or write server files and may enable code execution. The default stdio transport is not affected. This issue is fixed in 0.4.2. | ||||