Export limit exceeded: 391798 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 391798 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (391798 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79728 | 1 Dell | 1 Secure Connect Gateway | 2026-09-14 | 6.5 Medium |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker. | ||||
| CVE-2026-79695 | 1 Dell | 3 Secure Connect Gateway, Secure Connect Gateway Appliance, Secure Connect Gateway Application | 2026-09-14 | 7.3 High |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling of Highly Compressed Data (Data Amplification) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. | ||||
| CVE-2026-79577 | 2026-09-14 | 9.8 Critical | ||
| An issue in the /cas/login component of sso-master v1.0.0 allows attackers to authenticate into the application without a password via sending a crafted POST request. | ||||
| CVE-2026-79573 | 2026-09-14 | 6.5 Medium | ||
| L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement. | ||||
| CVE-2026-79389 | 2026-09-14 | 7.4 High | ||
| Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing. An attacker with network access can replay or modify captured MQTT messages, including security-related nonce, timestamp, and signature fields, and the device accepts the modified messages and executes the associated commands. | ||||
| CVE-2026-79379 | 1 Bestechnic | 1 Bes2300 | 2026-09-14 | 6.5 Medium |
| A buffer overflow in the SBC_DecodeFrames() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier and fixed in v.5.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted frame. | ||||
| CVE-2026-78849 | 1 Netgate | 1 Pfsense | 2026-09-14 | 5.4 Medium |
| Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_status.widget.php file | ||||
| CVE-2026-75439 | 1 Free5gc | 1 Upf | 2026-09-14 | 7.5 High |
| An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component | ||||
| CVE-2026-75429 | 1 Powerjob | 1 Powerjob | 2026-09-14 | 9.8 Critical |
| PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Server-Worker transport layer | ||||
| CVE-2026-75171 | 1 Hubcore | 1 Hubcore | 2026-09-14 | 9.8 Critical |
| An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. | ||||
| CVE-2026-75167 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-14 | 4.3 Medium |
| A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts. | ||||
| CVE-2026-73324 | 1 Videolan | 1 Vlc Media Player | 2026-09-14 | 4.3 Medium |
| Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from an attacker-controlled network source. Exploitation requires user interaction and may disclose a limited, layout-dependent amount of VLC process memory. Exposure depends on build configuration. | ||||
| CVE-2026-71620 | 2026-09-14 | 8.1 High | ||
| File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file | ||||
| CVE-2026-62653 | 1 Siemens | 1 Reyrolle 7sr5 | 2026-09-14 | 6.8 Medium |
| A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol that is exposed when the device is placed into a special firmware-update mode is not properly validated, resulting in a memory corruption condition. This could allow an unauthenticated attacker with physical access to the device to cause a crash and potentially execute arbitrary code on the device. | ||||
| CVE-2026-62647 | 1 Siemens | 1 Reyrolle 7sr5 | 2026-09-14 | 7.4 High |
| A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant values (such as session identifiers used for authentication purposes) that is not initialized with a True Random Number Generator (TRNG), resulting in a predictable sequence of generated values. This could allow an unauthenticated remote attacker to more easily predict the generated values and impersonate a legitimate authenticated user, potentially gaining unauthorized access to the device. | ||||
| CVE-2026-52307 | 1 Classcms | 1 Classcms | 2026-09-14 | 5.4 Medium |
| An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the title field. | ||||
| CVE-2026-38076 | 1 Artifex | 1 Jbig2dec | 2026-09-14 | 7.5 High |
| An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex commit cc37d0 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-34223 | 1 Siemens | 8 Desigo Cc Clickonce Client V6, Desigo Cc Clickonce Client V7, Desigo Cc Family V8 and 5 more | 2026-09-14 | 8.2 High |
| A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC family V8 (All versions), Desigo CC family V9 (All versions), Desigo CC Flex Client V6 (All versions), Desigo CC Flex Client V7 (All versions), Desigo CC Installed Client V6 (All versions), Desigo CC Installed Client V7 (All versions). The affected application is vulnerable to Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded within user-defined graphics documents. Specifically, when the script within a graphics document is designed or modified by an attacker to include malicious commands. When a user opens a compromised graphics document, the embedded script is executed on the client application instance, allowing an attacker to write arbitrary files to the client's operating system. Successful exploitation requires an attacker to craft a malicious graphics document and entice a user with sufficient privileges to display it. This could lead to compromise of the client operating system and potential lateral movement within the organization. | ||||
| CVE-2026-22591 | 1 Eprosima | 1 Fast Dds | 2026-09-14 | 7.5 High |
| eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue. | ||||
| CVE-2024-58381 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-14 | 7.5 High |
| PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash. | ||||