Export limit exceeded: 390737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (7909 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-20267 | 1 Cisco | 2 Ios Xe, Ios Xe Software | 2026-08-14 | 9 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XE Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20267 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284. | ||||
| CVE-2026-20150 | 1 Cisco | 3 Cisco Roomos Software, Roomos, Roomos Cloud | 2026-08-14 | 8.8 High |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20150 are related to improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284. | ||||
| CVE-2026-58437 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.1 High |
| Repository Visibility Manipulation via Git Push Options | ||||
| CVE-2026-55984 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 2.7 Low |
| Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | ||||
| CVE-2026-58417 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.5 High |
| REST API exposes organization membership of private organizations to public | ||||
| CVE-2026-58429 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.9 Medium |
| Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | ||||
| CVE-2026-58508 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 9.1 Critical |
| Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) | ||||
| CVE-2026-58507 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 5.3 Medium |
| Private Repository Existence Disclosure via go-get Meta Endpoint | ||||
| CVE-2026-55986 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 5.4 Medium |
| Email Management API Bypasses ManageCredentials Feature Restrictions | ||||
| CVE-2026-13610 | 2 Iqonic, Wordpress | 2 Kivicare, Wordpress | 2026-08-14 | 7.5 High |
| The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data. | ||||
| CVE-2026-13328 | 2026-08-14 | 5.3 Medium | ||
| The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations. | ||||
| CVE-2026-67287 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-14 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated comment creation in SP Page Builder < 6.8.0 - An unauthenticated attacker can create comments on instances with disabled guest commenting by overriding the setting in question with user supplied input. | ||||
| CVE-2026-58420 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.4 Medium |
| Local File Inclusion via file:// URI in Migration Restore | ||||
| CVE-2026-66804 | 1 Microsoft | 8 Windows 10 22h2, Windows 10 22h2, Windows 11 24h2 and 5 more | 2026-08-14 | 7.8 High |
| Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-73664 | 1 Freepbx | 1 Backup | 2026-08-14 | N/A |
| FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized_keys for the asterisk system user without reliably enforcing backup-only command and source restrictions. The key grants persistent shell access that can execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services. This issue is fixed in version 17.0.11. | ||||
| CVE-2026-19837 | 1 Webkul | 1 Bagisto | 2026-08-14 | 2.7 Low |
| A weakness has been identified in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /admin/customers/search of the component Customer Search. Executing a manipulation of the argument Query can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-72837 | 1 Filebrowser | 1 Filebrowser | 2026-08-14 | 8.8 High |
| File Browser versions before 2.63.20 fail to honor the createUserDir isolation in proxy and hook authentication auto-provisioning paths. Attackers with valid upstream-authenticated credentials can read, modify, delete, and share files belonging to other users by exploiting the server root scope assignment. | ||||
| CVE-2026-19835 | 1 Webkul | 1 Bagisto | 2026-08-14 | 3.8 Low |
| A vulnerability was identified in Webkul Bagisto up to 2.4.4. Affected by this vulnerability is an unknown functionality of the component Customer Item Deletion Endpoint. Such manipulation leads to improper access controls. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-65773 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-08-14 | 7.8 High |
| Improper access control in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-24259 | 1 Apple | 1 Macos | 2026-08-14 | 9.8 Critical |
| This issue was addressed with additional entitlement checks. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to retrieve Safari bookmarks without an entitlement check. | ||||