Export limit exceeded: 395643 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395643 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-67399 | 1 Webpros | 1 Whmcs | 2026-09-17 | N/A |
| Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. | ||||
| CVE-2026-25290 | 1 Qualcomm | 1 Snapdragon | 2026-09-17 | 7.8 High |
| Memory Corruption when validating large data buffers from external sources using addition to check buffer length. | ||||
| CVE-2026-90822 | 1 Fatpipe Networks | 3 Ipvpn, Mpvpn, Warp | 2026-09-17 | 9.8 Critical |
| FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerability in the xtremed daemon. An unauthenticated remote attacker with access to the affected management interface can submit crafted input to the AuthFormServlet endpoint, causing authentication data to be processed by a shell and allowing arbitrary commands to execute as root. The affected management interface is disabled by default and must be affirmatively enabled by the customer before the endpoint becomes reachable. FatPipe recommends restricting management access to trusted administrative networks and using WAN access control lists to limit access to trusted sources. Customers running the affected end-of-life firmware can contact FatPipe Support for help confirming their firmware version and upgrading to a current supported release at https://www.fatpipeinc.com/support/support, support@fatpipeinc.com, or +1 800-724-8521 (option 3). | ||||
| CVE-2026-24073 | 1 Qualcomm | 1 Snapdragon | 2026-09-17 | 7.8 High |
| Memory corruption when processing decode statistics due to insufficient validation of offset against structure size. | ||||
| CVE-2026-62108 | 2 Miniorange, Wordpress | 2 Headless Single Sign On, Wordpress | 2026-09-17 | 9.8 Critical |
| Unauthenticated Broken Authentication in Headless Single Sign On <= 1.7.0 versions. | ||||
| CVE-2026-14277 | 1 Ibm | 1 I Access Family | 2026-09-17 | 6.3 Medium |
| IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file. | ||||
| CVE-2026-14276 | 1 Ibm | 1 I Access Family | 2026-09-17 | 6.3 Medium |
| IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a malicious emulator macro RunProgram action. | ||||
| CVE-2026-14275 | 1 Ibm | 1 I Access Family | 2026-09-17 | 6.3 Medium |
| IBM i Access Family 1.1.2.0 through 1.1.9.15 IBM i Access Client Solutions could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a STRPCCMD CL command. | ||||
| CVE-2026-76413 | 1 Cisco | 1 Secure Firewall Management Center | 2026-09-17 | 8.2 High |
| A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO) handler for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to log in as the Cisco ASDM administrator user. This vulnerability is due to improper management of the Cisco ASDM SSO token. An attacker could exploit this vulnerability by performing session token forgery techniques. A successful exploit could allow the attacker to log in as the administrator user and, by repeating this action, keep legitimate administrators locked out of the ASDM indefinitely. | ||||
| CVE-2026-92955 | 1 Patriksimek | 1 Vm2 | 2026-09-17 | 10 Critical |
| vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions. | ||||
| CVE-2026-54471 | 1 Dell | 1 Smartfabric Manager | 2026-09-17 | 3.5 Low |
| Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure. | ||||
| CVE-2026-93015 | 1 Bluekitchen | 1 Btstack | 2026-09-17 | 6.3 Medium |
| BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the fixed table holds, causing out-of-bounds writes that corrupt adjacent static objects and crash the process or sever event delivery. | ||||
| CVE-2026-93307 | 1 O-ran-sc | 1 Smo Oam | 2026-09-17 | 4.3 Medium |
| A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipulation of the argument additionalFields.padding leads to uncontrolled memory allocation. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a bug report but has not responded yet. | ||||
| CVE-2026-78668 | 2026-09-17 | N/A | ||
| reserved but not needed | ||||
| CVE-2025-66974 | 2026-09-17 | 7.5 High | ||
| An issue in Prolink 13A Smart Plug Model Version: DS-3202M-UKv3 Wi-Fi and Application Version mEzee 2.6.7 allows attackers to cause a Denial of Service (DoS) or connection to an attacker-controlled device via supplying a crafted packet during the provisioning phase. | ||||
| CVE-2026-79410 | 1 Webkul | 1 Bagisto | 2026-09-17 | 8.1 High |
| Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods. | ||||
| CVE-2026-88616 | 1 Dromara | 1 Ruoyi-vue-plus | 2026-09-17 | 8.8 High |
| An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components | ||||
| CVE-2026-52484 | 2026-09-17 | 8.8 High | ||
| An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/device-management-utilities-internet.cgi component | ||||
| CVE-2026-79409 | 1 Webkul | 1 Bagisto | 2026-09-17 | 6.5 Medium |
| An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfilment components. | ||||
| CVE-2026-79411 | 1 Webkul | 1 Bagisto | 2026-09-17 | 8.8 High |
| Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding only the settings.users.edit permission to escalate to full administrator. The user-update endpoint (route admin.settings.users.update, UserController::update()) does not verify that the actor is permitted to grant the requested role, does not prevent a user from changing their own role, and does not restrict assignment to roles whose permission set is a subset of the actor's own. By submitting a request that sets role_id to the Administrator role for their own account, a low-privileged administrator gains every admin-panel capability, including store configuration, payment gateway credentials, and customer PII. | ||||