Export limit exceeded: 96570 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (96570 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-80208 | 1 Apitable | 1 Apitable | 2026-09-01 | 8.2 High |
| APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount in InternalUserController with requiredLogin = false. ResourceInterceptor honours that annotation by returning before any session or API key is validated, and the nginx gateway shipped with the product proxies every /api request to the backend server, so both endpoints are reachable by any unauthenticated client that can reach the gateway. An attacker can POST to /api/v1/internal/getUserHistories to enumerate the accounts sitting in the 30-day cooling-off period that follows a deletion request, then POST to /api/v1/internal/users/{userId}/close for each one. The closure path clears the account's email address, phone number and nickname, cancels its space subscriptions, removes its space memberships and deletes its OAuth bindings, so the cooling-off window that exists to let a user reverse a deletion request is bypassed and the account cannot be recovered. | ||||
| CVE-2026-81093 | 1 Apify | 1 Actors-mcp-server | 2026-09-01 | 8.6 High |
| The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a URL and inspected neither the host name nor the address it resolves to. Loopback, link-local and private ranges therefore passed, including the address cloud providers use to serve instance metadata. The unchecked URL was handed to the web-browser actor and the fetched document was returned in the tool response, so any caller of the MCP server could make it request an endpoint reachable only from the host and read the result, including instance credentials. Version 0.9.12 removes the tool. | ||||
| CVE-2026-78465 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-09-01 | 7 High |
| A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service. | ||||
| CVE-2026-34674 | 1 Adobe | 2 Substance 3d Painter, Substance 3d Sampler | 2026-09-01 | 7.8 High |
| Substance3D - Sampler versions 5.1.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-78002 | 2 Redhat, Rsyslog | 2 Enterprise Linux, Rsyslog | 2026-09-01 | 7.5 High |
| A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system. | ||||
| CVE-2026-5680 | 2 Redhat, Undertow | 17 Apache Camel Hawtio, Build Of Apache Camel - Hawtio, Build Of Apache Camel For Spring Boot and 14 more | 2026-09-01 | 7.5 High |
| A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application. | ||||
| CVE-2026-54721 | 1 Silverstripe | 1 Userforms | 2026-09-01 | 8.8 High |
| Silverstripe UserForms provides a visual form builder for the Silverstripe CMS. From 6.0.0 until 6.4.9, 7.0.7, and 7.1.1, the userform email recipient subject field in the CMS accepts a specially crafted payload that can be interpreted as executable server-side code. An authenticated CMS user with permission to configure a UserForms email recipient can use the subject field to run arbitrary code on the server, compromising confidentiality, integrity, and availability. This issue is fixed in versions 6.4.9, 7.0.7, and 7.1.1. | ||||
| CVE-2026-18965 | 1 Payrange | 1 Payrange | 2026-09-01 | 8.8 High |
| PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account. | ||||
| CVE-2026-50979 | 1 Osbil | 1 Opanel | 2026-09-01 | 8.1 High |
| A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary shell commands via the 'url' parameter | ||||
| CVE-2026-27852 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 7.5 High |
| An attacker that can send mail to a user can craft a message whose headers contain a very large number of email addresses or MIME parameters, which causes excessive memory usage when the message is later parsed. The message is still delivered, but reading it over IMAP can exhaust the memory limit of the process and terminate it, causing denial of service for the affected user. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-33605 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 7.5 High |
| An unauthenticated attacker can crash the ManageSieve login process by sending a small malformed command before authenticating. If running in high-security mode (default for community releases), only the attacker's own connection is terminated. If running in high-performance mode (default for Pro releases), all connections handled by the same managesieve-login process are terminated. Repeating the attack can cause denial of service for Sieve script management. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-40018 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 7.4 High |
| None None None No publicly available exploits are known. | ||||
| CVE-2026-82922 | 1 Shopex | 1 Ecshop | 2026-09-01 | 7.3 High |
| A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82908 | 1 Msi | 1 Dragon Center | 2026-09-01 | 8.8 High |
| A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-81296 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Forms Pro Add On Pack | 2026-09-01 | 7.5 High |
| Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | ||||
| CVE-2026-42391 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 7.5 High |
| An unauthenticated attacker can send an IMAP ID command with a very large number of parameters before logging in, which causes memory and CPU usage to grow disproportionately. The login process can be terminated by the out-of-memory handling, which also terminates all other connections handled by the same process. This can cause degradation or denial of service for IMAP logins. Limit the number of connections handled by a single imap-login process. This has a performance impact though. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-73208 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 7.4 High |
| An attacker that holds a token intended for a different purpose can authenticate, because when an OAuth2 token response does not contain a scope claim, the audience claim is used in its place and checked against the configured required scopes. These are different concepts, and the audience claim does not describe what a token is allowed to do. A token that grants no relevant permissions can be accepted because its intended recipient value happens to match a configured scope name, granting access that should have been denied. It also hides an identity provider misconfiguration where scopes are not being issued at all. Ensure the identity provider issues a scope claim for all tokens used with Dovecot, and that configured scope names do not match audience values. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-14307 | 2 Geotargetingwp Project, Wordpress | 2 Geotargetingwp, Wordpress | 2026-09-01 | 7.1 High |
| The geotargetingwp WordPress plugin before 3.5.6.2 does not sanitise or escape several parameters before reflecting them back in AJAX responses that are served with an HTML content type, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim is tricked into submitting a crafted request. | ||||
| CVE-2026-81765 | 2 Tailored Media, Wordpress | 2 Tailored Tools, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. | ||||
| CVE-2026-72642 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | 8.8 High |
| The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with the privileges required to upload and deploy a trained model can craft a model that reads and writes memory outside the intended allocation. The result is heap corruption that crashes the inference process, and, with sufficient control over the heap layout, could allow arbitrary code execution in the context of that process. | ||||