Export limit exceeded: 394986 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (394986 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92583 | 1 Wwbn | 1 Avideo | 2026-09-17 | 6.5 Medium |
| AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, allowing attackers to bypass all rate limits including login brute-force protection by issuing concurrent requests. Attackers can submit parallel credential attempts to exceed the documented 30-attempts-per-5-minutes login limit by an arbitrary factor determined only by their connection concurrency. | ||||
| CVE-2026-92581 | 1 Wwbn | 1 Avideo | 2026-09-17 | 4.3 Medium |
| In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parameters to desynchronize stored votes from counters. Authenticated attackers can send array-typed like parameters followed by ordinary requests to drive video like counts arbitrarily negative, with the corruption persisting in the denormalized counter until manual repair. | ||||
| CVE-2026-92578 | 1 Wwbn | 1 Avideo | 2026-09-17 | 8.1 High |
| WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credential through two independent code paths in loginFromRequest() and encryptPasswordVerify(). Attackers who obtain the stored users.password hash value can authenticate as any user by submitting the hash directly to login endpoints, completely bypassing password verification. | ||||
| CVE-2026-91996 | 2 Dromara, Tangyh | 2 Lamp-cloud, Lamp-cloud | 2026-09-17 | 7.5 High |
| lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets. | ||||
| CVE-2026-91962 | 1 Freerdp | 1 Freerdp | 2026-09-17 | 6.3 Medium |
| FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer allocation and potential out-of-bounds access. | ||||
| CVE-2026-91957 | 1 Freerdp | 1 Freerdp | 2026-09-17 | 3.1 Low |
| FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution. | ||||
| CVE-2026-91936 | 1 Flowiseai | 1 Flowise | 2026-09-17 | 6.8 Medium |
| Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are directly interpolated into shell run blocks. Attackers with repository write access can inject shell metacharacters through inputs like tag_version and node_version to execute arbitrary commands and steal AWS credentials and Docker Hub tokens. | ||||
| CVE-2026-91931 | 1 Flowiseai | 1 Flowise | 2026-09-17 | 8.5 High |
| Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server. | ||||
| CVE-2026-91926 | 1 Redhat | 1 Enterprise Linux | 2026-09-17 | 3.7 Low |
| A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service. | ||||
| CVE-2026-87116 | 2026-09-17 | 6.5 Medium | ||
| Tanium addressed a server-side request forgery vulnerability in Threat Response. | ||||
| CVE-2026-86892 | 1 Apple | 2 Ios And Ipados, Visionos | 2026-09-17 | 5.5 Medium |
| This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to cause a denial-of-service. | ||||
| CVE-2026-86891 | 1 Apple | 2 Macos, Watchos | 2026-09-17 | 3.5 Low |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, watchOS 27. An app may be able to access Bluetooth device information. | ||||
| CVE-2026-86887 | 1 Apple | 2 Ios And Ipados, Visionos | 2026-09-17 | 3.3 Low |
| A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be able to bypass certain Privacy preferences. | ||||
| CVE-2026-86884 | 1 Apple | 4 Ios And Ipados, Macos, Tvos and 1 more | 2026-09-17 | 5.5 Medium |
| A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, watchOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-84615 | 1 Apple | 3 Ios And Ipados, Tvos, Visionos | 2026-09-17 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, tvOS 27, visionOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-84600 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-17 | 5.4 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. A malicious shortcut may be able to send messages without user confirmation. | ||||
| CVE-2026-84580 | 1 Apple | 1 Macos | 2026-09-17 | 8.4 High |
| The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break out of its sandbox. | ||||
| CVE-2026-84556 | 1 Apple | 1 Macos | 2026-09-17 | 5.5 Medium |
| An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access sensitive user data. | ||||
| CVE-2026-84514 | 1 Apple | 1 Macos | 2026-09-17 | 5.5 Medium |
| This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system. | ||||
| CVE-2026-84513 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-17 | 5.5 Medium |
| A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. A malicious application may be able to determine a user's current location. | ||||