Export limit exceeded: 373150 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373150 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16793 | 1 Lenovo | 1 Xclarity Orchestrator | 2026-08-04 | 8.8 High |
| An improper neutralization of special elements used in an operating system command vulnerability was reported in Lenovo XClarity Orchestrator (LXCO) 2.2.0 that could allow an authenticated attacker to execute arbitrary operating system commands as a privileged user under a specific circumstance. | ||||
| CVE-2026-16792 | 1 Lenovo | 1 Xclarity Orchestrator | 2026-08-04 | 6.1 Medium |
| An improper certificate validation vulnerability was reported in multiple Lenovo XClarity Orchestrator (LXCO) 2.2.0 microservices that could allow an adjacent network attacker to intercept sensitive communications by performing a machine-in-the-middle attack against HTTPS connections during TLS certificate validation under certain circumstances. | ||||
| CVE-2026-16791 | 1 Lenovo | 1 Xclarity Essentials Onecli | 2026-08-04 | 3.9 Low |
| A temporary file creation vulnerability in the Linux version of Lenovo XClarity Essentials OneCLI 5.5.0 and below could allow a local low-privileged attacker to overwrite or truncate arbitrary local files with program-generated data when OneCLI is executed with elevated privileges. | ||||
| CVE-2026-18718 | 2026-08-04 | 7 High | ||
| Ghidra contains an arbitrary code execution vulnerability in the Swift demangler analyzer that allows an attacker to execute arbitrary binaries by supplying a malicious Ghidra project with a crafted Swift tool directory path. When a victim opens the attacker-supplied project, SwiftDemanglerAnalyzer restores the persisted Swift binary directory from project state and SwiftNativeDemangler executes the resolved binary without integrity or signature verification, causing attacker-controlled executables to run under the Ghidra process user with no prompt or confirmation. | ||||
| CVE-2026-48154 | 2026-08-04 | 5.9 Medium | ||
| GoRest is a Golang starter kit built with the Gin framework for prototyping and developing RESTful APIs. In versions prior to 1.12.2 nMemorySecret2FA contains a race condition due to an unsynchronized package-level map used to store 2FA secrets. Multiple HTTP handlers in handler/login.go and handler/twoFA.go read from and write to this map concurrently, and because Go's runtime treats unsynchronized concurrent map access as an unrecoverable fatal error, an attacker can repeatedly trigger this condition to crash the process on demand. This results in high, repeatable availability impact with no confidentiality or integrity consequences. This issue has been fixed in version 1.12.2. | ||||
| CVE-2026-58067 | 1 Veeam | 1 Service Provider Console | 2026-08-04 | N/A |
| A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to exhaust host memory and cause adenial of service. | ||||
| CVE-2026-64634 | 1 Veeam | 1 One | 2026-08-04 | N/A |
| A vulnerability allowing local privilege escalation to the Reporter service context. | ||||
| CVE-2026-58075 | 1 Veeam | 1 One | 2026-08-04 | N/A |
| A vulnerability allowing an unauthenticated attacker to read arbitrary files from the host, which can be further leveraged toescalate privileges locally. | ||||
| CVE-2026-64631 | 1 Veeam | 1 One | 2026-08-04 | N/A |
| A vulnerability allowing a low-privileged user to inject SQL and extract database contents. | ||||
| CVE-2026-58073 | 1 Veeam | 1 Service Provider Console | 2026-08-04 | N/A |
| A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to impersonate a managed agent andobtain that agent's credentials. | ||||
| CVE-2026-64630 | 1 Veeam | 1 One | 2026-08-04 | N/A |
| A vulnerability allowing a low-privileged user to retrieve report data outside the scope of a shared report link. | ||||
| CVE-2026-47620 | 2026-08-04 | 6.5 Medium | ||
| NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause a race condition in the LoRA manager singleton initialization. A successful exploit of this vulnerability might lead to data tampering and denial of service. | ||||
| CVE-2026-16566 | 1 Jenkins | 1 Credentials | 2026-08-04 | 6.1 Medium |
| A flaw was found in the community.general Ansible collection's jenkins_credential module. When creating a Jenkins API token (credential_type: token), the module correctly protects the input password with no_log=True in the argument specification, but places the generated API token returned by the Jenkins API directly into the Ansible task result dictionary without output suppression. The token is emitted in plaintext via exit_json(), causing it to appear in Ansible task output, AWX/Tower/AAP Controller job logs, callback plugin output, CI/CD pipeline logs, and fact caching backends. An attacker with access to any of these output channels can obtain the Jenkins API token and gain the same privileges as the user who created it. | ||||
| CVE-2026-67978 | 1 Nasa | 1 Cfs | 2026-08-04 | 7.5 High |
| An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame. | ||||
| CVE-2026-18657 | 1 Amazon | 1 Kiro Cli | 2026-08-04 | 7.8 High |
| An uncontrolled search path element in Kiro CLI before version 2.10.0 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user starts Kiro CLI in the directory. To remediate this issue, users should upgrade to version 2.10.0 or higher. | ||||
| CVE-2026-14920 | 2 Acymailing, Wordpress | 2 Acymailing, Wordpress | 2026-08-04 | 8.2 High |
| ## Summary | ||||
| CVE-2026-18656 | 1 Amazon | 1 Kiro Ide | 2026-08-04 | 7.8 High |
| An uncontrolled search path element in Kiro IDE before version 1.0.228 on Windows might allow a remote unauthenticated actor to execute arbitrary code via a maliciously crafted project directory containing an executable that bypasses workspace trust protections when a local user opens the directory. To remediate this issue, users should upgrade to version 1.0.228 or higher. | ||||
| CVE-2026-18654 | 1 Aws | 1 Aws-cli | 2026-08-04 | 6.8 Medium |
| Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later. | ||||
| CVE-2026-18733 | 1 Aws | 2 Strands-agents-tools, Strands Agents Tools | 2026-08-04 | 8.8 High |
| A prompt injection vulnerability in the shell tool in Amazon Strands Agents Tools before 0.8.0 might allow remote actors to execute arbitrary operating system commands on the agent's host via a crafted prompt that sets the non_interactive parameter to true, bypassing the human consent gate. To remediate this issue, users should upgrade to version 0.8.0. | ||||
| CVE-2026-69703 | 2026-08-04 | 9.8 Critical | ||
| Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state. | ||||