Export limit exceeded: 385086 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385086 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81707 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 9.8 Critical |
| openssl_encrypt before 1.4.9 fails to sanitize the email field of imported identity documents, allowing attackers to inject ANSI escape sequences that forge the fingerprint verification line displayed to users. Attackers can deliver a crafted identity bundle through normal contact-exchange flows or keyserver responses to manipulate terminal output and display a fraudulent fingerprint, bypassing the out-of-band verification mechanism that protects against key substitution attacks. | ||||
| CVE-2026-38347 | 1 Ffmpeg | 1 Ffmpeg | 2026-08-31 | 7.5 High |
| A heap overflow in the ff_sws_alphablendaway function (libswscale/alphablend.c) of FFmpeg git-master commit 722a217 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-38344 | 1 Ffmpeg | 1 Ffmpeg | 2026-08-31 | 7.5 High |
| A NULL pointer dereference in the get_min_buffer_size function (/libswscale/slice.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file. | ||||
| CVE-2026-79232 | 1 Google | 1 Chrome | 2026-08-31 | 9.6 Critical |
| Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-79235 | 1 Google | 1 Chrome | 2026-08-31 | 9.6 Critical |
| Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-75465 | 2026-08-31 | 7.5 High | ||
| The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue. The interface fails to perform any authentication or authorization checks. An unauthenticated remote attacker can send a crafted HTTP GET request with limit and offset parameters to paginate and retrieve sensitive information of all registered users. | ||||
| CVE-2026-51695 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-79240 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-08-31 | 8.8 High |
| Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-79244 | 1 Google | 1 Chrome | 2026-08-31 | 8.8 High |
| Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-79245 | 1 Google | 1 Chrome | 2026-08-31 | 7.7 High |
| Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-79257 | 1 Google | 1 Chrome | 2026-08-31 | 9.6 Critical |
| Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-79263 | 1 Google | 1 Chrome | 2026-08-31 | 8.1 High |
| Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Low) | ||||
| CVE-2026-79266 | 1 Google | 1 Chrome | 2026-08-31 | 8.8 High |
| Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-79275 | 1 Google | 1 Chrome | 2026-08-31 | 9.6 Critical |
| Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-59307 | 2 Spring, Vmware | 2 Spring Integration, Spring Integration | 2026-08-31 | 8 High |
| An operator who calls JdbcMessageStore.addAllowedPatterns(...) to restrict deserialization receives no protection at all when the store is a Spring-managed bean. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 | ||||
| CVE-2026-61306 | 1 Oracle | 2 Complex Maintenance Repair And Overhaul, Complex Maintenance Repair And Overhaul | 2026-08-31 | 7.1 High |
| Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Complex Maintenance, Repair and Overhaul. While the vulnerability is in Oracle Complex Maintenance, Repair and Overhaul, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Complex Maintenance, Repair and Overhaul accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Complex Maintenance, Repair and Overhaul. CVSS 3.1 Base Score 7.1 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:L). | ||||
| CVE-2019-25029 | 1 Versa-networks | 1 Versa Director | 2026-08-31 | 9.8 Critical |
| In Versa Director, the command injection is an attack in which the goal is execution of arbitrary commands on the host operating system via a vulnerable application. Command injection attacks are possible when an application passes unsafe user supplied data (forms, cookies, HTTP headers etc.) to a system shell. In this attack, the attacker-supplied operating system commands are usually executed with the privileges of the vulnerable application. Command injection attacks are possible largely due to insufficient input validation. | ||||
| CVE-2026-59650 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 4 Bc-java, Bouncy Castle For Java Lts, Bc-java and 1 more | 2026-08-31 | 9.1 Critical |
| In Bouncy Castle for Java before 1.85, MTI/A0 DH agreement exponentiates unvalidated peer value. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | ||||
| CVE-2026-59644 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 2 Bc-java, Bc-java | 2026-08-31 | 7.5 High |
| In Bouncy Castle for Java before 1.85, MLS hash-ratchet honours arbitrary 32-bit generation counter from sender. | ||||
| CVE-2026-59311 | 2 Spring, Vmware | 2 Spring Integration, Spring Integration | 2026-08-31 | 6.8 Medium |
| A local unprivileged user on the same host can redirect all Zip/UnZip transformer output into a directory of their choosing by pre-creating /tmp/ziptransformer as a symlink before the application starts. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring Integration 6.4.0 - 6.4.12 | ||||