Export limit exceeded: 369876 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369876 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59540 | 2026-07-23 | 9.8 Critical | ||
| Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 3.9.6 versions. | ||||
| CVE-2026-57717 | 2026-07-23 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. | ||||
| CVE-2026-57699 | 2026-07-23 | 7.1 High | ||
| Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions. | ||||
| CVE-2026-27422 | 2026-07-23 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions. | ||||
| CVE-2026-27399 | 2026-07-23 | 5.3 Medium | ||
| Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions. | ||||
| CVE-2026-27372 | 2026-07-23 | 6.5 Medium | ||
| Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. | ||||
| CVE-2026-25405 | 2026-07-23 | 8.5 High | ||
| Contributor SQL Injection in eRoom <= 1.7.1 versions. | ||||
| CVE-2026-24628 | 2026-07-23 | 5.9 Medium | ||
| Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. | ||||
| CVE-2025-68081 | 2026-07-23 | 5.9 Medium | ||
| Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions. | ||||
| CVE-2026-47708 | 1 Sepinetam | 1 Stata-mcp | 2026-07-23 | N/A |
| MCP-for-Stata is an MCP server for Stata to integrate Stata into an agent. Prior to version 1.17.3, the `log_file_name` parameter in the `stata_do` API and CLI is directly interpolated into a Stata command string without sanitization. The security guard (`GuardValidator`) only scans the do-file content but does not validate this parameter. An attacker can inject arbitrary Stata commands (including `shell`, `python`, `erase`, etc.) by crafting a malicious `log_file_name` containing quotes, newlines, or Stata command separators. Version 1.17.3 contains a patch for the issue. | ||||
| CVE-2026-13321 | 1 Isc | 1 Bind | 2026-07-23 | 8.6 High |
| The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.24, 9.21.0 through 9.21.23, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.24-S1. | ||||
| CVE-2026-64611 | 1 Redhat | 1 Enterprise Linux | 2026-07-23 | 7.5 High |
| A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exploit this by broadcasting a specially crafted printer advertisement, leading to denial of service. | ||||
| CVE-2026-15110 | 1 Google | 1 Chrome | 2026-07-23 | 8.8 High |
| Use after free in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) | ||||
| CVE-2026-15119 | 1 Google | 1 Chrome | 2026-07-23 | 8.3 High |
| Race in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-15120 | 1 Google | 1 Chrome | 2026-07-23 | 8.3 High |
| Use after free in Core in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-15121 | 1 Google | 1 Chrome | 2026-07-23 | 8.8 High |
| Use after free in WebRTC in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-15107 | 1 Google | 1 Chrome | 2026-07-23 | 8.8 High |
| Use after free in IndexedDB in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-51923 | 1 Docuform | 1 Client | 2026-07-23 | 8.1 High |
| An Insecure Direct Object Reference (IDOR) vulnerability exists in docuForm GmbH Client v.11.11c allowing a remote attacker to execute arbitrary code via the user settings component, and modify or retrieve sensitive data associated with other users’ accounts. | ||||
| CVE-2026-51925 | 1 Docuform | 1 Client | 2026-07-23 | 8.1 High |
| A Local File Inclusion (LFI) vulnerability exists in docuForm GmbH Client v.11.11c that allows a remote attacker to execute arbitrary code via the dfm-menu_report.php component. Attackers can exploit this flaw to read arbitrary files on the server, including sensitive configuration files, source code or system files. | ||||
| CVE-2026-64881 | 1 Tenable | 1 Security Center | 2026-07-23 | 8.8 High |
| The audit file upload handler does not sanitize filenames, allowing shell metacharacters to flow into system command execution. This input validation failure enables command injection when chained with a related vulnerability. | ||||