Export limit exceeded: 386167 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 386167 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386167 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64201 | 1 Ni | 1 Labview | 2026-09-03 | 7.8 High |
| There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions. | ||||
| CVE-2026-8619 | 1 Tp-link | 8 Archer Mr600, Archer Mr600 Firmware, Tl-mr100 and 5 more | 2026-09-03 | 7.5 High |
| An unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable. | ||||
| CVE-2026-71573 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 8.3 High |
| Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests. | ||||
| CVE-2026-76220 | 1 Gitpython Project | 1 Gitpython | 2026-09-03 | 8.8 High |
| GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clone_from to emit a joined token parsed as --upload-pack, enabling arbitrary OS command execution at default allow_unsafe_options=False. | ||||
| CVE-2026-76219 | 1 Gitpython Project | 1 Gitpython | 2026-09-03 | 8.1 High |
| GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the --index-output option to overwrite arbitrary files with a valid git-index blob, destroying existing file content at attacker-controlled writable paths. | ||||
| CVE-2026-72531 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 5.4 Medium |
| Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components. | ||||
| CVE-2026-76218 | 2 Gitpython-developers, Gitpython Project | 2 Gitpython, Gitpython | 2026-09-03 | 7.5 High |
| GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the initialized repository. | ||||
| CVE-2026-73336 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 6.4 Medium |
| Joomla! Core - [20260806] - XSS through schema.org outputs in Joomla 5.1.0-5.4.7, 6.0.0-6.1.2 - Improper escaping flags lead to an XSS vector in schema.org markup outputs. | ||||
| CVE-2026-76217 | 1 Gitpython Project | 1 Gitpython | 2026-09-03 | 6.5 Medium |
| GitPython versions before 3.1.58 fail to validate options passed to git rm and git checkout commands in IndexFile.remove() and Head.checkout(). Attackers can supply --pathspec-from-file and --pathspec-file-nul parameters to read arbitrary files accessible to the process, with full file contents returned in GitCommandError.stderr. | ||||
| CVE-2026-73372 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 4.3 Medium |
| Joomla! Core - [20260809] - Improper ACL checks when injection schema.org contact data in Joomla 5.1.0-5.4.7 and 6.0.0-6.1.2 - An improper access check injects contact information for unaccessible contact items into schema.org snippets. | ||||
| CVE-2026-64202 | 1 Ni | 1 Labview | 2026-09-03 | 7.8 High |
| There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions. | ||||
| CVE-2026-73371 | 1 Joomla | 2 Joomla!, Joomla\! | 2026-09-03 | 4.3 Medium |
| Joomla! Core - [20260808] - Improper ACL checks for batch copy actions in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to perform copy batch operations on uneditable items. | ||||
| CVE-2026-64203 | 1 Ni | 1 Labview | 2026-09-03 | 7.8 High |
| There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions. | ||||
| CVE-2026-51684 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the setStorageCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the storage-related service state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51691 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the setUploadSetting function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate the upload or flash workflow via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51733 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the FirmwareUpgrade function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove Wi-Fi schedule entries via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51738 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the LoadDefSettings function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reset the device configuration and reboot the device via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51751 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the delSlaveDevice function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove a specified slave device from local mesh management data and reboot the system via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51763 | 1 Totolink | 1 T6 | 2026-09-03 | 9.8 Critical |
| Incorrect access control in the freeStaClient function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forcibly disconnect wireless clients via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51768 | 1 Totolink | 1 T6 | 2026-09-03 | 7.5 High |
| Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify privileged QoS policy on the master device via sending a crafted MQTT message to the cs_broker component. | ||||