Export limit exceeded: 374441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 374441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 374441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 374441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 374441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 374441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 374441 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (374441 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58040 | 2 Nodejs, Redhat | 2 Nodejs, Hummingbird | 2026-08-03 | 6.3 Medium |
| An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | ||||
| CVE-2026-64635 | 1 Veeam | 1 Service Provider Console | 2026-08-03 | 5.3 Medium |
| Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attacker to control the domain of the generated password reset link. When the targeted user clicks the link delivered by email, the reset code is transmitted to an attacker-controlled host, allowing the attacker to take over the account. | ||||
| CVE-2026-56847 | 1 Nodejs | 1 Nodejs | 2026-08-03 | N/A |
| A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | ||||
| CVE-2026-44092 | 2 Phoenix Contact, Phoenixcontact | 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more | 2026-08-03 | 9.1 Critical |
| An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss. | ||||
| CVE-2026-69075 | 1 Flowintel | 1 Flowintel | 2026-08-03 | N/A |
| FlowIntel is affected by a stored cross-site scripting vulnerability through multiple user-controlled or administrator-controlled fields. Persisted values—including case titles, ticket identifiers, recurring-case information, user profile attributes, organisation names, and role names—were rendered inside DOM elements subsequently compiled by Vue. Although normal HTML escaping could neutralize direct HTML markup, it did not prevent an attacker from injecting Vue interpolation expressions using the configured [[ ... ]] delimiters. An authenticated attacker able to modify one of the affected fields could store a malicious Vue expression. When another user viewed an affected case, report, profile, recurring-case page, or navigation component, Vue could evaluate the injected expression in the context of the FlowIntel application. Successful exploitation could allow arbitrary JavaScript execution in the victim’s browser under the FlowIntel origin. This could expose information available to the victim, perform actions using the victim’s authenticated session, or modify application data within the victim’s privileges. The patch introduces a dedicated vue_escape filter that escapes HTML-sensitive characters and breaks Vue interpolation delimiters before the values are rendered. The filter is applied to the affected case, account, organisation, role, configuration, and navigation fields. | ||||
| CVE-2026-18353 | 1 Eclipse | 1 Eclipse Pia | 2026-08-03 | 8.2 High |
| PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme. | ||||
| CVE-2022-4994 | 1 Linux | 1 Linux Kernel | 2026-08-03 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulator_pio_in Use __emulator_pio_in() directly for fast PIO instead of bouncing through emulator_pio_in() now that __emulator_pio_in() fills "val" when handling in-kernel PIO. vcpu->arch.pio.count is guaranteed to be '0', so this a pure nop. emulator_pio_in_emulated is now the last caller of emulator_pio_in. No functional change intended. | ||||
| CVE-2026-18363 | 1 Enhancesoft | 1 Osticket | 2026-08-03 | 9.1 Critical |
| A logic vulnerability in the password reset token validation routine implemented by osTicket in versions prior to v1.17.8 and v1.18.4. During the password reset process, the application retrieves the timestamp associated with the provided token and checks whether the configured validity period has expired. Consequently, the expiry check is only performed if the timestamp lookup fails, allowing tokens with an existing timestamp to bypass the intended expiry validation. Therefore, an attacker able to obtain a valid password reset token could reuse it to perform an unauthorised password reset and compromise the affected account. | ||||
| CVE-2026-17543 | 1 Php Group | 1 Php | 2026-08-03 | 7.4 High |
| Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. | ||||
| CVE-2026-7260 | 1 Php Group | 1 Php | 2026-08-03 | 5.5 Medium |
| Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9. | ||||
| CVE-2026-13379 | 1 Openvpn | 1 Openvpn | 2026-08-03 | N/A |
| The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process | ||||
| CVE-2026-67822 | 1 Tenda | 1 W6 S | 2026-08-03 | 9.8 Critical |
| Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow. | ||||
| CVE-2026-58039 | 2 Nodejs, Redhat | 2 Nodejs, Hummingbird | 2026-08-03 | 4.4 Medium |
| A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | ||||
| CVE-2026-18593 | 1 Vxcontrol | 1 Pentagi | 2026-08-03 | 5.6 Medium |
| A weakness has been identified in vxcontrol PentAGI up to 2.1.0. This affects an unknown part of the file backend/pkg/templates/prompts/pentester.tmpl of the component Tool Management Protocol Handler. Executing a manipulation can lead to sandbox issue. It is possible to launch the attack remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-14317 | 2 Givewp, Wordpress | 2 Givewp, Wordpress | 2026-08-03 | 5.3 Medium |
| The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations through a payment gateway the administrator has disabled. | ||||
| CVE-2026-14333 | 2026-08-03 | 7.5 High | ||
| The Demi WordPress plugin before 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection, allowing unauthenticated attackers to download complete backups including the site database and its user password hashes. | ||||
| CVE-2026-14927 | 2026-08-03 | 3.7 Low | ||
| The FluentCart A New Era of eCommerce WordPress plugin before 1.5.3 does not perform any authorization or ownership check before rendering customer order documents keyed on a sequential numeric identifier, allowing unauthenticated visitors to enumerate and disclose customer personal data (names, email addresses, billing and shipping postal addresses, and order details) across the store. | ||||
| CVE-2026-14928 | 2026-08-03 | 6.5 Medium | ||
| The JS Help Desk WordPress plugin before 3.1.4 does not perform authorization or ownership checks before returning support-ticket content in a nonce-gated search handler, allowing any authenticated user (Subscriber and above) to read the subject and full message body of every other user's support tickets. | ||||
| CVE-2026-14929 | 2026-08-03 | 4.3 Medium | ||
| The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user (Subscriber and above) to overwrite the content of any support-ticket reply on the site. | ||||
| CVE-2026-12251 | 2 Ultimatemember, Wordpress | 2 Ultimate Member, Wordpress | 2026-08-03 | 8.1 High |
| The Ultimate Member WordPress plugin before 2.12.1 does not filter administrator-level capabilities from the roles it makes selectable on its registration forms, and its post-registration safeguard against elevated accounts is disabled by default, allowing unauthenticated users to register with a site-defined role that carries administrator capabilities and gain administrative access, when such a role exists and a role-selection field is present on a published registration form. | ||||