Export limit exceeded: 355932 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (355932 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-6858 | 1 Arista | 1 Eos | 2026-06-05 | N/A |
| In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. | ||||
| CVE-2024-27891 | 1 Arista | 1 Eos | 2026-06-05 | 5.3 Medium |
| On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. This can cause outgoing packets to incorrectly be allowed or denied. | ||||
| CVE-2024-27890 | 1 Arista | 1 Eos | 2026-06-05 | 9.6 Critical |
| Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch. | ||||
| CVE-2024-27892 | 1 Arista | 1 Eos | 2026-06-05 | 9.6 Critical |
| Affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected. This can result in unexpected configuration being applied to the switch. | ||||
| CVE-2023-5502 | 1 Arista | 1 Eos | 2026-06-05 | 5.9 Medium |
| On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, and routing enabled on the access VLAN of the ports, a malicious supplicant may be able to bypass the requirement to perform 802.1x authentication. | ||||
| CVE-2025-8873 | 1 Arista | 1 Eos | 2026-06-05 | 7.5 High |
| On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The control plane may detect this condition, and attempt to reset the IPsec processing pipeline. After reset traffic may not resume being processed. There is no impact to non-IPsec traffic or to IPsec traffic not originating or terminating on the system. This issue was reported by an Arista customer. | ||||
| CVE-2026-50590 | 1 Mimecast | 1 Incydr | 2026-06-05 | 4.5 Medium |
| In Mimecast Incydr before 2.6.0, arbitrary file access can occur. | ||||
| CVE-2026-10732 | 1 Kevva | 1 Decompress | 2026-06-05 | 6.4 Medium |
| All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same path - the first being a symlink to an arbitrary target and the second being a regular file - the file content is written through the symlink to the target location outside the output directory. This is due to the microtask processing order that checks readlink for the second file before resolving symlink for the first file. An attacker can write arbitrary file on the host filesystem potentially leading to remote code execution by providing a specially crafted ZIP archive. **Note:** This bypasses all existing path traversal protections including preventWritingThroughSymlink, added as a part of the fix for [CVE-2020-12265](https://security.snyk.io/vuln/SNYK-JS-DECOMPRESS-557358). | ||||
| CVE-2026-21826 | 1 Hcltech | 2 Digital Experience, Dx Compose | 2026-06-05 | 6.1 Medium |
| HCL Digital Experience and HCL Digital Experience Compose could be susceptible to Host header injection. An attacker can manipulate the Host header and cause the application to behave in unexpected ways. | ||||
| CVE-2026-21825 | 1 Hcltech | 1 Dx Compose | 2026-06-05 | 6.1 Medium |
| HCL Digital Experience Compose is affected by a reflected cross-site scripting (XSS) vulnerability in the search center. An attacker could execute arbitrary JavaScript in the victim's browser. | ||||
| CVE-2026-48907 | 1 Joomlacontenteditor.net | 1 Joomla Content Editor (jce) Extension For Joomla | 2026-06-05 | N/A |
| A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in PHP code upload and execution. | ||||
| CVE-2026-8914 | 2026-06-05 | N/A | ||
| In Teltonika Networks RUTOS devices, running versions 7.22 through 7.23.2 and TSWOS devices running versions 1.09 through 1.09.1, due to unsafe calls to an eval function in rpc-profile, a vulnerability exists where a lower privileged user could perform command injection as the root user. | ||||
| CVE-2025-59610 | 1 Qualcomm | 473 5g Fixed Wireless Access Platform, 5g Fixed Wireless Access Platform Firmware, C-v2x 9150 and 470 more | 2026-06-05 | 6.4 Medium |
| Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer. | ||||
| CVE-2026-6274 | 2026-06-05 | 9.8 Critical | ||
| Improper Authentication, Missing authentication for critical function, Weak Authentication vulnerability in DTS Electronics Industry and Trade Ltd. Co. Redline WR3200 allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Redline WR3200: from 7.1.3 before 7.1.8. | ||||
| CVE-2026-49777 | 2026-06-05 | 10 Critical | ||
| Improper Validation of Specified Quantity in Input vulnerability in ShapedPlugin, LLC Product Slider Pro for WooCommerce allows Malicious Software Implanted. This issue affects Product Slider Pro for WooCommerce: from n/a before 3.5.3. No patched version is available - the vendor has applied a fix to an existing release without publishing a new version. While the patch provided by the vendor is valid, releasing it under the existing version number leaves users unable to reliably determine whether they are running a patched or vulnerable installation. As a result, we treat this as an unpatched version. | ||||
| CVE-2025-10439 | 1 Yordam | 1 Library Automation System | 2026-06-05 | 9.8 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yordam Informatics Yordam Library Automation System allows SQL Injection. This issue affects Yordam Library Automation System: from 21.5 & 21.6 before 21.7. | ||||
| CVE-2025-10449 | 2026-06-05 | 8.6 High | ||
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Saysis Computer Systems Trade Ltd. Co. Saysis Web Portal allows Path Traversal. This issue affects Saysis Web Portal: from 3.1.9 & 3.2.0 before 3.2.1. | ||||
| CVE-2026-10990 | 1 Google | 1 Chrome | 2026-06-05 | N/A |
| Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2025-10463 | 1 Birtech Information Technologies Industry And Trade | 1 Senseway | 2026-06-05 | 7.3 High |
| Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology. | ||||
| CVE-2025-10464 | 1 Birtech Information Technologies Industry And Trade | 1 Senseway | 2026-06-05 | 6.5 Medium |
| Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the manufacturer is unable to fix the relevant vulnerabilities. Users of the Sensaway application are advised to contact the manufacturer and review updated products developed with newer technology. | ||||