Export limit exceeded: 381577 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (381577 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-73893 | 1 Oracle | 1 Helidon | 2026-08-21 | 6.5 Medium |
| Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). | ||||
| CVE-2026-49427 | 1 Freebsd | 1 Freebsd | 2026-08-21 | 8.8 High |
| Pages belonging to largepage shared memory objects were not explicitly wired. When sendfile(2) transmitted such an object with the SF_NOCACHE flag, it freed the underlying pages after transmission even though existing mappings still referred to them. An unprivileged local user can abuse the bug to access freed kernel memory. This can be exploited to escalate privileges. | ||||
| CVE-2026-54505 | 1 Mauriceboe | 1 Trek | 2026-08-21 | N/A |
| TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in client/src/pages/JourneyPage.tsx. A trip owner can store HTML in a qualifying trip title, and GET /api/journeys/suggestions returns that title through getSuggestions(userId) to a collaborator who opens the authenticated Journey page. The markup is inserted as live DOM in the collaborator's session, enabling content spoofing and UI redress, although the default Content Security Policy blocks inline handlers and script execution. This issue is fixed in version 3.1.0. | ||||
| CVE-2026-52021 | 2026-08-21 | N/A | ||
| An issue in code100xDevs 100xdevs CMS v.1.0 (2026-04-30) allows a remote attacker to obtain sensitive information via the src/middleware.ts, and src/app/api/mobile/search/route.ts components. | ||||
| CVE-2026-64777 | 1 Apple | 1 Container | 2026-08-21 | 4.3 Medium |
| A malicious builder peer may be able to request an in-context file by name from the host and receive the contents of whatever the name resolves to, even when it resolves outside the build context. This vulnerability is addressed in container version 1.2.0. | ||||
| CVE-2026-77506 | 1 Znuny | 1 Znuny | 2026-08-21 | 4.8 Medium |
| Znuny before LTS 6.5.22 allows AgentTicketEmailResend template XSS. | ||||
| CVE-2026-77584 | 1 Torproject | 1 Tor | 2026-08-21 | 7 High |
| Tor before 0.4.9.10 did not reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. This is TROVE-2026-025. | ||||
| CVE-2026-77587 | 1 Torproject | 1 Tor | 2026-08-21 | 5.9 Medium |
| Tor before 0.4.9.11 is prone to a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit node could use this to crash a client. This is TROVE-2026-026. | ||||
| CVE-2026-77638 | 1 Torproject | 1 Tor | 2026-08-21 | 8.9 High |
| Tor before 0.4.9.11 is prone to a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach. | ||||
| CVE-2026-77641 | 1 Torproject | 1 Tor | 2026-08-21 | 6.5 Medium |
| tor before 0.4.9.9 was prone to a NULL write after free when sending a CONFLUX_SWITCH cell fails. The return value of relay_send_command_from_edge() was ignored, so a send failure (which calls circuit_mark_for_close() and removes the leg via cfx_del_leg()) would go undetected, causing the caller to write to the now-freed current leg and resulting in a crash. This is TROVE-2026-017. | ||||
| CVE-2026-77639 | 1 Torproject | 1 Tor | 2026-08-21 | 5.3 Medium |
| Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many gzip or zlib sub-streams, each just under the per-stream detection threshold, to avoid the compression bomb check entirely. This is TROVE-2026-022. | ||||
| CVE-2026-77640 | 1 Torproject | 1 Tor | 2026-08-21 | 3.7 Low |
| tor before 0.4.9.9 was prone to an infinite loop when decompressing a truncated zlib/gzip stream with done=1. A truncated stream never reaches Z_STREAM_END, causing zlib to return Z_BUF_ERROR with no input remaining, which buf_add_compress() mistook for a full output buffer and retried forever. Fixed by returning TOR_COMPRESS_ERROR in that case so the caller can abort cleanly. This is TROVE-2026-021. | ||||
| CVE-2026-77642 | 1 Torproject | 1 Tor | 2026-08-21 | 7.5 High |
| tor before 0.4.9.9 was prone to an out-of-bounds write when parsing a consensus or detached signature with unexpected signature digest type. Impact is minor for most Tor roles, but potentially major for directory authorities. This is TROVE-2026-019. | ||||
| CVE-2026-64773 | 1 Apple | 1 Container | 2026-08-21 | N/A |
| An attacker that can reach a container's published TCP port may be able to force the host's forwarding process to buffer an unbounded amount of that client's data in memory, for as long as the backend container connection takes to complete — with no cap on how much accumulates or how long the wait can be stretched. This vulnerability is addressed in container version 1.2.0. | ||||
| CVE-2026-77643 | 1 Xapian | 1 Xapian-core | 2026-08-21 | 4.4 Medium |
| A cross-site scripting vulnerability in queryparser/termgenerator_internal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet(). NOTE: this issue exists because of a missed corner case of CVE-2018-0499. | ||||
| CVE-2026-54389 | 1 Nationalsecurityagency | 1 Ghidra | 2026-08-21 | 5.5 Medium |
| Ghidra before 12.1.3 contains an uncontrolled resource consumption vulnerability in the PDB parser that allows attackers to terminate the Ghidra process by supplying a crafted PDB file with an oversized parameters section. The AbstractPdb deserialization routine reads all remaining parameters into an unbounded list, causing uncontrolled heap growth that triggers an OutOfMemoryError which bypasses exception handling and crashes the application. | ||||
| CVE-2026-77646 | 1 Ptc | 2 Flexplm, Windchill Pdmlink | 2026-08-21 | N/A |
| A Server-Side Request Forgery (SSRF) vulnerability has been reported in PTC Windchill PDMLink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | ||||
| CVE-2026-54508 | 1 Mauriceboe | 1 Trek | 2026-08-21 | N/A |
| TREK is a collaborative travel planner. Prior to 3.1.0, TREK validates only the initial URL before native redirect following in importGoogleList() and importNaverList() in server/src/services/placeService.ts and resolveGoogleMapsUrl() in server/src/services/mapsService.ts. The affected sinks call checkSsrf() from server/src/utils/ssrfGuard.ts and then use fetch() with redirect: 'follow' instead of the DNS-pinned safeFetch() path, so a public attacker-controlled URL can redirect the server to loopback, RFC 1918, or cloud metadata addresses without revalidation. An authenticated trip member can reach the list-import routes, and any authenticated user can reach /api/maps/resolve-url, allowing blind GET requests to internal services without response-body reflection. This issue is fixed in version 3.1.0. | ||||
| CVE-2026-20672 | 1 Apple | 1 Macos | 2026-08-21 | 5.5 Medium |
| An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.3. An app may be able to access sensitive user data. | ||||
| CVE-2026-28995 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-08-21 | 8.8 High |
| A logic issue was addressed with improved restrictions. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. A malicious app may be able to break out of its sandbox. | ||||