Export limit exceeded: 396991 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 396991 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396991 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96546 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-09-24 | 2.5 Low |
| A one-byte out-of-bounds heap read flaw was found in GIMP's uncompressed DDS image loader. When a user opens an uncompressed DDS image, the file-dds plug-in performs an unconditional one-byte look-ahead after processing the final pixel. This may cause the plug-in to crash if the byte immediately following the pixel buffer is inaccessible; no information disclosure or code execution has been demonstrated. | ||||
| CVE-2026-61814 | 2 Org.typelevel, Typelevel | 4 Jawn-parser 2.12, Jawn-parser 2.13, Jawn-parser 3 and 1 more | 2026-09-24 | 7.5 High |
| Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0. | ||||
| CVE-2026-96872 | 1 Wikimedia | 1 Mediawiki-wikilambda Extension | 2026-09-24 | N/A |
| Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0. | ||||
| CVE-2026-94181 | 1 The Browser Company Of New York | 1 Arc | 2026-09-24 | 7.4 High |
| An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification. | ||||
| CVE-2026-96770 | 1 Temporal Technologies, Inc. | 1 S2s-proxy | 2026-09-24 | N/A |
| All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required. | ||||
| CVE-2026-87900 | 1 Webpros | 1 Wp Toolkit For Cpanel | 2026-09-24 | N/A |
| Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. | ||||
| CVE-2026-68492 | 1 Webpros | 2 Plesk, Plesk Extension "plesk Restful Api" | 2026-09-24 | N/A |
| An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7. | ||||
| CVE-2026-19125 | 2 Lynn999, Wordpress | 2 Ethpress – Web3 Login, Wordpress | 2026-09-24 | 8.1 High |
| The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover. | ||||
| CVE-2026-59980 | 1 Python-hyper | 1 Hpack | 2026-09-24 | 7.5 High |
| hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use. | ||||
| CVE-2026-18467 | 2 Paytiumsupport, Wordpress | 2 Paytium: Mollie Payment Forms & Donations, Wordpress | 2026-09-24 | 9.8 Critical |
| The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on the pt-paytium-user-data field, but left a second filter — pt_cf_checkout_meta(), registered on the pt_meta_values hook after the signed builder — that copies every $_POST['pt_form_field'][*] key verbatim into the payment meta array without any signature verification; this allows the pt-user-role value it copies to overwrite the signed path's output, after which paytium_user_data_processing() reads the persisted _pt-user-role post meta and passes it directly as the role argument to wp_insert_user(). This makes it possible for unauthenticated attackers to register a new WordPress account with the administrator role and fully take over the site. Exploitation requires submitting a payment through a publicly-exposed [paytium] shortcode form and completing the resulting payment flow, after which the attacker can seize the new administrator account via the standard lost-password flow on their supplied email address. | ||||
| CVE-2026-97151 | 1 Mwilliamson | 1 Mammoth.js | 2026-09-24 | N/A |
| mammoth (aka mammoth.js) before 1.12.2 is vulnerable to prototype pollution when reading the styles defined in a document. Converting a crafted .docx file allows an attacker to add arbitrary properties to Object.prototype. In 1.11.0 through 1.12.1, applications that convert further documents in the same process and return the converted HTML can also disclose the contents of local server files (to the party supplying the documents) by setting externalFileAccess to true. | ||||
| CVE-2026-97152 | 1 Nanomsg | 1 Nanomsg | 2026-09-24 | N/A |
| Nanomsg versions 0.5-beta through 1.x before 1.2.3 has a remotely exploitable buffer overflow in the WebSocket transport, due to an unchecked copy of the Sec-WebSocket-Version header, through snprintf. | ||||
| CVE-2026-96898 | 2 Shopxo, Yhx070424 | 2 Shopxo, Shopxo | 2026-09-24 | 7.3 High |
| A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument path_type results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-97155 | 1 Fabasoft | 1 Folio Client | 2026-09-24 | 6.5 Medium |
| Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite. | ||||
| CVE-2026-87898 | 1 Webpros | 1 Plesk Site Import | 2026-09-24 | N/A |
| OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | ||||
| CVE-2026-75886 | 1 Redhat | 2 Openshift, Openshift Container Platform | 2026-09-24 | 7.2 High |
| A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send requests to the in-cluster catalogd service, leading to the disclosure of the internal operator-catalog index and providing a relay into the openshift-catalogd namespace. | ||||
| CVE-2026-75887 | 1 Redhat | 2 Openshift, Openshift Container Platform | 2026-09-24 | 7.5 High |
| A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends. | ||||
| CVE-2026-96676 | 2 Fast, Fastcom | 2 Fac1900r, Fac1900r | 2026-09-24 | 6.3 Medium |
| A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd. Such manipulation leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-96739 | 2 Sem-cms, Semcms | 2 Semcms, Semcms | 2026-09-24 | 4.3 Medium |
| A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the component KindEditor Upload Interface. This manipulation of the argument imgFile causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-14780 | 1 Papercut | 1 Papercut Mf | 2026-09-24 | N/A |
| A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system. | ||||