Export limit exceeded: 399648 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (399648 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-45801 | 1 Glpi-project | 1 Glpi | 2026-09-26 | N/A |
| GLPI is a free asset and IT management software package. From 0.72 until 10.0.26 and 11.0.8, an authenticated user without the required permission can enable debug mode. The affected user-setting update does not enforce the privilege boundary intended to restrict debug-mode activation. This issue is fixed in versions 11.0.8 and 10.0.26. | ||||
| CVE-2026-55217 | 1 Glpi-project | 1 Glpi | 2026-09-26 | N/A |
| GLPI is a free asset and IT management software package. From 0.85 until 10.0.26 and 11.0.8, a low-privileged authenticated user can create, update, or delete knowledge base comments and translations without the required authorization for the affected content. This issue is fixed in versions 11.0.8 and 10.0.26. | ||||
| CVE-2026-6103 | 2 Php Group, Redhat | 2 Php, Hummingbird | 2026-09-26 | 4.3 Medium |
| phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine. | ||||
| CVE-2026-47679 | 1 Glpi-project | 1 Glpi | 2026-09-26 | N/A |
| GLPI is a free asset and IT management software package. From 10.0.0 until 10.0.26 and 11.0.8, any logged-in GLPI user can exploit insufficient path validation in the profile-picture update flow to request deletion of an attacker-selected file hosted by the server. This issue is fixed in versions 11.0.8 and 10.0.26. | ||||
| CVE-2026-53625 | 1 Glpi-project | 1 Glpi | 2026-09-26 | N/A |
| GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, a technician can manipulate the authtype value through the API to change another user's authentication method. Under configurations using the legacy API REST interface or SSO logins, this can change a super-administrator's authentication method and enable account takeover. This issue is fixed in versions 11.0.8 and 10.0.26. | ||||
| CVE-2026-53629 | 1 Glpi-project | 1 Glpi | 2026-09-26 | N/A |
| GLPI is a free asset and IT management software package. From 9.4.0 until 10.0.26 and 11.0.8, an attacker with the READ right on logs can craft a URL for the history tab that injects attacker-controlled values into a database query. This permits SQL injection through the history tab endpoint. This issue is fixed in versions 11.0.8 and 10.0.26. | ||||
| CVE-2026-100305 | 1 Tduckcloud | 1 Tduck-survey-form | 2026-09-26 | 4.3 Medium |
| TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/create. Authenticated attackers who know a form's key can submit unlimited entries to any form, bypassing publish status, time window, quota, and per-IP restrictions to falsify collected results. | ||||
| CVE-2026-100306 | 1 Tduckcloud | 1 Tduck-survey-form | 2026-09-26 | 5.3 Medium |
| TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote unauthenticated attackers can submit form entries directly to public submission APIs without providing the password by using the form key from share links. | ||||
| CVE-2026-5267 | 1 Ciena | 1 Navigator Ncs | 2026-09-26 | 7.5 High |
| Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly enforce authentication. An unauthenticated attacker with network access to the affected service could access the event stream and potentially obtain sensitive information. | ||||
| CVE-2026-100208 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-09-26 | 7.5 High |
| Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-26831 | 1 Dbashford | 1 Textract | 2026-09-26 | 9.8 Critical |
| textract through 2.5.0 is vulnerable to OS Command Injection via the file path parameter in multiple extractors. When processing files with malicious filenames, the filePath is passed directly to child_process.exec() in lib/extractors/doc.js, rtf.js, dxf.js, images.js, and lib/util.js with inadequate sanitization | ||||
| CVE-2026-35616 | 1 Fortinet | 1 Forticlientems | 2026-09-26 | 9.1 Critical |
| A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | ||||
| CVE-2026-100523 | 1 Cotonti | 2 Cotonti Siena, Siena | 2026-09-26 | 6.1 Medium |
| Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks. | ||||
| CVE-2026-17545 | 1 Php Group | 1 Php | 2026-09-26 | 5.9 Medium |
| On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes. | ||||
| CVE-2025-14181 | 2 Php Group, Redhat | 2 Php, Hummingbird | 2026-09-26 | 6.5 Medium |
| The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow. | ||||
| CVE-2026-86930 | 1 Claris | 1 Filemaker Server | 2026-09-26 | 9.1 Critical |
| An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3. | ||||
| CVE-2026-86934 | 1 Claris | 1 Filemaker Server | 2026-09-26 | 9.1 Critical |
| An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3. | ||||
| CVE-2026-8051 | 1 Ivanti | 1 Virtual Traffic Manager | 2026-09-26 | 7.2 High |
| OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | ||||
| CVE-2026-79314 | 1 Vaxilu | 1 X-ui | 2026-09-26 | 8.8 High |
| A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data. | ||||
| CVE-2026-7411 | 1 Eclipse | 1 Basyx | 2026-09-26 | 10 Critical |
| In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise. | ||||