Export limit exceeded: 24977 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 398099 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (398099 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-88840 | 2 Busybox, Redhat | 3 Busybox, Hardened Images, Hummingbird | 2026-09-24 | 5.3 Medium |
| BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. | ||||
| CVE-2026-93529 | 2 Bilal Naseer, Wordpress | 2 Wsp Mcp – Ai Agents Connector, Wordpress | 2026-09-24 | 6.5 Medium |
| Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. | ||||
| CVE-2026-93622 | 2 Nicolaskulka, Wordpress | 2 Wps Limit Login, Wordpress | 2026-09-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. | ||||
| CVE-2026-94118 | 2 Leap13, Wordpress | 2 Premium Blocks – Gutenberg Blocks For Wordpress, Wordpress | 2026-09-24 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | ||||
| CVE-2026-94174 | 2 Webfactory, Wordpress | 2 Email Log, Wordpress | 2026-09-24 | 7.6 High |
| Administrator SQL Injection in Email Log <= 2.63 versions. | ||||
| CVE-2026-94457 | 2 Webfactory, Wordpress | 2 Captcha Code, Wordpress | 2026-09-24 | 4.8 Medium |
| Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | ||||
| CVE-2026-94500 | 2 Roxnor, Wordpress | 2 Elementskit Elementor Addons Lite, Wordpress | 2026-09-24 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | ||||
| CVE-2026-95593 | 2 Ben Roberts, Wordpress | 2 Ultimeter, Wordpress | 2026-09-24 | 7.6 High |
| Editor SQL Injection in Ultimeter <= 3.0.8 versions. | ||||
| CVE-2026-95603 | 2 Victor Rodriguez, Wordpress | 2 Reycob Product Import Export, Wordpress | 2026-09-24 | 7.2 High |
| Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. | ||||
| CVE-2026-96545 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-09-24 | 4.4 Medium |
| An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an RGBA layer, the file-tim plug-in allocates an undersized row buffer but processes it using the larger RGBA row size. This can copy adjacent heap contents into the decoded image and may crash the plug-in. | ||||
| CVE-2026-61814 | 2 Org.typelevel, Typelevel | 4 Jawn-parser 2.12, Jawn-parser 2.13, Jawn-parser 3 and 1 more | 2026-09-24 | 7.5 High |
| Jawn is an open source JSON parser. Prior to 1.7.0, Jawn's AsyncParser can perform quadratic work when a single JSON token is delivered across many small chunks because each absorb call rescans the incomplete token from the start. A remote attacker who controls untrusted JSON input and its chunk sizes can exhaust CPU resources and cause denial of service in applications using AsyncParser. This issue is fixed in version 1.7.0. | ||||
| CVE-2026-96872 | 1 Wikimedia | 1 Mediawiki-wikilambda Extension | 2026-09-24 | N/A |
| Improper handling of insufficient permissions or privileges vulnerability in The Wikimedia Foundation Mediawiki - WikiLambda Extension on Linux, MacOS, and Windows allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - WikiLambda Extension: before 1.47.0. | ||||
| CVE-2026-94181 | 1 The Browser Company Of New York | 1 Arc | 2026-09-24 | 7.4 High |
| An address bar spoofing issue in affected versions of Arc could allow an attacker to spoof the browser address bar via a <select> element that triggers requestFullscreen without displaying the fullscreen notification. | ||||
| CVE-2026-96770 | 1 Temporal Technologies, Inc. | 1 S2s-proxy | 2026-09-24 | N/A |
| All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required. | ||||
| CVE-2026-87900 | 1 Webpros | 1 Wp Toolkit For Cpanel | 2026-09-24 | N/A |
| Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. | ||||
| CVE-2026-97155 | 1 Fabasoft | 1 Folio Client | 2026-09-24 | 6.5 Medium |
| Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, does not restrict which web origins may invoke its functions by default. The registry value VALIDDOMAINS, which limits permitted origins, was optional and empty by default, resulting in all domains being trusted. As a consequence, any website visited by a user with the Folio Client and browser extension installed could invoke client functions, e.g., related to downloading documents, opening documents, and synchronizing files. The first fixed builds are Fabasoft Folio Client 2026 (Build 26.0.0.10) and Fabasoft Folio Client 2026 April Release (Build 26.4.0.76). This client is, for example, shipped with Fabasoft eGov-Suite. | ||||
| CVE-2026-87898 | 1 Webpros | 1 Plesk Site Import | 2026-09-24 | N/A |
| OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | ||||
| CVE-2026-78310 | 1 Deltaww | 1 Diaenergie | 2026-09-24 | 4.3 Medium |
| Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | ||||
| CVE-2026-56211 | 2 Aomedia, Redhat | 7 Libaom, Ai Inference Server, Enterprise Linux and 4 more | 2026-09-24 | 7.1 High |
| A remote code execution vulnerability was found in libaom, the reference AV1 codec implementation. Insufficient bounds validation in the AV1 encoder's SVC (Scalable Video Coding) layer ID control allows an attacker to supply crafted video frame pixels that overlap with internal encoder layer context structures. In fork-based video processing services, an attacker can use this to hijack the cyclic refresh map pointer, brute-force the process base address via a crash oracle, and redirect control flow to achieve arbitrary command execution. Exploitation requires the target service to use libaom with SVC encoding enabled and accept attacker-supplied video frames. | ||||
| CVE-2026-56210 | 2 Aomedia, Redhat | 7 Libaom, Ai Inference Server, Enterprise Linux and 4 more | 2026-09-24 | 7.1 High |
| A heap-buffer-overflow read vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC (Scalable Video Coding) layer ID control function allows setting a spatial_layer_id exceeding the configured number of layers. This causes an out-of-bounds heap read of approximately 40,728 bytes when computing a layer context array index. An attacker who can influence SVC encoder parameters in a network-facing service could exploit this for information disclosure (heap content leak) or denial of service (segmentation fault from hitting unmapped memory). | ||||