Export limit exceeded: 378648 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (378648 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74250 | 1 Openstack | 1 Ironic | 2026-08-17 | 6.3 Medium |
| In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run cleaning immediately after enrollment with, or changing to, the autodetect deploy interface. | ||||
| CVE-2026-73060 | 1 Scriban | 1 Scriban | 2026-08-17 | 7.5 High |
| Scriban versions from 3.0.0 through 7.2.5 contain a denial of service vulnerability in the ScriptRange.Multiply operator that bypasses LoopLimit when the left operand is a lazy sequence. Attackers can supply templates with array multiplication on lazy sequences to execute billions of uncharged iterations, pinning CPU cores and exhausting garbage collection resources even when LoopLimit is set to 1. | ||||
| CVE-2026-73050 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-17 | 9 Critical |
| SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary JavaScript when viewing databases containing the malicious select field. | ||||
| CVE-2026-71571 | 1 Icagenda.com | 1 Icagenda Extension For Joomla | 2026-08-17 | N/A |
| Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL. | ||||
| CVE-2026-71570 | 1 Icagenda.com | 1 Icagenda Extension For Joomla | 2026-08-17 | N/A |
| Joomla Extension - icagenda.com - ACL bypass allowing arbitrary user enumeration < 2.0.0-4.0.11 - A backend operator granted access scoped to `com_icagenda` only could enumerate Joomla user profiles. | ||||
| CVE-2026-71567 | 2026-08-17 | 7.7 High | ||
| In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials (which are not verified by FakeFish). | ||||
| CVE-2026-67366 | 1 Icagenda.com | 1 Icagenda Extension For Joomla | 2026-08-17 | N/A |
| Joomla Extension - icagenda.com - CSRF on frontend registration actions in iCagenda < 2.0.0-4.0.11 - Multiple state changing operations in the frontend are callable without a CSRF token check. | ||||
| CVE-2026-67365 | 1 Icagenda.com | 1 Icagenda Extension For Joomla | 2026-08-17 | N/A |
| Joomla Extension - icagenda.com - Unauthenticated SQL injection in iCagenda < 4.0.0-4.0.11 - Unauthenticated SQL injection in mod_icagenda_calendar (iCagenda), reachable via com_ajax with no session, token or account. | ||||
| CVE-2026-63650 | 1 Openvpn | 1 Openvpn | 2026-08-17 | 3.1 Low |
| OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field | ||||
| CVE-2026-63649 | 1 Openvpn | 1 Openvpn | 2026-08-17 | 8.8 High |
| The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks | ||||
| CVE-2026-61920 | 1 Microsoft | 15 Windows 10 1607, Windows 10 1809, Windows 11 26h1 and 12 more | 2026-08-17 | 6.6 Medium |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-49307 | 1 Huawei | 1 Harmonyos | 2026-08-17 | 6.2 Medium |
| Permission control vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2026-2357 | 2 Bold-themes, Wordpress | 2 Bold Page Builder, Wordpress | 2026-08-17 | 6.4 Medium |
| The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bt_bb_shortcode' shortcode in all versions up to, and including, 5.6.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-22072 | 1 Oppo | 1 Oppo Health | 2026-08-17 | N/A |
| Loading arbitrary external URLs through WebView components introduces malicious JS code that can steal arbitrary user tokens. | ||||
| CVE-2026-20000 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-17 | 6.3 Medium |
| A vulnerability was detected in itsourcecode Hospital Management System 1.0. The impacted element is an unknown function of the file /viewprescriptionrecord.php. The manipulation of the argument delid results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-19997 | 1 Webkul | 1 Bagisto | 2026-08-17 | 4.7 Medium |
| A security flaw has been discovered in Webkul Bagisto up to 2.4.4. This issue affects some unknown processing of the file /admin/sales/rma/requests of the component Backend Sales RMA Endpoint. Performing a manipulation results in authorization bypass. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-19992 | 1 Orange View Limited | 1 Dualsafe Password Manager Digital Vault Extension | 2026-08-17 | 3.1 Low |
| A flaw has been found in Orange View Limited DualSafe Password Manager & Digital Vault Extension up to 1.4.35 on Chrome. Affected is an unknown function of the component postMessage-based Bridge. Executing a manipulation can lead to information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-19983 | 2 Gl-inet, Gl.inet | 16 A1300, Ax1800, Axt1800 and 13 more | 2026-08-17 | 8.3 High |
| A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl_nas_sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be launched remotely. Upgrading to version 4.9.0 is capable of addressing this issue. It is suggested to upgrade the affected component. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist." | ||||
| CVE-2026-19968 | 1 Assimp | 1 Assimp | 2026-08-17 | 4.3 Medium |
| A weakness has been identified in Open Asset Import Library Assimp 17c12da. The affected element is the function Assimp::MDLImporter::ReadFaces_3DGS_MDL7 in the library code/AssetLib/LWO/LWOLoader.h of the component 3DGS MDL7 Model Parser. Executing a manipulation can lead to heap-based buffer overflow. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called ee77bb09a42a49843ac85ef64c14d2328b251df1. Applying a patch is advised to resolve this issue. | ||||
| CVE-2026-19966 | 1 Codecanyon | 1 Timecamp Integration For Crm | 2026-08-17 | 5.4 Medium |
| A vulnerability was identified in CodeCanyon TimeCamp Integration for CRM up to 2.8. This issue affects some unknown processing of the file /clients/save_contact of the component Contact Information Update. Such manipulation of the argument contact_id leads to authorization bypass. The attack can be launched remotely. The exploit is publicly available and might be used. | ||||