Export limit exceeded: 398341 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 398341 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (101001 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-35397 | 1 Jupyter | 1 Jupyter Server | 2026-08-28 | 8.8 High |
| Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, a path traversal vulnerability in the REST API allows an authenticated user to escape the configured root_dir and access sibling directories whose names begin with the same prefix as the root_dir. For example, with a root_dir named "test", the API permits access to a sibling directory named "testtest" through a crafted request to the /api/contents endpoint using encoded path components. An attacker can read, write, and delete files in affected sibling directories. Multi-tenant deployments using predictable naming schemes are particularly at risk, as a user with a directory named "user1" could access directories for user10 through user19 and beyond. A user who can choose a single-character folder name could gain access to a significant number of sibling directories. Version 2.18.0 contains a fix. As a workaround, ensure folder names do not share a common prefix with any sibling directory. | ||||
| CVE-2026-33079 | 1 Lepture | 1 Mistune | 2026-08-28 | 7.5 High |
| In versions 3.0.0a1 through 3.2.0 of Mistune, there is a ReDoS (Regular Expression Denial of Service) vulnerability in `LINK_TITLE_RE` that allows an attacker who can supply Markdown for parsing to cause denial of service. The regular expression used for parsing link titles contains overlapping alternatives that can trigger catastrophic backtracking. In both the double-quoted and single-quoted branches, a backslash followed by punctuation can be matched either as an escaped punctuation sequence or as two ordinary characters, creating an ambiguous pattern inside a repeated group. If an attacker supplies Markdown containing repeated ! sequences with no closing quote, the regex engine explores an exponential number of backtracking paths. This is reachable through normal Markdown parsing of inline links and block link reference definitions. A small crafted input can therefore cause significant CPU consumption and make applications using Mistune unresponsive. | ||||
| CVE-2026-2614 | 2 Lfprojects, Mlflow | 2 Mlflow, Mlflow/mlflow | 2026-08-28 | 7.5 High |
| A vulnerability in the `_create_model_version()` handler of `mlflow/server/handlers.py` in mlflow/mlflow versions 3.9.0 and earlier allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem. The issue arises when a `CreateModelVersion` request includes the tag `mlflow.prompt.is_prompt`, which bypasses source path validation. This enables an attacker to store an arbitrary local filesystem path as the model version source. The `get_model_version_artifact_handler()` function later uses this source to serve files without verifying the model version's prompt status, leading to a complete confidentiality compromise. This issue is fixed in version 3.10.0. | ||||
| CVE-2026-18324 | 2 Wordpress, Wpmudev | 2 Wordpress, Forminator Forms – Contact Form, Payment Form & Custom Form Builder | 2026-08-28 | 7.2 High |
| The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled. | ||||
| CVE-2025-2610 | 1 Magnussolution | 1 Magnusbilling | 2026-08-28 | 7.6 High |
| Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. | ||||
| CVE-2025-2609 | 1 Magnussolution | 1 Magnusbilling | 2026-08-28 | 8.2 High |
| Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0. | ||||
| CVE-2026-12852 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 2 Bc-java, Bc-java | 2026-08-28 | 7.5 High |
| In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check. | ||||
| CVE-2026-27330 | 2 Weptile, Wordpress | 2 Mobile App For Woocommerce, Wordpress | 2026-08-28 | 8.6 High |
| Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions. | ||||
| CVE-2026-32550 | 2 Liquid Web, Llc, Wordpress | 2 Kadence Shop Kit, Wordpress | 2026-08-28 | 8.5 High |
| Subscriber SQL Injection in Kadence Shop Kit <= 3.0.6 versions. | ||||
| CVE-2026-78281 | 2 Codepeople, Wordpress | 2 Cp Media Player, Wordpress | 2026-08-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in CP Media Player <= 1.3.0 versions. | ||||
| CVE-2026-78283 | 2 Codepeople, Wordpress | 2 Music Player For Woocommerce, Wordpress | 2026-08-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Music Player for WooCommerce <= 1.8.9 versions. | ||||
| CVE-2026-81277 | 2 Villatheme, Wordpress | 2 Suggestion Engine For Woocommerce, Wordpress | 2026-08-28 | 8.5 High |
| Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions. | ||||
| CVE-2026-66155 | 1 Siemens | 3 Element Maps-ng V47, Element Maps-ng V48, Element Maps-ng V49 | 2026-08-28 | 7.6 High |
| A vulnerability has been identified in Element maps-ng V47 (All versions < V47.12.3), Element maps-ng V48 (All versions < V48.11.3), Element maps-ng V49 (All versions < V49.16.1). The si-map component does not properly neutralize user-controllable input of the points property that is used to render the tooltip label of map pins. This could allow an attacker to craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session. | ||||
| CVE-2026-80212 | 1 Ruby | 1 Resolv | 2026-08-28 | 7.5 High |
| An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency. | ||||
| CVE-2026-81091 | 1 Mcp-use | 1 Mcp-use | 2026-08-28 | 8.6 High |
| The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the __mcp_target parameter and proxied to it without inspecting the host, so loopback, link-local and private addresses were all accepted, as were names that resolve to them, and the validation was not reapplied to a redirect the destination returned. A caller could therefore make the server issue requests to addresses reachable only from the host it runs on and read the responses. The current code calls isSafeProxyTarget, which checks the resolved address against private, loopback and link-local ranges before proxying and bounds the number of redirects followed. | ||||
| CVE-2026-81097 | 1 Maquina-app | 1 Rails-mcp-server | 2026-08-28 | 8.4 High |
| The execute_ruby tool is documented as a read-only Ruby sandbox and is enforced by a pattern denylist together with replacements for the process-spawning methods on Kernel. The pseudo-terminal library's spawn entry points are neither in the denylist nor replaced, so a normal tool call could reach them and start a shell, executing commands as the account running the server and outside the guarded methods. The denylist was introduced with the tool in 1.4.0 and never covered those entry points through 1.6.0. Version 1.6.1 restricts the requires the sandbox permits to a data-only list and blocks dynamic dispatch to execution entry points; 2.0.0 removes the tool. | ||||
| CVE-2026-76639 | 1 Unitree Robotics | 1 G1 Edu | 2026-08-28 | 8.8 High |
| Unitree G1 EDU firmware through 1.5.2 contains an unauthenticated remote code execution vulnerability that allows network-adjacent attackers to execute arbitrary commands as root by chaining three weaknesses: an unauthenticated WebRTC-to-DDS bridge on TCP port 9991, a static AES-128 key stored with world-readable permissions, and a path traversal flaw in the chat_go knowledge upload API. Attackers can publish DDS control messages to restart the bashrunner service, plant a malicious payload in its script execution directory via path traversal, and trigger execution of that payload as uid 0 through the bashrunner shell subprocess. | ||||
| CVE-2026-76640 | 1 Unitree Robotics | 1 G1 Edu | 2026-08-28 | 7.5 High |
| Unitree G1 EDU firmware through 1.5.2 contains multiple chained vulnerabilities in the BLE GATT server and WiFi provisioning stack that allow unauthenticated proximate attackers to achieve root code execution without pairing or credentials by exploiting an unquoted heredoc variable in the WiFi provisioning script and a buffer overflow in the SSID chunk accumulator. Attackers can send crafted BLE writes to overflow a fixed BSS buffer across BLE connections, corrupting an adjacent mainloop function pointer dispatch entry that is subsequently invoked by the cleanup path passing attacker-controlled data to system() as uid 0. | ||||
| CVE-2026-81525 | 1 Mongodb | 2 Php Extension, Php Library | 2026-08-28 | 8.1 High |
| The MongoDB client library for PHP does not sufficiently sanitize special elements in application-supplied namespace identifiers before using them to construct the target namespace for database operations. An application that incorporates untrusted text into these identifiers may have operations silently directed at a different storage location than the one the application intended. | ||||
| CVE-2026-18717 | 1 Applied Systems Engineering | 1 Ase2000 V2 | 2026-08-28 | 7.4 High |
| ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications. | ||||