Export limit exceeded: 385566 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385566 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82224 | 2 Iova.mihai, Wordpress | 2 Slicewp, Wordpress | 2026-08-31 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions. | ||||
| CVE-2026-82228 | 2 Siteground, Wordpress | 2 Siteground Security, Wordpress | 2026-08-31 | 8.1 High |
| Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions. | ||||
| CVE-2026-18545 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 4.3 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2026-18729 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. | ||||
| CVE-2026-18891 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 8.2 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication. | ||||
| CVE-2026-82954 | 1 Dokploy | 1 Dokploy | 2026-08-31 | 9.9 Critical |
| A vulnerability was detected in Dokploy up to 0.29.7. This issue affects the function writeTraefikConfigInPath of the file packages/server/src/utils/traefik/application.ts of the component Settings. The manipulation of the argument path results in path traversal. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-81780 | 2 Hashthemes, Wordpress | 2 Hash Form, Wordpress | 2026-08-31 | 10 Critical |
| Unauthenticated Arbitrary File Upload in Hash Form <= 1.4.2 versions. | ||||
| CVE-2026-18904 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 8.2 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers. | ||||
| CVE-2026-19286 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint. | ||||
| CVE-2026-19294 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 6.4 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization. | ||||
| CVE-2026-19295 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 9.9 Critical |
| IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control. | ||||
| CVE-2026-51681 | 1 Totolink | 1 T6 | 2026-08-31 | 9.1 Critical |
| Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-54600 | 1 Ellite | 1 Wallos | 2026-08-31 | N/A |
| Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4. | ||||
| CVE-2026-82233 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-31 | 5.7 Medium |
| SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection. | ||||
| CVE-2026-82234 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-31 | 8.2 High |
| SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services. | ||||
| CVE-2026-54788 | 1 Datadog | 1 Dd-trace-rs | 2026-08-31 | 7.5 High |
| dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3. | ||||
| CVE-2026-82017 | 1 Igel | 1 Igel Os | 2026-08-31 | 7.6 High |
| IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code. | ||||
| CVE-2026-55854 | 1 Mariadb | 1 Connector-nodejs | 2026-08-31 | 5.9 Medium |
| MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3. | ||||
| CVE-2026-55855 | 1 Mariadb | 1 Connector-nodejs | 2026-08-31 | 6.5 Medium |
| MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js permits SQL injection when attacker-controlled Buffer parameters are escaped client-side under the big5, gbk, sjis, cp932, or gb18030 client character sets. PacketOutputStream.writeBufferEscape in lib/io/packet-output-stream.js escaped bytes without the charset-aware getMbRecognizer logic in lib/misc/charset-mb.js. The server SQL lexer runs my_ismbchar before escape processing, so an attacker-controlled lead byte can consume the inserted 0x5C backslash as a multibyte trail byte and leave the following 0x27 quote unescaped, terminating the string literal and allowing arbitrary SQL. The default utf8mb4 character set and parameters sent through the execute binary prepared-statement path are not affected. Successful exploitation can expose or modify data available to the database account. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3. | ||||
| CVE-2026-55779 | 1 Silverstripe | 1 Silverstripe | 2026-08-31 | 5.4 Medium |
| Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage() in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CAST_HTML and inserts $restoredItem->Title, $restoredItem->URLSegment, $restoredItem->CMSEditLink(), and $changedProperty['value'] without applying Convert::raw2xml(). When an administrator restores an archived page containing a crafted title or URL segment, the generated restoration message can execute stored JavaScript in the administrator's browser, compromising the confidentiality and integrity of the CMS session. This issue is fixed in version 3.2.1. | ||||