Export limit exceeded: 389924 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389924 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-0304 | 1 Palo Alto Networks | 1 Cortex Xdr Broker Vm | 2026-09-10 | N/A |
| A privilege escalation vulnerability in Palo Alto Networks Cortex XDR Broker VM enables an authenticated low privileged user with man-in-the-middle (MitM) access to execute code with root privileges on the Broker VM. | ||||
| CVE-2026-0303 | 1 Palo Alto Networks | 1 Checkov By Prisma Cloud | 2026-09-10 | N/A |
| A code execution vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can allow arbitrary code execution when Checkov scans a directory that contains an attacker-controlled configuration file. | ||||
| CVE-2026-46460 | 1 Dell | 1 Powerscale Onefs | 2026-09-10 | 3.5 Low |
| Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Incorrect Authorization vulnerability. A low privileged adjacent network attacker could potentially exploit this vulnerability, leading to unauthorized modification of system logs. | ||||
| CVE-2026-81988 | 3 Adobe, Apple, Microsoft | 5 Acrobat, Acrobat Dc, Acrobat Reader Dc and 2 more | 2026-09-10 | 7.8 High |
| Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-75059 | 1 Jetbrains | 1 Pycharm | 2026-09-10 | 4.4 Medium |
| In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible | ||||
| CVE-2026-47884 | 2 Spring, Vmware | 2 Spring Framework, Spring Framework | 2026-09-10 | 9.8 Critical |
| Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier | ||||
| CVE-2026-19654 | 2 Redhat, Rsyslog | 3 Enterprise Linux, Enterprise Linux Eus, Rsyslog | 2026-09-10 | 7.5 High |
| A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. | ||||
| CVE-2026-75060 | 1 Jetbrains | 1 Pycharm | 2026-09-10 | 8.4 High |
| In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools | ||||
| CVE-2026-47885 | 2 Spring, Vmware | 2 Spring Framework, Spring Framework | 2026-09-10 | 7.5 High |
| The PartEventHttpMessageReader in Spring WebFlux does not enforce the maxPartSize limit when maxInMemorySize is set to -1. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 | ||||
| CVE-2026-68892 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-10 | 7.8 High |
| Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-49312 | 1 Huawei | 1 Harmonyos | 2026-09-10 | 4 Medium |
| Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2026-12855 | 1 Insyde Software | 1 Insydeh2o | 2026-09-10 | 8.2 High |
| Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects. | ||||
| CVE-2023-54392 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 6.5 Medium |
| PocketMine-MP versions >= 4.20.0 before 4.22.3 (and before 5.2.1 in the 5.x branch) fail to validate NBT tag types in BlockActorDataPacket. A player can crash the server by sending a packet containing sign NBT data with an incorrect tag type, triggering an unhandled UnexpectedTagTypeException that terminates the server process. | ||||
| CVE-2023-54393 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 7.5 High |
| PocketMine-MP versions before 4.20.5 contain a denial of service vulnerability in LoginPacket JSON parsing due to improper validation in the JsonMapper dependency. Attackers can send malformed JSON structures in LoginPacket to crash the server. | ||||
| CVE-2023-54394 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 4.3 Medium |
| PocketMine-MP before 4.18.0-ALPHA2 fails to rate-limit mismatch type InventoryTransactionPacket requests, allowing attackers to trigger excessive inventory synchronization. Attackers can send numerous mismatch transactions to force the server to transmit large amounts of serialized inventory data, consuming significant bandwidth without authentication. | ||||
| CVE-2023-54396 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 6.5 Medium |
| PocketMine-MP versions before 4.8.1 fail to validate dye color IDs in banner NBT data during deserialization. Attackers can provide invalid color values in inventory transactions or via commands to trigger undefined offset errors and crash the server. | ||||
| CVE-2024-58381 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 7.5 High |
| PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash the server by sending malformed JSON data. Attackers can exploit improper object initialization from scalar JSON types to trigger unset required properties, causing the application to crash. | ||||
| CVE-2026-22591 | 1 Eprosima | 1 Fast Dds | 2026-09-10 | 7.5 High |
| eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3, Fast DDS’s implementation of SQL‑based content filtering (DDSSQLFilter) allows any participant in a DDS domain to remotely crash other Fast DDS participants by sending a single crafted SEDP `DATA` submessage whose `PID_CONTENT_FILTER_PROPERTY.filterExpression` contains a deeply nested filter expression. Versions 2.6.12, 2.14.6, 3.2.4, and 3.4.3 fix the issue. | ||||
| CVE-2026-23855 | 1 Dell | 2 Idrac10, Idrac9 | 2026-09-10 | 7.2 High |
| Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to command injection. | ||||
| CVE-2026-40635 | 1 Dell | 1 Powerscale Onefs | 2026-09-10 | 5.4 Medium |
| Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to denial of service and information tampering. | ||||