Export limit exceeded: 385269 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385269 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385269 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385269 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12661 | 1 Rockwell Automation | 1 Factorytalk Historian Machine Edition | 2026-09-01 | N/A |
| A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition. A network adjacent attacker who is authenticated could send crafted requests to the web interface, resulting in buffer overflow conditions that may cause the device to crash and become unresponsive. | ||||
| CVE-2025-12768 | 1 Rockwell Automation | 1 Factorytalk Historian Machine Edition | 2026-09-01 | N/A |
| A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device. | ||||
| CVE-2026-80047 | 2026-09-01 | N/A | ||
| A vulnerability in Hugging Face Transformers (versions 4.49.0, <= 5.8.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and caches a remote module file before performing the required trust_remote_code consent check, inverting the security model enforced by other code-loading paths (such as AutoConfig, AutoModel, and AutoTokenizer). As a result, attacker‑controlled Python code from custom_generate/generate.py is copied into the user’s ~/.cache/huggingface/modules directory even if the user declines the trust prompt. Although execution is correctly gated, the file write is not reversible and can persist across sessions. This can lead to persistent, unauthorized files on disk and stale cache collisions where cached attacker code may later be executed during trusted model loads. The issue stems from an unconditional file write in dynamic_module_utils.py prior to any trust verification. | ||||
| CVE-2026-79684 | 2026-09-01 | 8.8 High | ||
| Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to bypass access restrictions and gain escalated privileges. | ||||
| CVE-2026-18210 | 2026-09-01 | 9.8 Critical | ||
| Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer Software Hardware Industry and Trade Limited Company Products's Store allows SQL Injection. This issue affects Products's Store: before 030631b2. | ||||
| CVE-2026-9625 | 1 Rockwell Automation | 1 Rslinx Classic | 2026-09-01 | N/A |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover. | ||||
| CVE-2026-9624 | 1 Rockwell Automation | 1 Rslinx Classic | 2026-09-01 | N/A |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover. | ||||
| CVE-2026-9622 | 1 Rockwell Automation | 1 Rslinx Classic | 2026-09-01 | N/A |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet targeting the Forward Close service can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover. | ||||
| CVE-2026-9621 | 1 Rockwell Automation | 1 Rslinx Classic | 2026-09-01 | N/A |
| A denial-of-service security issue exists within RSLinx® Classic. The security issue stems from improper handling of a malformed packet. A crafted CIP packet can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover | ||||
| CVE-2026-13348 | 2026-09-01 | N/A | ||
| CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled. | ||||
| CVE-2026-12663 | 1 Rockwell Automation | 1 Controlflash | 2026-09-01 | N/A |
| A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level. | ||||
| CVE-2026-84119 | 1 Mozilla | 1 Firefox | 2026-09-01 | N/A |
| Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. | ||||
| CVE-2026-84120 | 2026-09-01 | N/A | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. | ||||
| CVE-2026-84131 | 2026-09-01 | N/A | ||
| Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. | ||||
| CVE-2026-84118 | 2026-09-01 | N/A | ||
| Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. | ||||
| CVE-2026-84124 | 2026-09-01 | N/A | ||
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 140.15, and Firefox ESR 153.2. | ||||
| CVE-2026-84125 | 2026-09-01 | N/A | ||
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. | ||||
| CVE-2026-84128 | 2026-09-01 | N/A | ||
| Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155. | ||||
| CVE-2026-84130 | 2026-09-01 | N/A | ||
| Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. | ||||
| CVE-2026-77194 | 2 Wordpress, Wpinsider-1 | 2 Wordpress, Simple Membership | 2026-09-01 | 5.3 Medium |
| The Simple Membership plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in versions up to, and including, 4.8.0. This is due to improper identity verification during the public registration flow in WordPress Multisite environments, where the plugin binds new Simple Membership records to existing global WordPress users based solely on matching username and email, without requiring password verification or ownership proof, and fails to properly detect Administrator roles on child sites. This makes it possible for unauthenticated attackers to take over Administrator accounts on child sites in a Multisite network by registering a Simple Membership account with a victim's credentials on a site where public registration is enabled, then updating the victim's global WordPress password through the profile edit functionality. The vulnerability was partially patched in version 4.8.1. | ||||