Export limit exceeded: 386212 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 386212 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386212 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48001 | 1 Adobe | 8 Adobe Commerce, Adobe Commerce B2b, Adobe Commerce Webhooks Plugin and 5 more | 2026-08-03 | 3.7 Low |
| Adobe Commerce is affected by an Information Exposure vulnerability that could lead to a limited disclosure of sensitive information. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-47995 | 1 Adobe | 8 Adobe Commerce, Adobe Commerce B2b, Adobe Commerce Webhooks Plugin and 5 more | 2026-08-03 | 8.1 High |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. | ||||
| CVE-2026-48356 | 1 Adobe | 8 Adobe Commerce, Adobe Commerce B2b, Adobe Commerce Webhooks Plugin and 5 more | 2026-08-03 | 9.3 Critical |
| Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | ||||
| CVE-2026-48358 | 1 Adobe | 8 Adobe Commerce, Adobe Commerce B2b, Adobe Commerce Webhooks Plugin and 5 more | 2026-08-03 | 9.1 Critical |
| Adobe Commerce is affected by an Improper Encoding or Escaping of Output vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-47999 | 1 Adobe | 8 Adobe Commerce, Adobe Commerce B2b, Adobe Commerce Webhooks Plugin and 5 more | 2026-08-03 | 4.8 Medium |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-47997 | 1 Adobe | 8 Adobe Commerce, Adobe Commerce B2b, Adobe Commerce Webhooks Plugin and 5 more | 2026-08-03 | 5.9 Medium |
| Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-18352 | 2 Gm Alex, Wordpress | 2 User Access Manager, Wordpress | 2026-08-03 | 7.5 High |
| The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path. | ||||
| CVE-2026-3245 | 1 Canon Production Printing | 1 Prismaproduction | 2026-08-03 | 7.5 High |
| A deserialization vulnerability in PRISMAproduction Version 6.5 or earlier that may lead to arbitrary code execution. | ||||
| CVE-2026-65875 | 1 Basercms Users Community | 1 Basercms | 2026-08-03 | 7.1 High |
| BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed. | ||||
| CVE-2026-59643 | 1 Legion Of The Bouncy Castle Inc. | 2 Bc-fja, Bc-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, OpenPGP inline-signature policy failures silently ignored. This issue also affects Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 2.0.13. | ||||
| CVE-2026-6694 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-08-03 | 5.5 Medium |
| A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user. | ||||
| CVE-2026-18584 | 2 Gl-inet, Gl.inet | 12 E5800, E750, X2000 and 9 more | 2026-08-03 | 5.4 Medium |
| A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. | ||||
| CVE-2026-18585 | 2 Gl-inet, Gl.inet | 22 Be3600, Be6500, Be9300 and 19 more | 2026-08-03 | 4.3 Medium |
| A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. | ||||
| CVE-2026-9593 | 2 Endress+hauser, Endress Hauser | 2 Fdi Package Library, Fdi Package Library | 2026-08-03 | 6.7 Medium |
| A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disruption of device data or operation. | ||||
| CVE-2026-33591 | 1 Tranquil It Systems | 1 Wapt Server | 2026-08-03 | N/A |
| A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account. | ||||
| CVE-2026-56608 | 1 Hcltech | 1 Icontrol | 2026-08-03 | 3.7 Low |
| HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization. | ||||
| CVE-2026-56609 | 1 Hcltech | 1 Icontrol | 2026-08-03 | 4.8 Medium |
| HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission. | ||||
| CVE-2026-18574 | 1 Checkpoint | 2 Multi-domain Security Management Server, Security Management Server | 2026-08-03 | N/A |
| An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation. | ||||
| CVE-2026-18572 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-08-03 | 6.5 Medium |
| Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times. | ||||
| CVE-2026-12188 | 1 Grit42 | 1 Grit | 2026-08-03 | 6.3 Medium |
| A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules/core/backend/app/controllers/concerns/grit/core/grit_entity_controller.rb of the component GritEntityController. Performing a manipulation results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||