Export limit exceeded: 394922 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (394922 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-50125 | 2026-09-17 | 7.5 High | ||
| MKP is a Model Context Protocol server for Kubernetes. Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines values for the pods logs subresource. buildPodLogOpts() in pkg/k8s/subresource.go parses those values as unbounded int64 parameters, and defaultGetPodLogs() copies the returned Kubernetes log stream through io.Copy into an in-memory bytes.Buffer without an application-side cap. A remote attacker who can reach the default port 8080 MCP endpoint and select a pod with sufficiently large accumulated logs can send one tools/call request that causes large allocations and additional response copies, while the request-frequency limiter does not constrain per-request volume. This can exhaust process memory, terminate the MKP server, and deny the MCP service; observed testing showed more than one GiB of RSS growth while handling a 128 MiB requested stream. This issue is fixed in version 0.4.1. | ||||
| CVE-2026-76702 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-17 | 5.8 Medium |
| A vulnerability in the operating system of HPE Networking EdgeConnect SD-WAN Gateways could allow an authenticated local attacker to cause a denial-of-service. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state. | ||||
| CVE-2026-76703 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-17 | 5.5 Medium |
| A buffer overflow vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways that could allow an authenticated attacker with administrative access to cause a denial of service. Successful exploitation could allow an attacker to disrupt system operations, potentially resulting in an unstable system state. | ||||
| CVE-2026-76704 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-17 | 5.5 Medium |
| A vulnerability in the web-based management interface of the EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to execute arbitrary script code in a victim's browser in the context of the affected interface. Successful exploitation could allow an attacker to access sensitive information, potentially affecting the confidentiality and integrity of the data processed by the application. | ||||
| CVE-2026-76705 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-17 | 5.5 Medium |
| A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system. | ||||
| CVE-2026-76706 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-17 | 5.3 Medium |
| A vulnerability in the API endpoint of HPE Networking EdgeConnect SD-WAN Orchestrator could allow an unauthenticated remote attacker to obtain sensitive information. Successful exploitation could result in the disclosure of security-relevant configuration details and security feature status, which could be used to facilitate further attacks. | ||||
| CVE-2026-76707 | 1 Hewlett Packard Enterprise (hpe) | 1 Edgeconnect Sd-wan Gateways | 2026-09-17 | 4.3 Medium |
| A vulnerability in HPE Networking EdgeConnect SD-WAN Gateways could allow an unauthenticated adjacent attacker to view some system memory contents. Successful exploitation could allow an attacker to gain insight into internal services and workflows, increasing the risk of unauthorized access and elevated privileges when combined with other vulnerabilities. | ||||
| CVE-2026-76796 | 1 Newell Brands | 1 Dymo Connect Desktop | 2026-09-17 | 4 Medium |
| The LoadImageAsPngBase64 endpoint of the Newell Brands DYMO Connect Desktop local web service accepts a file path parameter without adequate validation, allowing a crafted path to read arbitrary image files from the host filesystem outside the intended scope. Fixed in 1.6.2. The fix limits access by file extension only, not by directory - arbitrary-location reads of files with an allowed image extension remain possible by design (accepted residual risk). | ||||
| CVE-2026-89040 | 1 Tencent | 1 Mass Service Engine In Cluster (msec) | 2026-09-17 | 9.8 Critical |
| Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root. | ||||
| CVE-2026-89027 | 2 Miniorange, Wordpress | 2 Jwt Authentication For Wp Rest Apis, Wordpress | 2026-09-17 | 6.5 Medium |
| miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability that allows unauthenticated attackers to bypass administrator-configured authentication by supplying a specific GET parameter without any capability check or nonce verification. Attackers can force the plugin to use Basic HTTP authentication regardless of configured JWT or API token settings, then exploit distinguishable error codes and the absence of rate limiting to perform unthrottled username enumeration and credential guessing attacks. | ||||
| CVE-2026-88065 | 1 Niaefeup | 1 Tts-be | 2026-09-17 | 7.5 High |
| `tts-be` is a backend for a timetable selector that aims to help students better choose their class schedules. Versions prior to 2.1.0 have a Broken Access Control vulnerability across several API endpoints (such as `/api/student/{id}/photo` and `/api/course_unit/{id}/exchange/metadata`). By chaining these unauthenticated endpoints, a remote attacker can use the backend as an open proxy to bypass authorization checks, allowing for the enumeration and extraction of sensitive Personally Identifiable Information (PII) from upstream university systems. The exposed data includes full names, student IDs, class schedules, and photos. This issue was fixed in version 2.1.0. | ||||
| CVE-2026-68953 | 1 Digital Watchdog | 5 Va1g4 Recorder, Vg4 Recorder, Vmax A1 G4 Dvr and 2 more | 2026-09-17 | 6.5 Medium |
| The affected products are vulnerable to an authentication bypass that allows unauthenticated remote attackers to disclose sensitive device information, including administrator credentials in plaintext, by sending crafted HTTP(S) requests. | ||||
| CVE-2026-66890 | 1 Digital Watchdog | 5 Va1g4 Recorder, Vg4 Recorder, Vmax A1 G4 Dvr and 2 more | 2026-09-17 | 9.6 Critical |
| The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable. | ||||
| CVE-2026-68070 | 1 Digital Watchdog | 5 Va1g4 Recorder, Vg4 Recorder, Vmax A1 G4 Dvr and 2 more | 2026-09-17 | 8.8 High |
| The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command. | ||||
| CVE-2026-68950 | 1 Digital Watchdog | 5 Va1g4 Recorder, Vg4 Recorder, Vmax A1 G4 Dvr and 2 more | 2026-09-17 | 8.8 High |
| The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable. | ||||
| CVE-2026-66887 | 1 Digital Watchdog | 5 Va1g4 Recorder, Vg4 Recorder, Vmax A1 G4 Dvr and 2 more | 2026-09-17 | 9.6 Critical |
| The affected products are missing authorization on state-changing CGIs and session checks are not performed. | ||||
| CVE-2026-66372 | 1 Digital Watchdog | 5 Va1g4 Recorder, Vg4 Recorder, Vmax A1 G4 Dvr and 2 more | 2026-09-17 | 6.8 Medium |
| The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the seed space. | ||||
| CVE-2026-61568 | 1 Zereight | 1 Gitlab-mcp | 2026-09-17 | 9.6 Critical |
| `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a victim's local MCP listener while preserving an attacker-controlled `Host` and `Origin`. The server accepts those headers and reaches the MCP initialization path instead of rejecting the request at the HTTP boundary. Version 2.1.30 contains a patch. | ||||
| CVE-2026-61559 | 1 Zereight | 1 Gitlab-mcp | 2026-09-17 | 9.6 Critical |
| `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and uses it as the base URL for all outbound GitLab API calls made within that request. The server validates that the value is a well-formed URL (`new URL(dynamicApiUrl)`) but applies no allowlist or hostname restriction. The server then attaches the victim's `Private-Token` to every outbound fetch that uses the redirected URL. Any caller who can reach the HTTP transport can set `X-GitLab-API-URL` to an attacker-controlled host. The next GitLab API call the server makes delivers the victim's token to that host. Version 2.1.27 contains a patch. | ||||
| CVE-2026-68491 | 1 Webpros | 1 Solusvm | 2026-09-17 | N/A |
| An insufficient check allowed for the overwrite of arbitrary files via a symlink. | ||||