Export limit exceeded: 379189 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (379189 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-73995 | 2 Wordpress, Wpeverest | 2 Wordpress, User Registration | 2026-08-18 | 5.4 Medium |
| Subscriber Broken Authentication in User Registration <= 5.2.6 versions. | ||||
| CVE-2025-9211 | 2026-08-18 | 6.7 Medium | ||
| Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting | ||||
| CVE-2025-9210 | 2026-08-18 | 8.1 High | ||
| Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs | ||||
| CVE-2026-47630 | 2026-08-18 | 5.5 Medium | ||
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution. | ||||
| CVE-2026-47629 | 2026-08-18 | 7.5 High | ||
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation. A successful exploit might lead to denial of service. | ||||
| CVE-2026-47628 | 2026-08-18 | 7.5 High | ||
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits. A successful exploit might lead to denial of service. | ||||
| CVE-2026-47627 | 2026-08-18 | 9.8 Critical | ||
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal. A successful exploit might lead to denial of service. | ||||
| CVE-2026-47606 | 2026-08-18 | 6.5 Medium | ||
| NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure. | ||||
| CVE-2025-12011 | 2 Rockwell Automation, Rockwellautomation | 5 Compactlogix 5370 Compact Guardlogix 5370 Controllogix 5570 Guardlogix 5570, Compact Guardlogix 5370, Compactlogix 5370 and 2 more | 2026-08-18 | N/A |
| A denial-of-service issue exists in 5370/5570 controllers. This vulnerability could potentially allow a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF). | ||||
| CVE-2026-71571 | 1 Icagenda.com | 1 Icagenda Extension For Joomla | 2026-08-18 | N/A |
| Joomla Extension - icagenda.com - Authenticated SQL injection via unescaped numeric filter in iCagenda < 2.0.0-4.0.11 - Backend operators with permissions to access iCagenda could inject SQL. | ||||
| CVE-2026-75924 | 1 Redhat | 2 Acm, Multicluster Engine | 2026-08-18 | 8.7 High |
| A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster. | ||||
| CVE-2026-75858 | 1 Hmbown | 1 Codewhale | 2026-08-18 | 7.8 High |
| CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' causing arbitrary model-supplied Python code to run in a python3 interpreter without consulting the user's configured --approval-policy and without any approval prompt or audit step. An attacker can induce the agent to execute arbitrary code via prompt injection in untrusted content the agent reads (a web page, fetched URL, repository file, or MCP tool result); the companion rlm_open tool can stage such content. Code runs on the user's machine at the user's privilege level. Fixed in 0.8.64. | ||||
| CVE-2026-71539 | 2026-08-18 | N/A | ||
| n8n is an open source workflow automation platform. Prior to 1.123.64, 2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node directory that loads as a custom JavaScript node after restart and executes arbitrary code on the server. This issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1. | ||||
| CVE-2026-70657 | 1 9001 | 1 Copyparty | 2026-08-18 | 4.3 Medium |
| Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder even though both features are disabled by default and must be explicitly enabled in the volume flags. This issue is fixed in version 1.20.17. | ||||
| CVE-2026-68924 | 2026-08-18 | 4.9 Medium | ||
| MobSF is a mobile application security testing tool used. Prior to 4.5.1, the unzip function in mobsf/StaticAnalyzer/views/common/shared_func.py logs that an archive member exceeding ZIP_MAX_UNCOMPRESSED_FILE_SIZE is being skipped but does not continue to the next member, so an authenticated user can upload a crafted ZIP or APK whose oversized member is extracted to disk when the aggregate ZIP_MAX_UNCOMPRESSED_TOTAL_SIZE limit has not yet been reached, potentially exhausting disk space and preventing further scans. This issue is fixed in version 4.5.1. | ||||
| CVE-2026-67678 | 2026-08-18 | 9.8 Critical | ||
| File Upload vulnerability in RainyGao-Hithub DocSys v.2.02.80 allows a remote attacker to execute arbitrary code | ||||
| CVE-2026-65400 | 1 Apple | 1 Macos | 2026-08-18 | 9.8 Critical |
| An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials. | ||||
| CVE-2026-65335 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-64784 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-63640 | 2026-08-18 | 4.3 Medium | ||
| MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, when hideConfigSecrets is enabled, the catch-all socket dispatcher in js/node_helper.js passes every inbound object payload through replaceSecretPlaceholder in js/server_functions.js before invoking socketNotificationReceived. A client connected to a loaded module namespace can submit a SECRET_API_KEY placeholder, causing the server to replace it with the corresponding process environment value. The default weather helper accepts INIT_WEATHER, copies the attacker-controlled instanceId, and returns it in WEATHER_ERROR, providing an echo path for the expanded secret. This reverses the intended one-way redaction boundary and can disclose API tokens, credentials, or service keys stored in SECRET_ variables. This issue is fixed in version 2.37.0. | ||||