Export limit exceeded: 366011 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 366011 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366011 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-60090 | 2 Mervinpraison, Praison | 2 Praisonai, Praisonai | 2026-07-14 | 9.8 Critical |
| PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store create_collection() backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value (declared as int but not enforced at runtime) is interpolated directly into the vector column of the generated CREATE TABLE DDL. A caller able to influence collection-creation dimensions can pass a string such as '3); DROP TABLE tenant_secrets; --' to inject SQL/CQL tokens into the statement executed by the database driver. | ||||
| CVE-2026-61445 | 2 Mervinpraison, Praison | 2 Praisonai, Praisonai | 2026-07-14 | 9.9 Critical |
| PraisonAI before 4.6.78 contains arbitrary file write and command execution vulnerabilities in the AICoder component due to missing path validation and command sanitization in LLM tool calls. Attackers can inject malicious prompts through the chat interface to write files to arbitrary filesystem locations and execute arbitrary shell commands with root privileges. | ||||
| CVE-2026-61858 | 1 Imagemagick | 1 Imagemagick | 2026-07-14 | 3.3 Low |
| ImageMagick before 7.1.2-26 contains a policy bypass vulnerability in the APNG encoder and external delegates due to missing validation checks. Attackers can write files to disallowed paths by bypassing configured policy restrictions through the APNG encoding process. | ||||
| CVE-2026-15473 | 1 Eleveo | 1 Call Recording Software | 2026-07-14 | 6.3 Medium |
| A vulnerability was identified in Eleveo Call Recording Software 9.7.0. This issue affects some unknown processing of the file /callrec/restoreCallAction.do of the component Recorded Calls Page. The manipulation leads to improper authorization. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-56259 | 1 Crawl4ai | 1 Crawl4ai | 2026-07-14 | 8.2 High |
| Crawl4AI before 0.8.8 contains credential exfiltration vulnerabilities in the Docker API server that allow attackers to redirect LLM API calls to attacker-controlled endpoints and read arbitrary environment variables. Attackers can exploit the unauthenticated /md, /llm, and /llm/job endpoints by supplying a malicious base_url parameter and setting api_token to env:VARIABLE_NAME to exfiltrate provider API keys and server secrets including JWT SECRET_KEY for authentication bypass. | ||||
| CVE-2026-56336 | 1 Cap-go | 1 Cap-go | 2026-07-14 | 5.3 Medium |
| Capgo before 12.128.2 contains an information disclosure vulnerability in the unauthenticated /private/sso/check-domain endpoint that returns internal org_id and provider_id values. Attackers can enumerate email domains to build mappings of domains to organization UUIDs and SSO provider identifiers, enabling reconnaissance against Capgo tenants. | ||||
| CVE-2026-15552 | 1 Ragic | 1 Enterprise Cloud Database | 2026-07-14 | 6.1 Medium |
| Enterprise Cloud Database developed by Ragic has a Stored Cross-Site Scripting vulnerability, allowing unauthenticated remote attackers to inject persistent JavaScript code executed in users' browsers upon page load. | ||||
| CVE-2026-15553 | 1 Ragic | 1 Enterprise Cloud Database | 2026-07-14 | 5.3 Medium |
| Enterprise Cloud Database developed by Ragic has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload malicious files and make them available for users to download. | ||||
| CVE-2026-10037 | 1 Canonical | 1 Ubuntu | 2026-07-14 | 8.8 High |
| A sandbox escape vulnerability exists in the OpenJDK packages provided in Ubuntu. The .jar MIME handlers installed by these packages execute files marked as executable when the mailcap package is installed. A compromised or malicious sandboxed application with access to the OpenURI portal via xdg-desktop-portal-gtk can write a malicious .jar file to the host file system, set its executable bit, and trigger the handler to execute arbitrary code outside of the sandbox environment. | ||||
| CVE-2026-9492 | 1 Gigabyte | 1 Mbstorage | 2026-07-14 | 7.8 High |
| The MBStorage DRAM lighting control module within Gigabyte Control Center (GCC) developed by GIGABYTE Technology has an Improper Access Control vulnerability. Authenticated local attackers can send specific IOCTL commands through the driver MyPortIO_x64.sys bundled with the module, thereby arbitrarily reading and writing physical memory and obtaining kernel-level privileges. | ||||
| CVE-2026-57830 | 2026-07-14 | N/A | ||
| The Joomla extension Helix Ultimate is vulnerable to an unauthenticated arbitrary file deletion. | ||||
| CVE-2026-61465 | 1 Imagemagick | 1 Imagemagick | 2026-07-14 | 3.3 Low |
| ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service. | ||||
| CVE-2026-9571 | 1 Mattermost | 1 Mattermost | 2026-07-14 | 5.9 Medium |
| Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to invalidate OAuth refresh tokens upon user account deactivation, which allows a deactivated user or an attacker in possession of a valid refresh token to obtain new functional access tokens via the OAuth refresh token grant endpoint.. Mattermost Advisory ID: MMSA-2026-00680 | ||||
| CVE-2026-62143 | 1 Misp | 1 Misp-modules | 2026-07-14 | N/A |
| A Server-Side Request Forgery (SSRF) protection bypass existed in the html_to_markdown expansion module of misp-modules. The module attempts to prevent requests to loopback, private, link-local, and other restricted IP address ranges. However, IP addresses were compared against the blocked ranges without first normalising IPv4-mapped IPv6 addresses. An authenticated attacker able to invoke the module could supply an IPv4-mapped IPv6 address, such as: http://[::ffff:127.0.0.1]/ http://[::ffff:169.254.169.254]/ Alternatively, the attacker could use a hostname that resolves to an IPv4-mapped IPv6 address. These addresses were treated as IPv6 addresses and therefore did not match the corresponding blocked IPv4 ranges. Successful exploitation could cause the misp-modules server to connect to services available through its loopback interface, internal network, or link-local network. This could expose internal web services, administrative interfaces, or cloud instance metadata, with retrieved content potentially returned to the attacker as converted Markdown. The vulnerability has been addressed by normalising IPv4-mapped IPv6 addresses to their underlying IPv4 representation before applying the blocked-range checks. URLs without a valid hostname are now also rejected. | ||||
| CVE-2026-10103 | 1 Mattermost | 1 Mattermost | 2026-07-14 | 4.3 Medium |
| Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to verify post ownership in the shared channel inbound sync handler, which allows an authenticated remote cluster to modify or delete posts authored by local users or other remotes via crafted sync messages referencing arbitrary post IDs in channels shared with that remote.. Mattermost Advisory ID: MMSA-2026-00689 | ||||
| CVE-2026-0275 | 1 Palo Alto Networks | 1 Prisma Browser | 2026-07-14 | N/A |
| A local privilege escalation vulnerability in Palo Alto Networks Prisma® Browser allows a locally authenticated administrator with access to the macOS local filesystem to perform actions on the device with root privileges. This issue only affects Prisma® Browser on macOS. | ||||
| CVE-2026-15584 | 1 Redhat | 1 Pdrive Lightspeed | 2026-07-14 | 7.5 High |
| A privilege escalation vulnerability was found in the incluster-checks tool for OpenShift. The tool creates privileged debug pods with host filesystem access in the shared default namespace, where any user with the standard edit role can exec into them and obtain root access on cluster nodes. | ||||
| CVE-2026-61498 | 1 Vitec | 1 Flamingo | 2026-07-14 | 9.8 Critical |
| Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access. | ||||
| CVE-2026-0276 | 1 Palo Alto Networks | 1 Cortex Xdr Broker Vm | 2026-07-14 | N/A |
| A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions as the root user. | ||||
| CVE-2026-6847 | 1 4real | 1 Themisnetpanel | 2026-07-14 | N/A |
| Remote Code Execution vulnerability exists in ThemisNETPanel due to missing authentication for a critical file upload function. The application exposes an endpoint that allows unauthenticated attackers to upload arbitrary PHP files by providing a base64-encoded payload and to execute arbitrary code on the underlying server. This issue has been fixed by a patch released in April 2026. | ||||