Export limit exceeded: 378152 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 378152 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (378152 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72970 | 1 Microsoft | 1 Edge Chromium | 2026-08-14 | 8.3 High |
| Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-58314 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.7 High |
| Two SSRF findings in Gitea 1.26.2 | ||||
| CVE-2026-58434 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.5 High |
| Private Repository Metadata Remains Accessible After Access Revocation | ||||
| CVE-2026-73849 | 1 Emlog | 1 Emlog | 2026-08-14 | 9.8 Critical |
| Emlog is an open source website building system. In 2.6.26 and earlier, install.php accepts action=reinstall without authentication and deliberately skips the already-installed check because the guard runs only when $act != 'reinstall'. A remote attacker can submit hostname, dbuser, dbpasswd, dbname, dbprefix, username, password, and email values to cause file_put_contents('config.php', $config) to overwrite the configuration with attacker-controlled database settings and create a new administrator account. No fixed version is available as of this review. | ||||
| CVE-2026-50105 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.3 Medium |
| RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | ||||
| CVE-2026-39925 | 2026-08-14 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-19910 | 2026-08-14 | N/A | ||
| PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the application installer. The issue results from the lack of proper verification of a cryptographic signature before installing an application. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-30585. | ||||
| CVE-2026-19908 | 2026-08-14 | N/A | ||
| PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the XCB daemon. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-30584. | ||||
| CVE-2026-19909 | 2026-08-14 | N/A | ||
| PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of AIP files. By creating a symbolic link, an attacker can abuse the installer process to write arbitrary files. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of root. Was ZDI-CAN-30583. | ||||
| CVE-2026-19636 | 1 Tenable | 1 Security Center | 2026-08-14 | 5.3 Medium |
| An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation. | ||||
| CVE-2026-59124 | 1 Microsoft | 2 Windows App, Windows App Client For Windows Desktop | 2026-08-14 | 9.8 Critical |
| Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-73680 | 2026-08-14 | 8.8 High | ||
| Cockpit CMS 2.14.0 and prior contains a command injection vulnerability in the FFmpeg integration that allows authenticated users with only the assets/upload permission to execute arbitrary commands by uploading a video file with a shell metacharacter-laden filename. The unsanitized filename is interpolated into a shell command executed via Process::fromShellCommandline() before the slugify() sanitizer runs, enabling injected shell metacharacters such as backticks, $(), and semicolons to escape the FFmpeg command context and execute as the web-server user. | ||||
| CVE-2026-54481 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.5 High |
| Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) | ||||
| CVE-2026-55982 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 9.1 Critical |
| OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes | ||||
| CVE-2026-55984 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 2.7 Low |
| Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service | ||||
| CVE-2026-58427 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.5 High |
| Private org member list leaked via /members API endpoint — incomplete fix for PR #38145 | ||||
| CVE-2026-58429 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.9 Medium |
| Public-Only Personal access tokens scope bypass in Organization and Permission Endpoints | ||||
| CVE-2026-73850 | 1 Emlog | 1 Emlog | 2026-08-14 | N/A |
| Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php. | ||||
| CVE-2026-33818 | 1 Go Standard Library | 1 Encoding/asn1 | 2026-08-14 | 7.5 High |
| Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. | ||||
| CVE-2026-19847 | 1 Totolink | 2 A800r, A800r Firmware | 2026-08-14 | 8.8 High |
| A security flaw has been discovered in TOTOLINK A800R 4.1.2cu.5137_B20200730. Affected is the function setWiFiWpsConfig of the file /cgi-bin/cstecgi.cgi of the component wps.so. The manipulation of the argument pin results in stack-based buffer overflow. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. | ||||