Export limit exceeded: 397405 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (397405 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55610 | 1 Invoiceshelf | 1 Invoiceshelf | 2026-09-23 | 8.7 High |
| InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to version 2.4.1, in InvoiceShelf's multi-company installations, any user who is an Owner of one company can read and overwrite any user account in any other company on the same installation. `GET/PUT /api/v1/users/{user}` resolves the target `User` by global primary key, and `UserPolicy` checks only that the requester owns their own header-company — it never verifies that the target user belongs to that company. This allows cross-tenant disclosure of user data and full account takeover (email/password overwrite + company re-assignment). Version 2.4.1 fixes the issue. | ||||
| CVE-2026-54253 | 1 Joni1802 | 1 Ts3 Manager | 2026-09-23 | 8.2 High |
| TS3 Manager is modern web interface for maintaining Teamspeak3 servers. Prior to 2.2.6, the /api/download handler in packages/server/routes/api.js passes the attacker-controlled port query parameter to socket.connect(port, host) and returns the resulting error.message through res.status(400).send(error.message) as text/html without a Content Security Policy. When a logged-in operator follows a crafted top-level link, the reflected value executes in the manager origin. The token cookie set in packages/ui/src/store/modules/query.js lacks HttpOnly, Secure, and an explicit SameSite attribute, allowing the script to read the token and call the autofillform event in packages/server/socket.js. autofillform returns the decoded JWT, including the cleartext ServerQuery password, enabling operator-session hijacking and control of the managed TeamSpeak server when the operator uses administrative ServerQuery credentials. A valid operator session and user interaction are required. This issue is fixed in 2.2.6. | ||||
| CVE-2026-19179 | 1 Ibm | 1 Financial Transaction Manager Ftmfor Redhat Openshift | 2026-09-23 | 8.2 High |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression. | ||||
| CVE-2026-18490 | 1 Ibm | 2 Financial Transaction Manager (ftm) for Redhat Openshift, Financial Transaction Manager Ftmfor Redhat Openshift | 2026-09-23 | 8.8 High |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to unauthenticated remote code execution via Java native deserialization on the PayDir Business Rules Manager RMI SSL endpoint (BrmRMISSLServerSocketFactory.java:95, EP8). An adjacent-network attacker can deliver a crafted serialized payload to achieve arbitrary code execution, exposing all PayDir credentials and enabling manipulation of payment business rules. | ||||
| CVE-2026-12751 | 1 Ibm | 1 Cloud Pak For Business Automation | 2026-09-23 | 5.4 Medium |
| IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site. | ||||
| CVE-2026-94124 | 2 Levelfourdevelopment, Wordpress | 2 Wp-easycart, Wordpress | 2026-09-23 | 8.5 High |
| Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. | ||||
| CVE-2026-95601 | 2 Wbw Plugins, Wordpress | 2 Product Filter By Wbw, Wordpress | 2026-09-23 | 9.3 Critical |
| Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. | ||||
| CVE-2026-94080 | 2 Webwizards, Wordpress | 2 Marketking, Wordpress | 2026-09-23 | 5.3 Medium |
| Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. | ||||
| CVE-2026-95586 | 2 Themefic, Wordpress | 2 Ultimate Addons For Contact Form 7, Wordpress | 2026-09-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. | ||||
| CVE-2026-12750 | 1 Ibm | 1 Cloud Pak For Business Automation | 2026-09-23 | 6.4 Medium |
| IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2026-12749 | 1 Ibm | 1 Cloud Pak For Business Automation | 2026-09-23 | 6.4 Medium |
| IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2026-78227 | 1 Nlnetlabs | 1 Unbound | 2026-09-23 | 6.5 Medium |
| NLnet Labs Unbound 1.22.0 up to and including 1.26.1, has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer that holds the DNS response. ngtcp2's retransmission buffer keeps a shallow pointer into the output buffer for as long as a STREAM frame may be resent. On a client RESET_STREAM, the output buffer is freed but ngtcp2 still holds the matching retransmission entries. The next PTO timeout makes ngtcp2 re-encode the STREAM frame and copy from the freed buffer. A malicious actor that can query Unbound over DoQ and that withholds ACKs, sends RESET_STREAM, and waits for PTO, reaches this use-after-free with no privilege. This leads to retransmissions against freed memory and eventually an abnormal server exit under a 20-query spray. | ||||
| CVE-2026-69528 | 1 Microsoft | 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more | 2026-09-23 | 7.8 High |
| Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69517 | 1 Microsoft | 18 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 15 more | 2026-09-23 | 7 High |
| Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69512 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-23 | 8 High |
| Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69511 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-23 | 8.8 High |
| Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69509 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-09-23 | 7.8 High |
| Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69508 | 1 Microsoft | 6 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-09-23 | 7.8 High |
| Stack-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69500 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-23 | 7 High |
| Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-52744 | 1 Gocd | 1 Gocd | 2026-09-23 | N/A |
| GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authenticated user can retrieve inter-pipeline dependency hierarchy details and user-defined pipeline, stage, job, and artifact plugin reference names that the user cannot otherwise view in the UI. The endpoint is read-only and does not permit modification of pipeline data. This issue is fixed in version 26.1.0. | ||||