Export limit exceeded: 364053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 18983 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 364053 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (364053 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14535 | 1 Trailofbits | 1 Fickling | 2026-07-07 | 8.8 High |
| In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.shorten_code(node) on every import node it inspects, regardless of whether the import is flagged as unsafe. This call registers the shortened code representation in the shared AnalysisContext.reported_shortened_code set. When the MLAllowlist analysis pass subsequently runs, it calls the same shorten_code() method, receives already_reported=True for every import, and executes a continue statement that skips its allowlist check entirely. This renders MLAllowlist dead code for all imports — it never evaluates whether an import is in the ML allowlist or not. The MLAllowlist pass was designed to catch imports of modules outside the known-safe ML ecosystem (torch, numpy, transformers, etc.) that slip past the UnsafeImports denylist. With MLAllowlist inoperative, any standard library module not in the UNSAFE_IMPORTS denylist can be invoked via pickle deserialization while fickling's check_safety() returns LIKELY_SAFE. The fickling.load() API chains check_safety() into pickle.loads() as an explicit security gate, meaning a LIKELY_SAFE verdict causes the payload to be deserialized and executed. The root cause is shared mutable state between independently-correct analysis passes — UnsafeImportsML works as designed in isolation, MLAllowlist works as designed in isolation, but the shared reported_shortened_code set causes UnsafeImportsML to poison MLAllowlist's deduplication logic. | ||||
| CVE-2026-48951 | 2026-07-07 | N/A | ||
| Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | ||||
| CVE-2026-48953 | 2026-07-07 | N/A | ||
| Lack of escaping leads to an XSS vulnerability in the generic image output layout. | ||||
| CVE-2026-48948 | 2026-07-07 | N/A | ||
| An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. | ||||
| CVE-2026-48949 | 2026-07-07 | N/A | ||
| Lack of validation leads to an XSS vulnerability in the MFA management views. | ||||
| CVE-2026-48954 | 2026-07-07 | N/A | ||
| Improper validation leads to a generic XSS vector in the language override feature. | ||||
| CVE-2026-48955 | 2026-07-07 | N/A | ||
| An improper access check allows unauthorized users to access workflow stage and transition information. | ||||
| CVE-2026-48950 | 2026-07-07 | N/A | ||
| Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | ||||
| CVE-2026-48957 | 2026-07-07 | N/A | ||
| An improper access check allows unauthorized users to access com_privacy datasets. | ||||
| CVE-2026-48958 | 2026-07-07 | N/A | ||
| An improper access check allows unauthorized users to create custom fields via webservices endpoints. | ||||
| CVE-2026-48956 | 2026-07-07 | N/A | ||
| An improper access check allows users to display a list of modules in the frontend. | ||||
| CVE-2026-48947 | 2026-07-07 | N/A | ||
| An improper access check allows privileged users to overwrite media files without editing permissions. | ||||
| CVE-2026-48952 | 2026-07-07 | N/A | ||
| Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | ||||
| CVE-2026-14742 | 1 Langchain-ai | 1 Langgraph | 2026-07-07 | 3.1 Low |
| A vulnerability was determined in langchain-ai langgraph up to 1.2.4. The affected element is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the component Task Result Cache. This manipulation of the argument default_cache_key causes use of weak hash. The attack is possible to be carried out remotely. The complexity of an attack is rather high. The exploitability is described as difficult. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2021-30004 | 1 W1.fi | 2 Hostapd, Wpa Supplicant | 2026-07-07 | 4.3 Medium |
| In wpa_supplicant and hostapd 2.9, forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c. | ||||
| CVE-2026-42009 | 2 Gnu, Redhat | 26 Gnutls, Ai Inference Server, Discovery and 23 more | 2026-07-07 | 7.5 High |
| A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service. | ||||
| CVE-2026-42010 | 2 Gnu, Redhat | 15 Gnutls, Ai Inference Server, Discovery and 12 more | 2026-07-07 | 7.1 High |
| A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process. | ||||
| CVE-2022-30065 | 2 Busybox, Siemens | 13 Busybox, Scalance Sc622-2c, Scalance Sc622-2c Firmware and 10 more | 2026-07-07 | 7.8 High |
| A use-after-free in Busybox 1.35-x's awk applet leads to denial of service and possibly code execution when processing a crafted awk pattern in the copyvar function. | ||||
| CVE-2026-12866 | 1 Silentmatt | 1 Expr-eval | 2026-07-07 | 9.8 Critical |
| All versions of the package expr-eval are vulnerable to Code Execution via the toJSFunction() API. An attacker can execute arbitrary JavaScript by supplying crafted expressions that are compiled into native code using new Function(). Because user-controlled expressions are transformed directly into executable JavaScript, attackers can escape the intended expression sandbox and run arbitrary code within the application's context. | ||||
| CVE-2025-59617 | 1 Qualcomm | 1 Snapdragon | 2026-07-07 | 6.6 Medium |
| Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input. | ||||