Export limit exceeded: 383130 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 383130 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (383130 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76845 | 2 Adm-zip Project, Cthackers | 2 Adm-zip, Adm-zip | 2026-08-24 | 6.5 Medium |
| adm-zip 0.5.9 through 0.6.0 follows symbolic links at the extraction destination. Utils.sanitize in util/utils.js enforces containment by comparing only the string form of an archive entry name against the resolved extraction root, and Utils.writeFileTo opens the computed destination with fs.openSync(path, "w", 0o666), which resolves symbolic links and carries neither O_NOFOLLOW nor a pre-write fs.lstatSync check. When a path component at the destination already exists as a symbolic link pointing outside the extraction root, extractAllTo, extractAllToAsync and extractEntryTo write the entry contents through that link and then chmod its target, placing attacker-controlled content in a file outside the root without any traversal sequence appearing in the archive. Reaching the write requires overwrite to be enabled, because the preceding fs.existsSync check also resolves the link and otherwise declines. An attacker able to create a symbolic link inside a shared, reused or predictable extraction directory, such as a temporary directory or a continuous integration workspace, can overwrite any file the extracting process is permitted to write. | ||||
| CVE-2026-21751 | 1 Hcltech | 1 Hive | 2026-08-24 | 7.4 High |
| HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise or widespread credential leakage if a single internal component is breached. | ||||
| CVE-2025-68833 | 1 Hcltech | 1 Hive | 2026-08-24 | 5.3 Medium |
| HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources. | ||||
| CVE-2026-21755 | 1 Hcltech | 1 Hive | 2026-08-24 | 5.3 Medium |
| HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attacks, or cause a denial of service. | ||||
| CVE-2026-19874 | 1 Konami | 1 Metal Gear Online 3 | 2026-08-24 | 9.1 Critical |
| A heap-based buffer overflow vulnerability exists in Konami's Metal Gear Online 3, originating from improper validation of lobby data fields related to kicked players. The affected function processes a list of kicked player identifiers using the lobby data key "kick_num" to determine the number of entries, and individual kicked player IDs supplied via keys in the format "kicked_id_%i". The function does not validate that "kick_num" falls within the expected bounds. The game design limits matches to a maximum of 16 players, and the corresponding buffer for storing kicked player IDs is sized accordingly. If "kick_num" exceeds this limit, the function continues writing the provided player IDs past the end of the intended buffer and into adjacent memory regions. These adjacent regions contain Steam callback handler structures responsible for processing lobby data updates, lobby messages, and other related events. By supplying an oversized "kick_num" value and appropriate "kicked_id_%i" fields, an attacker can overwrite fields within the callback handler structures, including function pointers and callback argument values. Successful exploitation may enable control-flow hijacking, potentially allowing arbitrary code execution within the game process. | ||||
| CVE-2026-76070 | 1 Netis-systems | 1 Nc63 | 2026-08-24 | 9.8 Critical |
| Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by submitting an oversized Base64-encoded password to the login handler in /bin/netis.cgi. Attackers can exploit the custom Base64 decoder's lack of output length validation against the fixed-size stack buffer to achieve remote code execution with root privileges, as the Boa web server executes the CGI environment as root. | ||||
| CVE-2026-76071 | 1 Netis-systems | 1 Nc63 | 2026-08-24 | 9.8 Critical |
| Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers to overwrite saved stack state by supplying an oversized destHost parameter to the ipFilterList=mod action in netis.cgi. Attackers can exploit widthless sscanf conversions that copy user-supplied input into fixed-size stack buffers before authentication is verified, achieving remote code execution as root due to the Boa web server executing the CGI environment with root privileges. | ||||
| CVE-2026-12554 | 1 Hp Inc | 1 Hp Easy Start For Macos | 2026-08-24 | N/A |
| Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities. | ||||
| CVE-2026-12555 | 1 Hp Inc | 1 Hp Easy Start For Macos | 2026-08-24 | N/A |
| Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities. | ||||
| CVE-2026-12556 | 1 Hp Inc | 1 Hp Easy Start For Macos | 2026-08-24 | N/A |
| Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities. | ||||
| CVE-2026-78465 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-08-24 | 7 High |
| A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of planes to 4 alongside sufficiently large dimensions, the calculation exceeds the 32-bit integer limit and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when the plugin subsequently writes image data into the undersized buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service. | ||||
| CVE-2026-15469 | 1 Tp-link | 3 Deco Xe75 V3, We10800 V3.6, Xe5300 V3.6 | 2026-08-24 | N/A |
| The use of hard-coded cryptographic key vulnerability has been identified in the mesh functionality of Deco XE75 v3, XE5300 v3.6 and WE10800 v3.6. A shared RSA-512 mesh group private key is present in the affected firmware and is used by the mesh protocol for node authentication. An attacker who obtains the firmware image and has local network access may be able to authenticate as a mesh node without possessing a device-specific credential. Successful exploitation may allow an unauthenticated adjacent attacker to impersonate a trusted mesh node and bypass mesh node authentication, which may permit unauthorized changes to device or mesh configuration, affecting confidentiality, integrity and availability. | ||||
| CVE-2026-71907 | 1 Draytek | 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more | 2026-08-24 | 7.2 High |
| Multiple DrayTek VigorAP models contain a command injection vulnerability in the setcamset function. The vulnerability is caused by insufficient filtering of the selectSlaves field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface. | ||||
| CVE-2026-71909 | 1 Draytek | 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more | 2026-08-24 | 7.2 High |
| Multiple DrayTek VigorAP models contain a command injection vulnerability in the InquierTime function. The vulnerability is caused by insufficient filtering of the time field before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface. | ||||
| CVE-2026-71912 | 1 Draytek | 12 Vigorap 1060c, Vigorap 1060c Firmware, Vigorap 903 and 9 more | 2026-08-24 | 7.2 High |
| Multiple DrayTek VigorAP models contain a buffer overflow vulnerability in the apautotest function. The vulnerability is caused by missing length checks during memory copy operations involving the CMD6 field. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface. | ||||
| CVE-2026-78475 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-08-24 | 6.1 Medium |
| A flaw was found in the file-pix (ESM) plugin in GIMP. When processing a specially crafted PIX image file, the plugin allocates a Variable-Length Array (VLA) on the stack without proper bounds checking, causing an unbounded stack allocation followed by a 21-byte stack over-read. This can result in a denial of service due to stack exhaustion and a limited information disclosure of stack memory contents into an intermediate file. | ||||
| CVE-2026-9254 | 1 Tp-link | 3 Archer Ax75 V1, Archer Be3600 V1, Archer Be800 V1 | 2026-08-24 | N/A |
| An unauthenticated OS command injection vulnerability exists in the parental control functionality of Archer BE800 V1, BE3600 V1, and AX75 V1 due to improper filtering and neutralization of special characters in certain parameters. A LAN-based attacker can inject arbitrary commands and execute them with root privileges. Successful exploitation may result in complete device compromise and impact the confidentiality, integrity, and availability of the affected device and network traffic. | ||||
| CVE-2026-16348 | 1 Tp-link | 1 Archer Be800 V1 | 2026-08-24 | N/A |
| An authenticated command injection vulnerability in TP-Link Archer BE800 V1 allows an attacker with administrative access to execute arbitrary system commands with root privileges by injecting shell metacharacters via a VPN connection. Successful exploitation may enable persistent backdoors, credential theft, LAN reconnaissance, and router-assisted attacks against connected devices. | ||||
| CVE-2026-78541 | 1 Tp-link | 1 Archer Be3600 V1 | 2026-08-24 | N/A |
| A stored OS command injection vulnerability exists in the parent-control module of TP-Link Archer BE3600 V1. An authenticated adjacent attacker with administrative access may store a crafted profile name containing shell metacharacters, which is later processed unsafely during daily cloud report generation and may result in arbitrary command execution. Successful exploitation may allow command execution on the affected device with potential impact to device confidentiality, integrity, and availability. | ||||
| CVE-2026-66786 | 1 Submariner | 1 Submariner | 2026-08-24 | 9.1 Critical |
| A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource Definition (CRD) without proper validation. A malicious cluster can exploit this by publishing a CableName that includes newlines and ipsec.conf directives. This allows an attacker to inject arbitrary configuration parameters or execute commands through leftupdown hooks, leading to remote code execution as root on the gateway node. | ||||