Export limit exceeded: 389995 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389995 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84282 | 1 Onlyoffice | 1 Onlyoffice Owncloud Integration Plugin | 2026-09-11 | 6.5 Medium |
| A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/ajax/settings/address endpoint does not sufficiently validate the user-supplied Document Server URL before initiating outbound connections. An authenticated administrator can manipulate the document server parameter to cause the ownCloud server to send arbitrary requests to attacker-controlled destinations, including localhost and internal network hosts. This allows internal network reconnaissance and TCP port scanning based on differences in server responses. | ||||
| CVE-2026-28583 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28584 | 2026-09-11 | 5.5 Medium | ||
| In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-79908 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-11 | 7.8 High |
| Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-81994 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-11 | 8.2 High |
| Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-85150 | 2 Freedesktop, Redhat | 2 Gstreamer, Enterprise Linux | 2026-09-11 | 7.5 High |
| A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity. | ||||
| CVE-2026-28594 | 1 Google | 1 Android | 2026-09-11 | 7.8 High |
| In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28602 | 2026-09-11 | 7.8 High | ||
| In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-52097 | 2026-09-11 | 6.8 Medium | ||
| An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, _afLaunchLocalUri (url_launcher.dart), OpenFilex.open, localPathRegex (common_patterns.dart) components | ||||
| CVE-2025-57231 | 2026-09-11 | N/A | ||
| Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url. | ||||
| CVE-2026-71640 | 2026-09-11 | N/A | ||
| An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via improper handling of expired trajectory data in the replanning pipeline | ||||
| CVE-2026-63427 | 1 Lenovo | 1 Software Fix | 2026-09-11 | 7.8 High |
| An authentication bypass vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges. | ||||
| CVE-2026-19136 | 1 Lenovo | 1 Tianxi Ai Agent Pc Application | 2026-09-11 | 7.8 High |
| A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application. | ||||
| CVE-2026-18994 | 1 Lenovo | 1 File Manager Application | 2026-09-11 | 7.1 High |
| A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the Chinese market, that could allow a local authenticated user to read or modify protected files within the application. | ||||
| CVE-2026-78133 | 1 Strongswan | 1 Strongswan | 2026-09-11 | 7.5 High |
| libcharon in strongSwan 6.0.0 through 6.0.7 has a use-after-free in IKEv2 rekeying collision handling. | ||||
| CVE-2026-28652 | 2026-09-11 | 3.1 Low | ||
| In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-45519 | 2026-09-11 | 3.3 Low | ||
| In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49895 | 2026-09-11 | 3.5 Low | ||
| In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-71808 | 2026-09-11 | 8.8 High | ||
| A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands via the ${} string concatenation in AdminMapper.java and multiple other Mapper files (including MerchantWithdrawRecordMapper.java and MemberWithdrawRecordMapper.java). | ||||
| CVE-2026-79522 | 1 Gpac | 1 Gpac | 2026-09-11 | 6.5 Medium |
| An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request. Fixed in 2fd5a06ab226767900fd86edb5a1e8bfc1010640. | ||||