Export limit exceeded: 379112 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (379112 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66643 | 2026-08-18 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions. | ||||
| CVE-2026-66641 | 2026-08-18 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions. | ||||
| CVE-2026-66639 | 2026-08-18 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions. | ||||
| CVE-2026-66636 | 2026-08-18 | 6.5 Medium | ||
| Contributor Cross Site Scripting (XSS) in Wise Chat <= 3.4 versions. | ||||
| CVE-2026-66634 | 2026-08-18 | 4.3 Medium | ||
| Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions. | ||||
| CVE-2026-66621 | 2026-08-18 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Ultimate Dashboard <= 3.11.2 versions. | ||||
| CVE-2026-65974 | 1 Frappe | 1 Erpnext | 2026-08-18 | 9.9 Critical |
| ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, limited authenticated users can cross a permission boundary in Frappe safe execution because frappe.render_template is exposed without forcing restrict_globals, allowing server-side template injection and remote code execution. This issue is fixed in versions 15.111.0 and 16.22.0. | ||||
| CVE-2026-64865 | 1 Quantumnous | 1 New-api | 2026-08-18 | N/A |
| New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. Prior to 1.0.0-rc.16, repeated PUT /api/user/self requests that update language or sidebar_modules can race relay billing because controller/user.go calls User.Update and updateUserCache performs a full RedisHSetObj write to user:.Quota, overwriting concurrent HINCRBY deductions and allowing an authenticated user to keep cached quota artificially high. This issue is fixed in version 1.0.0-rc.16. | ||||
| CVE-2026-59909 | 1 Dell | 1 Objectscale | 2026-08-18 | 7.1 High |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering. | ||||
| CVE-2026-59902 | 1 Netty | 1 Netty | 2026-08-18 | 7.5 High |
| Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Final and 4.2.17.Final, io.netty.handler.codec.sctp.SctpMessageCompletionHandler limits incomplete messages and fragment counts but not maxBufferedBytes, allowing unauthenticated peers to exhaust memory with large SCTP fragments. This issue is fixed in versions 4.1.137.Final and 4.2.17.Final. | ||||
| CVE-2026-56090 | 1 Dell | 1 Objectscale | 2026-08-18 | 7.3 High |
| Dell ObjectScale, versions prior to 4.3.0.1, contain(s) an Uncontrolled Search Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. | ||||
| CVE-2026-55674 | 1 Discourse | 1 Discourse | 2026-08-18 | 9.3 Critical |
| Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers. This issue is fixed in versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0. | ||||
| CVE-2026-40506 | 1 Openemr | 1 Openemr | 2026-08-18 | 6.5 Medium |
| OpenEMR before 8.2.0 contains a path traversal vulnerability in the standard_tables_manage.php interface where the db GET parameter is passed without validation to temp_dir_cleanup(), which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers can supply a traversal sequence in the db parameter to resolve outside the intended temporary directory, and by chaining this with an open redirect in dicom_frame.php, an unauthenticated attacker can deliver a crafted URL that triggers arbitrary recursive directory deletion within an authenticated Superuser's session. | ||||
| CVE-2026-32468 | 2026-08-18 | 7.5 High | ||
| Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions. | ||||
| CVE-2026-32463 | 2026-08-18 | 9.9 Critical | ||
| Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions. | ||||
| CVE-2026-28569 | 2026-08-18 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions. | ||||
| CVE-2026-24301 | 1 Microsoft | 1 Copilot Web | 2026-08-18 | 8.8 High |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-19996 | 1 Webkul | 1 Bagisto | 2026-08-18 | 4.3 Medium |
| A vulnerability was identified in Webkul Bagisto up to 2.4.4. This vulnerability affects unknown code of the file /admin/customers of the component Backend Customer Behavior Data Endpoint. Such manipulation of the argument ID leads to improper privilege management. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases." | ||||
| CVE-2026-19988 | 1 Alaev | 1 Seo Tools Extension | 2026-08-18 | 4.3 Medium |
| A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-19982 | 2 Gl-inet, Gl.inet | 4 Be9300, Mt6000, Be9300 and 1 more | 2026-08-18 | 7.4 High |
| A security vulnerability has been detected in GL.iNet BE9300 and MT6000 4.8.x. This vulnerability affects unknown code of the component Firewall-management RPC. The manipulation of the argument dest_port/dest_ip leads to os command injection. The attack may be initiated remotely. Upgrading to version 4.9.0 is able to resolve this issue. The affected component should be upgraded. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist." | ||||