Export limit exceeded: 377116 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377116 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48376 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 5.4 Medium |
| is affected by an Improper Encoding or Escaping of Output vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access, causing a limited disruption to availability. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48384 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 4.9 Medium |
| ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker with high privileges could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48385 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 7.7 High |
| ColdFusion is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-14332 | 2 Ecwid, Wordpress | 2 Ecwid By Lightspeed Ecommerce Shopping Cart, Wordpress | 2026-08-13 | 5.4 Medium |
| The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disconnect the store and take the storefront offline until an administrator reconnects it. | ||||
| CVE-2026-73571 | 1 Zimbra | 1 Collaboration | 2026-08-13 | 3.1 Low |
| An authorization bypass vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.17 due to improper authorization validation in delegated email sending functionality. An authenticated attacker can send specially crafted SOAP requests to impersonate another user and send emails without possessing the required delegation or send-as permissions. This occurs in the SaveDraftRequest SOAP handler. | ||||
| CVE-2026-73357 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-08-13 | 6.5 Medium |
| Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | ||||
| CVE-2026-73403 | 2 Wordpress, Wpeverest | 2 Wordpress, User Registration | 2026-08-13 | 5.3 Medium |
| Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. | ||||
| CVE-2026-73507 | 1 Netty | 1 Netty | 2026-08-13 | 7.5 High |
| Netty is an asynchronous, event-driven network application framework. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.xml.XmlFrameDecoder.decode() failed to preserve closing-tag parser state across invocations, so an unauthenticated remote attacker could trickle-feed repeated </ sequences that repeatedly rescanned the accumulated buffer and exhausted an EventLoop thread's CPU, causing denial of service with a maxFrameLength of 1 MB. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. | ||||
| CVE-2026-73555 | 1 Vllm-project | 1 Vllm | 2026-08-13 | 5.3 Medium |
| vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0. | ||||
| CVE-2026-73556 | 1 Vllm-project | 1 Vllm | 2026-08-13 | 5.3 Medium |
| vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer.RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0. | ||||
| CVE-2026-73558 | 1 Vllm-project | 1 Vllm | 2026-08-13 | 5.3 Medium |
| vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0. | ||||
| CVE-2026-48386 | 1 Adobe | 3 Coldfusion, Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 7.5 High |
| ColdFusion is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-62793 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 5.5 Medium |
| Buffer over-read in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-62786 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 5.5 Medium |
| Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-62799 | 1 Microsoft | 2 Windows 11 26h1, Windows 11 26h1 | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62781 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 8.1 High |
| Heap-based buffer overflow in RPC Runtime allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-62785 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 8.8 High |
| Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-62784 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 8.8 High |
| Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-62797 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 7.8 High |
| Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-62790 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-08-13 | 8.8 High |
| Heap-based buffer overflow in Windows SMB Server allows an authorized attacker to execute code over a network. | ||||