Export limit exceeded: 384953 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (384953 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-52489 | 1 Gpac | 1 Gpac | 2026-08-31 | 7.8 High |
| Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameToImplementationName() function | ||||
| CVE-2026-40465 | 2026-08-31 | 5.3 Medium | ||
| NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL (or redirect) parameter. | ||||
| CVE-2026-40463 | 2026-08-31 | 7.6 High | ||
| WaveSuite is affected by an insufficient role-based access control vulnerability in the CPB Log Files feature. Successful exploitation allows an authenticated low-privilege user to load pages restricted to higher-privilege roles by requesting the corresponding URL directly in the browser. | ||||
| CVE-2026-39113 | 1 Sqlite | 1 Sqlite | 2026-08-31 | 4 Medium |
| Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components | ||||
| CVE-2026-38474 | 2026-08-31 | 5.4 Medium | ||
| GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock. | ||||
| CVE-2026-38467 | 2026-08-31 | 5.4 Medium | ||
| A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with users_mod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to tools.php?action=manage_tags. | ||||
| CVE-2026-38343 | 1 Ffmpeg | 1 Ffmpeg | 2026-08-31 | 6.5 Medium |
| An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file. | ||||
| CVE-2026-30072 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| A NULL pointer dereference in the CDR processing path of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload. | ||||
| CVE-2026-30071 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| An issue in the RechargePut function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-30070 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| An issue in the HandleGetSharedData function of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-30069 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| A NULL pointer dereference in the UDMC registration handler component of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via supplying crafted payload. | ||||
| CVE-2026-30068 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| Improper input validation in the HandleUpdate function (/sbi/parameter_provision.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-30064 | 1 Free5gc | 1 Free5gc | 2026-08-31 | 7.5 High |
| Improper input validation in the buildFilter function (processor/processor.go) of free5gc v4.0.1 allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-82808 | 1 Inbox Foundry | 1 Activeinbox Extension | 2026-08-31 | 7.3 High |
| A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was informed beforehand about the issue. The support explains, that "[a]t the moment, the [bug bounty] programme is on hold while we work through a large number of existing reports." | ||||
| CVE-2026-51672 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51673 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter time synchronization settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51675 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure uplink settings via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51676 | 2026-08-31 | N/A | ||
| Incorrect access control in the setAccessDeviceCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter access-device policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-17615 | 1 Redhat | 10 Apicurio Registry, Build Keycloak, Camel Quarkus and 7 more | 2026-08-31 | 7.5 High |
| A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint that accepts application/xml and returns Source or StreamSource, the server can be tricked into resolving the entity and including sensitive file contents in the HTTP response. This is due to the SourceProvider.writeTo() method creating a SAXParser without disabling external entity resolution, leading to an XML External Entity (XXE) vulnerability. | ||||
| CVE-2026-51719 | 2026-08-31 | N/A | ||
| Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||