Export limit exceeded: 404302 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (404302 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-37347 | 1 Sourcecodester | 1 Payroll Management And Information System | 2026-04-17 | 9.1 Critical |
| SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_employee.php. | ||||
| CVE-2026-37345 | 1 Sourcecodester | 1 Vehicle Parking Area Management System | 2026-04-17 | 9.8 Critical |
| SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manage_park.php. | ||||
| CVE-2026-37338 | 1 Sourcecodester | 1 Simple Music Cloud Community System | 2026-04-17 | 9.4 Critical |
| SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_user.php. | ||||
| CVE-2026-37336 | 1 Sourcecodester | 1 Simple Music Cloud Community System | 2026-04-17 | 7.3 High |
| SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/view_music.php. | ||||
| CVE-2026-37346 | 1 Sourcecodester | 1 Payroll Management And Information System | 2026-04-17 | 4.7 Medium |
| SourceCodester Payroll Management and Information System v1.0 is vulnerable to SQL Injection in the file /payroll/view_account.php?emp_id=. | ||||
| CVE-2026-34722 | 1 Zammad | 1 Zammad | 2026-04-17 | 4.3 Medium |
| Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4. | ||||
| CVE-2026-4832 | 1 Schneider-electric | 25 Easergy P14x, Easergy P24x, Easergy P341 and 22 more | 2026-04-17 | N/A |
| CWE-798 Use of Hard-coded Credentials vulnerability exists that could cause unauthorized access to sensitive device information when an unauthenticated attacker is able to interrogate the SNMP port. | ||||
| CVE-2026-4914 | 1 Ivanti | 1 Neurons For Itsm | 2026-04-17 | 5.4 Medium |
| Stored XSS in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to obtain limited information from other user sessions. User interaction is required. | ||||
| CVE-2026-4913 | 1 Ivanti | 1 Neurons For Itsm | 2026-04-17 | 5.7 Medium |
| Improper protection of an alternate path in Ivanti N-ITSM before version 2025.4 allows a remote authenticated attacker to retain access when their account has been disabled. | ||||
| CVE-2026-30617 | 1 Langchain | 1 Langchain | 2026-04-17 | 8.6 High |
| LangChain-ChatChat 0.3.1 contains a remote code execution vulnerability in its MCP STDIO server configuration and execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and arguments. When the MCP server is started and MCP is enabled for agent execution, subsequent agent activity triggers execution of arbitrary commands on the server. Successful exploitation allows arbitrary command execution within the context of the LangChain-ChatChat service. | ||||
| CVE-2026-30616 | 1 Jaaz | 1 Jaaz | 2026-04-17 | 7.3 High |
| Jaaz 1.0.30 contains a remote code execution vulnerability in its MCP STDIO command execution handling. A remote attacker can send crafted network requests to the network-accessible Jaaz application, causing attacker-controlled commands to be executed on the server. Successful exploitation results in arbitrary command execution within the context of the Jaaz service, potentially allowing full compromise of the affected system. | ||||
| CVE-2026-30615 | 1 Windsurf | 1 Windsurf | 2026-04-17 | 8 High |
| A prompt injection vulnerability in Windsurf 1.9544.26 allows remote attackers to execute arbitrary commands on a victim system. When Windsurf processes attacker-controlled HTML content, malicious instructions can cause unauthorized modification of the local MCP configuration and automatic registration of a malicious MCP STDIO server, resulting in execution of arbitrary commands without further user interaction. Successful exploitation may allow attackers to execute commands on behalf of the user, persist malicious MCP configuration changes, and access sensitive information exposed through the application. | ||||
| CVE-2026-20152 | 1 Cisco | 1 Secure Web Appliance | 2026-04-17 | 5.3 Medium |
| A vulnerability in the authentication service feature of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attacker to bypass authentication policy requirements. This vulnerability is due to improper validation of user-supplied authentication input in HTTP requests. An attacker could exploit this vulnerability by sending HTTP requests that contain specific authentication requests to an affected device. A successful exploit could allow the attacker to bypass policy enforcement on the device. There is no direct impact to the Cisco Secure Web Appliance. However, as a result of exploiting this vulnerability, an attacker could send HTTP requests that should be restricted through the device. | ||||
| CVE-2026-4135 | 1 Lenovo | 1 Software Fix | 2026-04-17 | 6.6 Medium |
| During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges. | ||||
| CVE-2026-30364 | 1 Ttrftech | 1 Centsdr | 2026-04-17 | 7.5 High |
| CentSDR commit e40795 was discovered to contain a stack overflow in the "Thread1" function. | ||||
| CVE-2026-20205 | 1 Splunk | 1 Mcp Server | 2026-04-17 | 7.2 High |
| In Splunk MCP Server app versions below 1.0.3 , a user who holds a role with access to the Splunk `_internal` index or possesses the high-privilege capability `mcp_tool_admin` could view users session and authorization tokens in clear text.<br><br>The vulnerability would require either local access to the log files or administrative access to internal indexes, which by default only the admin role receives. <br><br>Review roles and capabilities on your instance and restrict internal index access to administrator-level roles. See [Define roles on the Splunk platform with capabilities](https://docs.splunk.com/Documentation/Splunk/latest/Security/Rolesandcapabilities) and [Connecting to MCP Server and Admin settings](https://help.splunk.com/en/splunk-enterprise/mcp-server-for-splunk-platform/connecting-to-mcp-server-and-admin-settings) in the Splunk documentation for more information. | ||||
| CVE-2026-20170 | 1 Cisco | 1 Cisco Webex Contact Center | 2026-04-17 | 6.1 Medium |
| A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed an unauthenticated, remote attacker to conduct cross-site scripting attacks. Cisco has addressed this vulnerability in the Cisco Webex Contact Center service, and no customer action is needed. This vulnerability existed because HTML and script content was not properly handled. Prior to this vulnerability being addressed, an attacker could have exploited this vulnerability by persuading a user to follow a malicious link. A successful exploit could have allowed the attacker to steal sensitive information from the browser, including authentication and session information. | ||||
| CVE-2026-20132 | 1 Cisco | 1 Identity Services Engine Software | 2026-04-17 | 4.8 Medium |
| Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative write privileges to conduct a stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based management interface of an affected device. These vulnerabilities are due to insufficient sanitization of user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by convincing a user of the interface to click a specific link or view an affected web page. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information. | ||||
| CVE-2024-53412 | 1 Nietthijmen | 1 Shoppingcart | 2026-04-17 | 8.4 High |
| Command injection in the connect function in NietThijmen ShoppingCart 0.0.2 allows an attacker to execute arbitrary shell commands and achieve remote code execution via injection of malicious payloads into the Port field | ||||
| CVE-2026-4134 | 1 Lenovo | 1 Software Fix | 2026-04-17 | 7.3 High |
| During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to execute code with elevated privileges. | ||||