Export limit exceeded: 377350 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377350 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17473 | 1 Ibm | 1 Documentation Offline | 2026-08-13 | 7.5 High |
| IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to read arbitrary files due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-17481 | 1 Ibm | 1 Documentation Offline | 2026-08-13 | 8.8 High |
| IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper output neutralization for logs. | ||||
| CVE-2026-17438 | 1 Ibm | 1 I | 2026-08-13 | 4.4 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to obtain sensitive information or modify data due to improper privilege management. | ||||
| CVE-2026-17075 | 1 Ibm | 1 I | 2026-08-13 | 6.5 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information and perform unauthorized operations due to improper validation of authentication tokens. | ||||
| CVE-2026-46804 | 1 Oracle | 1 Webcenter Content | 2026-08-13 | 8.7 High |
| Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is affected is 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle WebCenter Content, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle WebCenter Content accessible data as well as unauthorized access to critical data or complete access to all Oracle WebCenter Content accessible data. CVSS 3.1 Base Score 8.7 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N). | ||||
| CVE-2026-56968 | 2 Debian, Gnu | 3 Debian Linux, Gnu Sasl, Sasl | 2026-08-13 | 3.7 Low |
| GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server. | ||||
| CVE-2026-14668 | 1 Postgresql | 1 Postgresql | 2026-08-13 | 8.1 High |
| Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. | ||||
| CVE-2026-17226 | 1 Ibm | 1 I | 2026-08-13 | 5.4 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information or cause a denial of service due to an out-of-bounds read. | ||||
| CVE-2026-17216 | 1 Ibm | 1 I | 2026-08-13 | 5.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an integer error when processing DRDA large-object headers. | ||||
| CVE-2026-17212 | 1 Ibm | 1 I | 2026-08-13 | 5.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. | ||||
| CVE-2026-17078 | 1 Ibm | 1 I | 2026-08-13 | 5.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion. | ||||
| CVE-2026-17077 | 1 Ibm | 1 I | 2026-08-13 | 5.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to the use of an uninitialized variable. | ||||
| CVE-2026-73652 | 1 Vantage6 | 1 Vantage6 | 2026-08-13 | N/A |
| vantage6 is an open-source infrastructure for privacy preserving analysis. In version 5.0.2 and earlier, the algorithm-store edit permission lacks an ownership check, allowing one algorithm developer to alter another developer's algorithm while it is pending or under review. The attacker can change metadata including the algorithm image or image tag, causing reviewers and nodes to trust a different image from the one originally submitted for approval. No fixed version is available as of this review. | ||||
| CVE-2026-58510 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | 4.3 Medium |
| GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public->private | ||||
| CVE-2026-42931 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | 6.5 Medium |
| Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint | ||||
| CVE-2026-3639 | 2 Buildwps, Wordpress | 2 Ppwp – Password Protect Pages, Wordpress | 2026-08-13 | 6.4 Medium |
| The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ppwp` shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-19746 | 1 Calix | 1 Gigaspire | 2026-08-13 | 4.3 Medium |
| A vulnerability has been found in Calix GigaSpire 26.1.0. The affected element is an unknown function of the file traceroute.cmd. The manipulation leads to denial of service. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-19376 | 1 Uasoft | 1 Badaso | 2026-08-13 | 7.3 High |
| A vulnerability has been found in Uasoft Badaso 3.0.0-alpha. This vulnerability affects the function ApiRequest::class of the file src/Routes/api.php of the component File API. The manipulation leads to permission issues. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-19371 | 1 Nikolaibibo | 1 Claude-comfyui-mcp | 2026-08-13 | 5.3 Medium |
| A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfy_upload_image. Such manipulation of the argument image_path leads to path traversal. An attack has to be approached locally. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-19366 | 1 Noctedefensor | 1 Ludusmcp | 2026-08-13 | 5.3 Medium |
| A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insert_creds_range_config. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricted to local execution. The project was informed of the problem early through an issue report but has not responded yet. | ||||