Export limit exceeded: 376601 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 376601 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376601 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-0290 | 1 Palo Alto Networks | 1 Prisma Browser | 2026-08-13 | N/A |
| An information disclosure vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a local attacker to view sensitive data. | ||||
| CVE-2026-65675 | 1 Microsoft | 1 Visual Studio Code Copilot Chat Extension | 2026-08-13 | 7.1 High |
| No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-70321 | 1 Microsoft | 2 Sharepoint Server, Sharepoint Server Subscription Edition | 2026-08-13 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-59322 | 2026-08-13 | N/A | ||
| CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be mounted as plaintext. | ||||
| CVE-2025-59323 | 1 Cpsd | 1 Cryptopro Secure Disk | 2026-08-13 | N/A |
| CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to validate the integrity of the DataStore, a non-partitioned filesystem, responsible for storing configuration and cryptographic details. Crafted DataStore contents can impact service availability and/or allow for code execution in the context of high privilege. | ||||
| CVE-2026-71387 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-08-13 | 8.8 High |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. The vulnerable component is restricted to an administrative network zone by default. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-73083 | 1 Activepieces | 1 Activepieces | 2026-08-13 | N/A |
| Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOX_CODE_ONLY mode, the engine loads the compiled user module with importFresh(), a wrapper around Node.js require(), before the V8 isolate is applied. Top-level module code can therefore call require('child_process'), access fs, and use other Node.js APIs in the host engine process outside the sandbox. An authenticated user who can create a Code step can read environment secrets including AP_ENCRYPTION_KEY and AP_JWT_SECRET, read or write files, and reach internal services. This issue is fixed in version 0.80.0. | ||||
| CVE-2026-73084 | 1 Activepieces | 1 Activepieces | 2026-08-13 | 6.1 Medium |
| Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can break out of the script context and execute arbitrary JavaScript in the Activepieces origin when a logged-in user opens it. An unauthenticated attacker can access the victim's session tokens or make authenticated API calls on the victim's behalf. This issue is fixed in version 0.83.0. | ||||
| CVE-2026-73085 | 1 Advplyr | 1 Audiobookshelf | 2026-08-13 | N/A |
| Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.36.0, the jwtAuthCheck function in server/auth/TokenManager.js treats JWTs with the refresh token type as bearer access tokens on API and WebSocket resource endpoints such as /api/me instead of restricting them to /auth/refresh, allowing refresh tokens to authenticate as the associated users. This issue is fixed in version 2.36.0. | ||||
| CVE-2026-73087 | 1 Amir20 | 1 Dozzle | 2026-08-13 | N/A |
| Dozzle is a realtime log viewer for docker containers. From 10.5.2 until 10.6.15, the isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, used by safeDialContext for webhook notification URLs, does not inspect IPv4 addresses embedded in 6to4, NAT64, Teredo, or IPv4-compatible IPv6 addresses, allowing an authenticated user to reach loopback or link-local targets that the guard intends to block. This issue is fixed in version 10.6.15. | ||||
| CVE-2026-48439 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 7.5 High |
| CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48435 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 6.2 Medium |
| CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48444 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 6.2 Medium |
| CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48446 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 5.5 Medium |
| CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | ||||
| CVE-2026-48387 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 6.2 Medium |
| CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48445 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 6.2 Medium |
| CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48442 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 7.1 High |
| CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Arbitrary file system read. An attacker could leverage this vulnerability to gain unauthorized read access to files or directories outside the intended restrictions. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-71390 | 1 Adobe | 3 Content Credentials Command-line Tool, Content Credentials Js Sdk, Content Credentials Rust Sdk | 2026-08-13 | 4 Medium |
| CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-0289 | 1 Palo Alto Networks | 1 Prisma Browser | 2026-08-13 | N/A |
| A security bypass vulnerability in the Account Protection feature of Palo Alto Networks Prisma® Browser enables a user to bypass intended security controls. | ||||
| CVE-2026-15213 | 2026-08-13 | 5.3 Medium | ||
| The Welcart e-Commerce WordPress plugin before 2.11.33 does not verify the authenticity of its convenience-store / bank-transfer settlement callback: an unauthenticated request can flip an order from unpaid to settled purely from an order number and a status flag, with no signature, amount, or origin check. Because these are pay-later methods, an attacker can mark their own unpaid order as settled and obtain fulfilment without paying. | ||||