Export limit exceeded: 384505 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (384505 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12554 | 1 Hp Inc | 1 Hp Easy Start For Macos | 2026-08-27 | N/A |
| Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities. | ||||
| CVE-2025-62300 | 1 Hcl Software | 1 Iem | 2026-08-27 | 5.9 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior. | ||||
| CVE-2025-62299 | 1 Hcl Software | 1 Iem | 2026-08-27 | 6.6 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges. | ||||
| CVE-2026-43670 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-08-27 | 8.8 High |
| A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy. | ||||
| CVE-2026-64705 | 1 Apple | 1 Macos | 2026-08-27 | 5.5 Medium |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7. An app may be able to cause unexpected system termination or write kernel memory. | ||||
| CVE-2026-47857 | 2026-08-27 | 5.9 Medium | ||
| In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier | ||||
| CVE-2026-47863 | 2026-08-27 | 5.9 Medium | ||
| In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier | ||||
| CVE-2026-47884 | 1 Spring | 1 Spring Framework | 2026-08-27 | 9.8 Critical |
| Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier | ||||
| CVE-2026-47886 | 1 Spring | 1 Spring Framework | 2026-08-27 | 7.5 High |
| Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier | ||||
| CVE-2026-47889 | 1 Spring | 1 Spring Framework | 2026-08-27 | 7.5 High |
| A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 | ||||
| CVE-2026-16567 | 2026-08-27 | 5.3 Medium | ||
| The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs. | ||||
| CVE-2026-19223 | 2026-08-27 | 7.2 High | ||
| The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-19225 | 2026-08-27 | 6.6 Medium | ||
| The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-19715 | 2026-08-27 | 7.5 High | ||
| The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled. | ||||
| CVE-2021-48005 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2021-48004 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2021-48003 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2021-48002 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2021-48001 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2021-48000 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||