Export limit exceeded: 394761 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (394761 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-68873 | 1 Microsoft | 10 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 7 more | 2026-09-17 | 5.5 Medium |
| Insertion of sensitive information into log file in Windows Program Compatibility Assistant Service allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-53681 | 2026-09-17 | N/A | ||
| Red Hat Product Security has come to the conclusion that this CVE is not needed. | ||||
| CVE-2026-53679 | 2026-09-17 | N/A | ||
| Red Hat Product Security has come to the conclusion that this CVE is not needed. | ||||
| CVE-2026-11874 | 2026-09-17 | N/A | ||
| Red Hat Product Security has come to the conclusion that this CVE is not needed. | ||||
| CVE-2026-91980 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-09-17 | 4.3 Medium |
| vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and members. Attackers can attach arbitrary team IDs via the project teams endpoint to retrieve complete team rosters including member names and admin flags for unauthorized teams. | ||||
| CVE-2026-92860 | 1 Rcourtman | 1 Pulse | 2026-09-17 | 9.1 Critical |
| A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the file /api/security/quick-setup of the component Quick Security Setup Handler. The manipulation of the argument Username results in improper input validation. The attack may be performed from remote. Upgrading the affected component is advised. | ||||
| CVE-2026-81240 | 1 Dell | 1 Wyse Management Suite | 2026-09-17 | 8.6 High |
| Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | ||||
| CVE-2026-0179 | 1 Google | 1 Android | 2026-09-17 | 6.7 Medium |
| In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-81665 | 2 Corosync, Redhat | 7 Corosync, Enterprise Linux, Enterprise Linux Eus and 4 more | 2026-09-17 | 7.5 High |
| A heap-based buffer overflow was found in Corosync's Totem Process Group (totempg) message reassembly. When processing fragmented multicast messages, the buffer used to reassemble fragments lacks a runtime bounds check in release builds. A network-adjacent attacker able to send crafted multicast protocol messages to the cluster could cause a heap buffer overflow with attacker-controlled data. This can crash the Corosync daemon, causing a denial of service to the entire cluster, and may potentially allow further exploitation given sufficient heap-corruption control. | ||||
| CVE-2026-43690 | 1 Apple | 1 Macos | 2026-09-17 | 4.7 Medium |
| A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory. | ||||
| CVE-2026-43696 | 1 Apple | 1 Macos | 2026-09-17 | 5.3 Medium |
| An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar content without authorization. | ||||
| CVE-2026-15809 | 1 Redhat | 4 Confidential Compute Attestation, Openshift, Openshift Container Platform and 1 more | 2026-09-17 | 7.8 High |
| A flaw was found in CRI-O. The fix for a previous vulnerability (CVE-2022-4318) was incorrect, allowing it to be bypassed. An attacker capable of setting environment variables on a container can inject a newline character into the HOME environment variable. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. | ||||
| CVE-2026-91098 | 1 Hp Inc. | 1 Hp Linux Imaging And Printing Software Hplip | 2026-09-17 | 8.8 High |
| HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. | ||||
| CVE-2026-91105 | 1 Hp Inc. | 1 Hp Linux Imaging And Printing Software Hplip | 2026-09-17 | 8.8 High |
| HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software components that could potentially enable remote code execution, privilege escalation, denial of service, information disclosure, or unauthorized file modification under certain conditions. | ||||
| CVE-2026-16313 | 1 Redhat | 9 Enterprise Linux, Openshift, Openshift Container Platform and 6 more | 2026-09-17 | 7.6 High |
| A flaw was found in sg3_utils. The sg_inq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev device database. This could allow an attacker who can present a crafted SCSI device to execute arbitrary commands as root when the device is disconnected. | ||||
| CVE-2026-81440 | 2026-09-17 | 7.3 High | ||
| Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Credentials vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access. | ||||
| CVE-2026-43719 | 1 Apple | 1 Macos | 2026-09-17 | 6.5 Medium |
| A use-after-free issue was addressed with improved memory management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Mounting a maliciously crafted SMB network share may lead to system termination. | ||||
| CVE-2026-81239 | 1 Dell | 1 Wyse Management Suite | 2026-09-17 | 8.6 High |
| Dell Wyse Management Suite, versions prior to 2605.0.3.683, contain an Unrestricted Upload of File with Dangerous Type vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | ||||
| CVE-2026-81479 | 2026-09-17 | 5.8 Medium | ||
| Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Partial String Comparison vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Denial of service. | ||||
| CVE-2026-92917 | 1 Getgrav | 1 Grav | 2026-09-17 | 7.5 High |
| Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (print_r, vardump, json_encode, yaml_encode, string): GravExtension::assertSandboxDumpSafe() determines sandbox state by calling SandboxExtension::isSandboxed() without a Source argument, which reports only the global sandbox flag that Grav never enables, so the guard added in GHSA-mc5q-6hpj-rp7j never executes. As a result, an authenticated user with page-edit rights can render {{ config|print_r }} in page content with Twig processing enabled and dump Grav's entire merged configuration — print_r reflects the real Config object held in a private property of the SandboxConfig facade, bypassing its path redaction — exposing plugin secrets such as SMTP credentials, API tokens, webhook secrets and cache backend passwords. Grav 1.7 is not affected because it ships no Twig content sandbox. The issue is fixed in 2.0.22, where the affected filters are registered with Twig's needs_is_sandboxed flag. | ||||