Export limit exceeded: 396549 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396549 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-23937 | 1 Zabbix | 1 Zabbix | 2026-09-23 | 6.5 Medium |
| The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. | ||||
| CVE-2026-70584 | 1 Microsoft | 22 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 19 more | 2026-09-23 | 7.8 High |
| Access of resource using incompatible type ('type confusion') in Windows Core Messaging allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-18179 | 1 Ibm | 1 Financial Transaction Manager Ftmfor Redhat Openshift | 2026-09-23 | 6.5 Medium |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization. | ||||
| CVE-2026-59167 | 2026-09-23 | 10 Critical | ||
| SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11. | ||||
| CVE-2026-18177 | 1 Ibm | 1 Financial Transaction Manager Ftmfor Redhat Openshift | 2026-09-23 | 7.1 High |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks. | ||||
| CVE-2026-72927 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-23 | 6.7 Medium |
| Heap-based buffer overflow in Winsock allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-75973 | 1 Apache | 1 Tomcat | 2026-09-23 | N/A |
| Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the default provider and multiple web application used that provider, the realm for the first web application to authenticate a request would be used for all web applications. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M4 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60, 9.0.122, which fixes the issue. | ||||
| CVE-2026-78383 | 1 Apache | 1 Tomcat | 2026-09-23 | N/A |
| Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP processing thread leading to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from 9.0.0.M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100, from 7.0.0 through 7.0.109. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue. | ||||
| CVE-2026-78437 | 1 Apache | 1 Apache Tomcat | 2026-09-23 | N/A |
| Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from another user to fail. This issue affects Apache Tomcat: from 11.0.19 through 11.0.25, from 10.1.53 through 10.1.59, from 9.0.116 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue. | ||||
| CVE-2026-86350 | 1 Apache | 1 Apache Tomcat | 2026-09-23 | N/A |
| Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in fix for CVE-2026-41293 can trigger request header mix-up. This issue affects Apache Tomcat: from 11.0.22 through 11.0.25, from 10.1.55 through 10.1.59, from 9.0.118 through 9.0.121. Users are recommended to upgrade to version 11.0.26, 10.1.60 or 9.0.122, which fix the issue. | ||||
| CVE-2026-73581 | 1 Apache | 1 Tomcat | 2026-09-23 | N/A |
| Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.58, from 9.0.0-M1 through 9.0.121. The following versions were EOL at the time the CVE was created but are known to be affected: from 8.5.0 through 8.5.100. Other unsupported versions may also be affected. Users are recommended to upgrade to version 11.0.26, 10.1.59, 9.0.122, which fixes the issue. | ||||
| CVE-2026-86678 | 1 Zohocorp | 1 Manageengine Applications Manager | 2026-09-23 | 8.8 High |
| ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and use it to perform administrator-level actions. | ||||
| CVE-2026-72933 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-23 | 8.8 High |
| Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-72937 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-23 | 5.5 Medium |
| Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-86677 | 1 Zohocorp | 1 Manageengine Applications Manager | 2026-09-23 | 8.8 High |
| ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution. | ||||
| CVE-2026-16751 | 1 Ente | 1 Museum Server | 2026-09-23 | 6.5 Medium |
| Authorization Bypass in the emergency recovery approval component in Ente Technologies Ente Museum Server allows an authenticated attacker configured as a victim's emergency contact to bypass the configured recovery waiting period and take over the victim's account via a crafted `approve-recovery` API request. | ||||
| CVE-2026-96560 | 2026-09-23 | 9.8 Critical | ||
| LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, which exposes an unauthenticated RPyC control channel that deserializes attacker-supplied data. Attackers can send malicious pickled objects to the exposed RPyC ThreadedServer to execute arbitrary code with the privileges of the LightLLM service account. | ||||
| CVE-2026-25104 | 1 Mediaarea | 2 Mediainfo, Mediainfolib | 2026-09-23 | 7.8 High |
| A heap-based buffer overflow vulnerability exists in the LXF parsing functionality of MediaInfoLib (version(s): 26.01). A specially crafted .lxf file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability. | ||||
| CVE-2026-84091 | 2026-09-23 | 5.3 Medium | ||
| The SUMIT Payment Gateway for WooCommerce WordPress plugin before 4.0.0 does not verify with the payment provider that a payment notification is genuine before marking the corresponding order as paid, allowing unauthenticated users to mark a pending order paid without completing payment. | ||||
| CVE-2026-86679 | 1 Zohocorp | 1 Manageengine Applications Manager | 2026-09-23 | 7.1 High |
| ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope. | ||||