Export limit exceeded: 376482 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376482 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-30240 | 1 Tp-link | 33 Eb810v(eu1) V1.0, Ex220(br) V1.0/1.20/1.28/1.29/1.8, Ex220(br) V2.0 and 30 more | 2026-08-11 | N/A |
| The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem. | ||||
| CVE-2025-30241 | 1 Tp-link | 31 Eb210 Pro(eu1) 1.0, Eb210 Pro(us1) 1.0, Eb810v(eu1) V1.0 and 28 more | 2026-08-11 | N/A |
| Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise. | ||||
| CVE-2026-19424 | 1 Inventec Appliances | 1 Chiline Cloud | 2026-08-11 | 7.5 High |
| Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data. | ||||
| CVE-2026-19425 | 1 Win Men Intermational | 1 Travel Agency Management System | 2026-08-11 | 9.8 Critical |
| Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. | ||||
| CVE-2026-8158 | 1 Axis Communications Ab | 3 Axis File Player, Signed Media Verifier, Signed Video Framework | 2026-08-11 | 5.3 Medium |
| The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected. | ||||
| CVE-2026-19391 | 1 Redhat | 5 Certification For Red Hat Enterprise Linux, Certifications, Enterprise Linux and 2 more | 2026-08-11 | 6.5 Medium |
| A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com. | ||||
| CVE-2026-71218 | 2 Iperf3 Project, Redhat | 2 Iperf3, Enterprise Linux | 2026-08-11 | 5.3 Medium |
| A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service. | ||||
| CVE-2026-6181 | 1 Axis Communications Ab | 1 Axis Os | 2026-08-11 | 5.9 Medium |
| The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account. | ||||
| CVE-2026-5303 | 1 Axis Communications Ab | 1 Axis Os | 2026-08-11 | 5.7 Medium |
| The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | ||||
| CVE-2026-44401 | 1 Typemill | 1 Typemill | 2026-08-11 | 4.8 Medium |
| Typemill CMS version 2.x contains a persistent cross-site scripting vulnerability in the Markdown parser extension that allows authenticated users with theme-configuration access to inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. Attackers can craft Markdown links using the javascript: scheme through ParsedownExtension.php or TwigMarkdownExtension.php, storing a persistent payload that executes in the browser of every visitor who clicks the link, enabling session cookie theft, authenticated request forgery, and credential harvesting. | ||||
| CVE-2026-67591 | 1 Apache | 2 Qpid Proton-j, Qpid Protonj2 | 2026-08-11 | 6.5 Medium |
| An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue. | ||||
| CVE-2026-67592 | 1 Apache | 2 Qpid Proton-j, Qpid Protonj2 | 2026-08-11 | 7.5 High |
| It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue | ||||
| CVE-2026-0673 | 2 Bdthemes, Wordpress | 2 Element Pack Addons For Elementor, Wordpress | 2026-08-11 | 5.3 Medium |
| The Element Pack Addons for Elementor plugin for WordPress is vulnerable to Email Header Injection in all versions up to, and including, 8.3.15 via the `element_pack_contact_form` AJAX action. This is due to insufficient sanitization of newline characters in user-supplied input that gets concatenated into email headers. This makes it possible for unauthenticated attackers to inject arbitrary email headers into emails sent by the contact form. | ||||
| CVE-2026-18473 | 2 Wordpress, Wpdirectorykit | 2 Wordpress, Wp Directory Kit | 2026-08-11 | 9.1 Critical |
| The WP Directory Kit WordPress plugin before 1.5.5 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users. | ||||
| CVE-2026-19350 | 1 Dolibarr | 2 Erp, Erp Crm | 2026-08-11 | 6.3 Medium |
| A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is 8992ce8704da947b6abe7b65a6fe59aed736bb81. It is advisable to implement a patch to correct this issue. | ||||
| CVE-2026-19379 | 2 Efm, Iptime | 2 Iptime Ax8004m, Ax8004m | 2026-08-11 | 7.3 High |
| A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-17541 | 2 Filemanagerpro, Wordpress | 2 File Manager, Wordpress | 2026-08-11 | 7.5 High |
| The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them. | ||||
| CVE-2026-17542 | 2 Filemanagerpro, Wordpress | 2 File Manager, Wordpress | 2026-08-11 | 7.5 High |
| The File Manager WordPress plugin before 6.9.1 does not perform any capability check on one of its file manager connector endpoints, allowing any authenticated user, such as a subscriber, to browse the entire WordPress installation directory and download files of certain types from it, including archives and documents which may contain sensitive data. | ||||
| CVE-2026-19053 | 2 Prosolution, Wordpress | 2 Prosolution Wp Client, Wordpress | 2026-08-11 | 9.1 Critical |
| The ProSolution WP Client WordPress plugin before 2.0.6 does not sanitise and escape a parameter before using it in a SQL statement reachable by unauthenticated visitors, leading to a blind SQL injection. | ||||
| CVE-2026-57279 | 1 Cybozu | 1 Cybozu Garoon | 2026-08-11 | N/A |
| Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product. | ||||