Export limit exceeded: 366895 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366895 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-61900 | 2026-07-20 | N/A | ||
| The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE. | ||||
| CVE-2026-61901 | 2026-07-20 | N/A | ||
| The Joomla extension Hikashop is vulnerable to an open redirect. | ||||
| CVE-2026-48812 | 2026-07-20 | 7.5 High | ||
| FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.221, FreeScout's attachment download route skips token authentication for any attachment whose `token_type` is set to `1` (`TOKEN_TYPE_LEGACY`). Because this route is unauthenticated and the file path is deterministic, an unauthenticated remote attacker can download any attachment that was created by an older version of FreeScout without possessing a valid token or session. Version 1.8.221 contains a fix. | ||||
| CVE-2026-34239 | 2026-07-20 | N/A | ||
| Chamilo version 1.11.40 and earlier are vulnerable to authenticated remote code execution in the main/inc/ajax/lang.ajax.php path. This endpoint is protected only by `api_protect_course_script(true)`, which means any authenticated user enrolled in a course (student, teacher, DRH) can reach it. | ||||
| CVE-2026-50743 | 2026-07-20 | N/A | ||
| A CSRF vulnerability exists in the `zone-include.php` script in Revive Adserver 6.0.7. Linking and unlinking banners or campaigns to zones could be triggered via crafted GET or POST requests without any verification of the CSRF token, allowing an attacker to perform these actions on behalf of an authenticated administrator. | ||||
| CVE-2026-6793 | 2026-07-20 | 5.4 Medium | ||
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bifra Engineering Consulting Ltd. Q-smart NexT Poll allows Stored XSS. This issue affects Q-smart NexT Poll: before 1.8.7. | ||||
| CVE-2026-51027 | 2026-07-20 | 9.9 Critical | ||
| An issue in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via the ft2.php component. | ||||
| CVE-2026-51026 | 2026-07-20 | 6.5 Medium | ||
| Directory Traversal vulnerability in FileThingie v.2.5.7 allows a remote attacker to obtain sensitive information via a crafted request. | ||||
| CVE-2026-26081 | 1 Haproxy | 1 Haproxy | 2026-07-20 | 4.8 Medium |
| HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. | ||||
| CVE-2026-50162 | 2026-07-20 | 5.3 Medium | ||
| oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1. | ||||
| CVE-2026-26080 | 1 Haproxy | 1 Haproxy | 2026-07-20 | 3.7 Low |
| HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected. | ||||
| CVE-2026-46420 | 2026-07-20 | 5.6 Medium | ||
| setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1. | ||||
| CVE-2026-60027 | 2026-07-20 | N/A | ||
| The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element. | ||||
| CVE-2025-51677 | 1 Openrisc | 1 Or1200 | 2026-07-20 | 9.1 Critical |
| An issue was discovered in openRISC OR1200 commit 83ac6b. An output mismatch between the RTL and the netlist of the or1200 cpu output port can lead to unexpected behavior. | ||||
| CVE-2026-60031 | 2026-07-20 | N/A | ||
| The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses. | ||||
| CVE-2026-60029 | 2026-07-20 | N/A | ||
| The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users. | ||||
| CVE-2026-60026 | 2026-07-20 | N/A | ||
| The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default). | ||||
| CVE-2026-60034 | 2026-07-20 | N/A | ||
| The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS. | ||||
| CVE-2026-60030 | 2026-07-20 | N/A | ||
| The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions. | ||||
| CVE-2026-60033 | 2026-07-20 | N/A | ||
| The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses. | ||||