Export limit exceeded: 394069 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (394069 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91954 | 1 Freerdp | 1 Freerdp | 2026-09-15 | 6.5 Medium |
| FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled. | ||||
| CVE-2026-91959 | 1 Freerdp | 1 Freerdp | 2026-09-15 | 6.5 Medium |
| FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort. | ||||
| CVE-2026-91960 | 1 Freerdp | 1 Freerdp | 2026-09-15 | 6.5 Medium |
| FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer wraparound, resulting in a double free that crashes the FreeRDP client during connection. | ||||
| CVE-2026-91979 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-09-15 | 6.5 Medium |
| Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers can upload highly compressed files that expand to tens of gigabytes in memory and disk, exhausting server resources and crashing the instance. | ||||
| CVE-2026-11921 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-09-15 | N/A |
| IBM Verify Identity Access containers may not apply management password change operations correctly. | ||||
| CVE-2026-87511 | 1 Google | 1 Chrome | 2026-09-15 | 4.3 Medium |
| Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-87473 | 1 Google | 1 Chrome | 2026-09-15 | 6.5 Medium |
| Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87469 | 1 Google | 1 Chrome | 2026-09-15 | 4.3 Medium |
| Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via crafted network traffic. (Chromium security severity: Low) | ||||
| CVE-2026-11927 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-09-15 | N/A |
| IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services. | ||||
| CVE-2026-11928 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-09-15 | N/A |
| IBM Verify Identity Access is vulnerable to a buffer overflow attack. | ||||
| CVE-2026-91943 | 1 Unclecode | 1 Crawl4ai | 2026-09-15 | 7.7 High |
| Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads targets with Python requests without egress validation. Authenticated attackers can supply URLs that redirect to internal addresses or use DNS rebinding to access internal services, exfiltrating responses through PDF text extraction in crawl results. | ||||
| CVE-2026-91932 | 1 Flowiseai | 1 Flowise | 2026-09-15 | 8.5 High |
| Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working directory to execute malicious code. | ||||
| CVE-2026-90708 | 1 Yot | 1 Cms | 2026-09-15 | 7.3 High |
| A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-90537 | 1 Wwbn | 1 Avideo | 2026-09-15 | 8.2 High |
| WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that allows unauthenticated attackers to access scheduler email jobs by providing a site-wide daily token. Attackers can enumerate scheduler jobs, read private live titles and email addresses, and trigger email sending by supplying any valid daily token obtained from Live pages. | ||||
| CVE-2026-90474 | 1 Samanhappy | 1 Mcphub | 2026-09-15 | 6.8 Medium |
| MCPHub before 1.0.32 contains an authentication bypass vulnerability in its embedded OAuth 2.0 authorization server where client authentication is disabled by default and PKCE enforcement is optional. Attackers who obtain an authorization code through interception can redeem it for access tokens without providing a client secret or PKCE verifier, gaining access to victim accounts and their privileges. | ||||
| CVE-2026-89267 | 2 Encode, Jowilf | 2 Starlette, Starlette-admin | 2026-09-15 | 4.3 Medium |
| starlette-admin versions 0.16.1 through 0.17.1 fail to enforce the searchable_fields allowlist when configured as an empty list, allowing authenticated users to filter on non-searchable fields. Attackers can submit structured filter queries via the list API's where parameter to perform equality and comparison operations on excluded columns. | ||||
| CVE-2026-79699 | 1 Redhat | 7 Ansible Automation Platform, Container Native Virtualization, Enterprise Linux and 4 more | 2026-09-15 | 4.4 Medium |
| A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer. | ||||
| CVE-2026-54724 | 2026-09-15 | 6.1 Medium | ||
| Kiwi TCMS is an open source test management system. Prior to 16.1, the account confirmation endpoint accepted an unvalidated next parameter, allowing an unauthenticated attacker to create a URL on a trusted Kiwi TCMS hostname that redirects a victim to an arbitrary external domain. The trusted origin can support credential-harvesting pages, bypass email security filters and link-reputation checks that allowlist the organization's domain, or deliver malware through a convincing account-confirmation lure. This issue is fixed in version 16.1. | ||||
| CVE-2026-54450 | 2026-09-15 | N/A | ||
| ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64 addresses embedding private, loopback, or link-local IPv4 targets are classified as public and allowed. The most direct attacker-controlled path begins when an external OAuth client supplies a client_id URL that CIMDStorageDecorator.GetClient routes through FetchClientMetadataDocument in pkg/oauthproto/cimd/fetch.go; protectedDialerControl in pkg/networking/http_client.go and validateHost in pkg/skills/gitresolver/reference.go share the defective classification but use operator-controlled or user-controlled destinations. On a ToolHive host behind a NAT64/DNS64 gateway, the gateway translates an allowed address such as 64:ff9b:1::a9fe:a9fe to 169.254.169.254, permitting blind probing of internal TCP or TLS reachability. The attacker-controlled CIMD path requires HTTPS, verifies certificates, and does not reflect response bodies, so the established impact is an internal reachability oracle rather than metadata credential exfiltration; the webhook client is not affected because it does not use this IP guard. This issue is fixed in version 0.29.1. | ||||
| CVE-2026-49846 | 1 Signalwire | 1 Libks | 2026-09-15 | 7.5 High |
| libks provides foundational support for signalwire C products. Prior to version 2.0.11, `clean_uri()` in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with embedded ".." sequences intact, enabling path traversal in any consumer that later joins the URI with a filesystem path. Version 2.0.11 patches the issue. | ||||