Export limit exceeded: 372316 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372316 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-69095 | 1 Openwrt | 1 Luci | 2026-08-03 | 7.5 High |
| OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated attackers to read files outside the configured runtimeDir. Attackers can supply directory traversal sequences in the query string to escape the intended directory and read sensitive files accessible to the CGI process. | ||||
| CVE-2026-9593 | 1 Endress Hauser | 1 Fdi Package Library | 2026-08-03 | 6.7 Medium |
| A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disruption of device data or operation. | ||||
| CVE-2023-52355 | 2 Libtiff, Redhat | 6 Libtiff, Ai Inference Server, Discovery and 3 more | 2026-08-03 | 7.5 High |
| An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB. | ||||
| CVE-2026-67608 | 1 Teleniasoftware | 1 Tvox | 2026-08-03 | 7.2 High |
| Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user. | ||||
| CVE-2026-64827 | 1 Teleniasoftware | 1 Tvox | 2026-08-03 | 9.8 Critical |
| Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory. | ||||
| CVE-2025-71401 | 1 Better-auth | 2 Better-auth\/oauth-provider, Better Auth | 2026-08-03 | 5.9 Medium |
| better-auth (npm) before 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms. | ||||
| CVE-2026-12912 | 2 Libtiff, Redhat | 5 Libtiff, Enterprise Linux, Enterprise Linux Eus and 2 more | 2026-08-03 | 7.3 High |
| A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS). | ||||
| CVE-2026-21550 | 2026-08-03 | 7.5 High | ||
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2026-21551 | 2026-08-03 | 7.5 High | ||
| In modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed | ||||
| CVE-2025-67408 | 1 Sourcecodester | 1 Casap Automated Enrollment System | 2026-08-03 | 7.3 High |
| Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status. | ||||
| CVE-2026-50782 | 1 Jinher | 1 Oa C6 | 2026-08-03 | 7.5 High |
| Jinher OA C6 contains an XML External Entity (XXE) injection vulnerability in the /c6/JHSoft.Web.HrmAttendance/sp_manager_getUserlist.aspx/GetXmlHttp endpoint. An unauthenticated remote attacker can send a crafted XML payload to read arbitrary files from the server via an out-of-band attack. | ||||
| CVE-2026-68580 | 1 Freerdp | 1 Freerdp | 2026-08-03 | 7.5 High |
| FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms. | ||||
| CVE-2026-69090 | 1 Admidio | 1 Admidio | 2026-08-03 | 4.9 Medium |
| Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deactivate, or edit roles belonging to other organizations. Attackers can supply a role UUID from another organization to groups_roles.php handlers to modify that organization's roles without authorization. | ||||
| CVE-2026-18197 | 2026-08-03 | N/A | ||
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Link Library allows Cross-Site Scripting (XSS). This issue affects Link Library: before 7.9.4. | ||||
| CVE-2026-38710 | 1 Cudy | 2 Tr1200, Tr3000 | 2026-08-03 | 7.2 High |
| TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input. | ||||
| CVE-2026-12927 | 1 Schneider Electric | 1 Igss Definition (def.exe) | 2026-08-03 | N/A |
| CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious CGF file is imported to IGSS Definition. | ||||
| CVE-2026-8763 | 2026-08-03 | N/A | ||
| In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | ||||
| CVE-2026-18591 | 1 Meesho | 1 Online Shopping App | 2026-08-03 | 2.1 Low |
| A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. Affected by this vulnerability is an unknown functionality of the component com.meesho.supply. Such manipulation of the argument user_id/phone number/email address/name leads to cleartext storage of sensitive information. The attack can be executed directly on the physical device. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-8497 | 1 Devolutions | 1 Password Manager | 2026-08-03 | 7.4 High |
| Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager 2026.2.1.0 and earlier on Android, iOS, and macOS allows an adjacent-network attacker to intercept and modify sensitive information via a forged TLS certificate. | ||||
| CVE-2025-69935 | 1 Codeastro | 1 Membership Management System | 2026-08-03 | 9.8 Critical |
| CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. | ||||