Export limit exceeded: 385646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385646 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84132 | 1 Mozilla | 1 Firefox | 2026-09-02 | N/A |
| Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-84133 | 1 Mozilla | 1 Firefox | 2026-09-02 | N/A |
| Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2024-35585 | 2026-09-02 | 8.6 High | ||
| Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. | ||||
| CVE-2026-3851 | 2 Elegant Themes, Wordpress | 2 Divi, Wordpress | 2026-09-02 | 6.4 Medium |
| The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: (1) the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only searches for dynamic content markers in the `@ET-DC@...@` format, but the rendering engine also supports a legacy JSON format that is silently converted at render time, completely bypassing the save-time filter, and (2) the `post_meta_key` resolver in `et_builder_filter_resolve_default_dynamic_content()` does not apply `wp_kses_post()` to the resolved meta value when `enable_html` is set to `on`, passing raw `get_post_meta()` output directly to the page. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-14357 | 2026-09-02 | 8.8 High | ||
| The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check and missing nonce validation in the DPDEV_install_themes_func() function registered on the wp_ajax_DPDEV_install_themes action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install arbitrary theme ZIP packages containing PHP files that are extracted into the web-accessible wp-content/themes/ directory, which may make remote code execution possible. | ||||
| CVE-2026-51693 | 1 Totolink | 1 T6 | 2026-09-02 | 9.8 Critical |
| Incorrect access control in the setVpnPassCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to weaken edge filtering via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51695 | 1 Totolink | 1 T6 | 2026-09-02 | 7.5 High |
| Incorrect access control in the setDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter dynamic DNS state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51698 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the setUrlFilterRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter browsing policies via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51699 | 1 Totolink | 1 T6 | 2026-09-02 | 9.8 Critical |
| Incorrect access control in the setDmzCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose an internal host via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51713 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the setManualDialCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to manipulate WAN dial state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51721 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the setPairCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter the mesh pairing state via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51726 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the delParentalRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to remove parental-control rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51736 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the clearSyslog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase system logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51737 | 1 Totolink | 1 T6 | 2026-09-02 | 5.3 Medium |
| Incorrect access control in the clearTracerouteLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase traceroute logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-79408 | 1 Metagpt | 1 Metagpt | 2026-09-02 | 9.8 Critical |
| An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py. | ||||
| CVE-2026-51752 | 1 Totolink | 1 T6 | 2026-09-02 | 5.3 Medium |
| Incorrect access control in the staticInfoSend function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger static information reporting to the configured master via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-84206 | 2 Grokability, Snipeitapp | 2 Snipe-it, Snipe-it | 2026-09-02 | 4.3 Medium |
| Snipe-IT before 8.7.0 gates the bulk asset restore endpoint on the assets.edit permission instead of assets.delete, allowing users without delete rights to restore soft-deleted assets. Attackers with edit permissions can post asset identifiers to the bulk restore endpoint to undo administrator deletions and bypass intended permission separation. | ||||
| CVE-2026-51704 | 1 Totolink | 1 T6 | 2026-09-02 | 4.3 Medium |
| Incorrect access control in the setWiFiMeshConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter mesh configurations via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51706 | 1 Totolink | 1 T6 | 2026-09-02 | 4.3 Medium |
| Incorrect access control in the setSmartQosCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to degrade traffic handling via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-84131 | 1 Mozilla | 1 Firefox | 2026-09-02 | 8.8 High |
| Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ESR 153.2, Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. | ||||