Export limit exceeded: 395041 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395041 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395041 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-54644 | 2026-09-17 | 6.1 Medium | ||
| CubeCart is an ecommerce software solution. Prior to 6.7.5, the _errorMessage method in classes/gui.class.php uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session, enabling session exposure or unauthorized application actions. This issue is fixed in version 6.7.5. | ||||
| CVE-2026-54647 | 2026-09-17 | 7.2 High | ||
| CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST parameter into a raw UPDATE statement for CubeCart_downloads without numeric validation. An authenticated administrator can supply a comma-delimited value that changes the SET clause because HTML sanitization does not neutralize SQL syntax, allowing manipulation of database columns and potentially other data within the application's database privileges. This issue is fixed in version 6.7.5. | ||||
| CVE-2026-54646 | 2026-09-17 | 7.2 High | ||
| CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABLE, and ANALYZE TABLE statements without validating the identifiers or escaping embedded backticks. An authenticated administrator can terminate the quoted identifier with a closing backtick and introduce attacker-controlled structural SQL, potentially compromising database confidentiality, integrity, and availability within the application's database privileges. This issue is fixed in version 6.7.5. | ||||
| CVE-2026-54648 | 2026-09-17 | 6.5 Medium | ||
| CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for the purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts, compromising data integrity and availability. This issue is fixed in version 6.7.5. | ||||
| CVE-2026-43664 | 1 Apple | 6 Ios And Ipados, Ipados, Iphone Os and 3 more | 2026-09-17 | 5.5 Medium |
| This issue was addressed with improved data protection. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, watchOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-84596 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-09-17 | 6.5 Medium |
| An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory. | ||||
| CVE-2026-86905 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-09-17 | 5.5 Medium |
| This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to delete credentials stored in Keychain. | ||||
| CVE-2026-84538 | 1 Apple | 1 Macos | 2026-09-17 | 6.5 Medium |
| A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote attacker may be able to cause a denial-of-service. | ||||
| CVE-2026-84611 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-09-17 | 7.3 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted 3D model may lead to memory corruption. | ||||
| CVE-2026-43761 | 1 Apple | 1 Macos | 2026-09-17 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. Mounting a malicious disk image may cause unexpected system termination. | ||||
| CVE-2026-84543 | 1 Apple | 1 Macos | 2026-09-17 | 7.5 High |
| An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. Connecting to a malicious SMB server may cause unexpected system termination or corrupt kernel memory. | ||||
| CVE-2026-64701 | 1 Apple | 1 Macos | 2026-09-17 | 7.8 High |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges. | ||||
| CVE-2026-64756 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-09-17 | 5.5 Medium |
| A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to access user-sensitive data. | ||||
| CVE-2026-86883 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-09-17 | 5.5 Medium |
| A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 27 and iPadOS 27, visionOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-84575 | 1 Apple | 7 Ios And Ipados, Ipados, Iphone Os and 4 more | 2026-09-17 | 7.8 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted file may lead to unexpected app termination. | ||||
| CVE-2026-84522 | 1 Apple | 1 Macos | 2026-09-17 | 5.9 Medium |
| A race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-43690 | 1 Apple | 1 Macos | 2026-09-17 | 4.7 Medium |
| A race condition was addressed with improved locking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A local user may be able to read kernel memory. | ||||
| CVE-2026-84534 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-09-17 | 5.5 Medium |
| A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files. | ||||
| CVE-2026-84563 | 1 Apple | 1 Macos | 2026-09-17 | 7.5 High |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-84631 | 1 Apple | 1 Macos | 2026-09-17 | 7.8 High |
| This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges. | ||||