Export limit exceeded: 399497 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (399497 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-100561 | 1 Openclaw | 1 Openclaw | 2026-09-29 | 8 High |
| OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the policy could trust a command-running wrapper without inspecting the command carried in its arguments. After an operator allowlisted or permanently approved a benign wrapper invocation, a later agent turn could substitute an arbitrary inner command and execute it with the OpenClaw process's host privileges without a further approval prompt. Exploitation requires the relevant wrapper to resolve on the host and a prior operator decision allowing that wrapper. Transparent shell carriers and opaque utilities such as process monitors, tracers, namespace tools, and proxy wrappers were affected through related trust-resolution gaps. Fixed in 2026.8.1. | ||||
| CVE-2015-20122 | 2026-09-29 | 7.5 High | ||
| Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint that allows remote attackers to extract arbitrary database contents without prior authentication. Attackers can inject UNION-based SQL statements through the attach_ids request parameter in downloadAtt.jsp to retrieve sensitive information including credentials and system configuration data. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17. | ||||
| CVE-2026-102559 | 1 Redhat | 1 Enterprise Linux | 2026-09-29 | 8.6 High |
| A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer overflow. | ||||
| CVE-2026-102558 | 1 Redhat | 1 Enterprise Linux | 2026-09-29 | 8.6 High |
| A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame data. | ||||
| CVE-2026-96418 | 1 Wireshark | 1 Wireshark | 2026-09-29 | 5.5 Medium |
| TIFF protocol dissector infinite loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-96417 | 1 Wireshark | 1 Wireshark | 2026-09-29 | 5.5 Medium |
| RF4CE protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-95394 | 1 Wireshark | 1 Wireshark | 2026-09-29 | 4.7 Medium |
| Microsoft Network Monitor file parser large loop in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-101266 | 1 Pretix | 1 Pretix | 2026-09-29 | N/A |
| A logic flaw in the checkout flow allows users to bypass validations performed during the check-in by skipping entire check-in steps. | ||||
| CVE-2026-101267 | 1 Pretix | 1 Pretix | 2026-09-29 | N/A |
| A missing permission check allowed low-privileged users with access to an event but without access to the event's orders to extract some specific information. This information includes the number of attendees and the total revenue. | ||||
| CVE-2026-101268 | 1 Pretix | 1 Pretix | 2026-09-29 | N/A |
| If an attacker is able to convince a victim on a specially crafted link, the victim is logged in to the attacker's customer account. If the victim does not notice this, this might lead to their order details being stored into the attacker's account. The attack only works when the event is available on a different domain than the organizer page. | ||||
| CVE-2026-101269 | 1 Pretix | 1 Pretix | 2026-09-29 | N/A |
| The mechanism binding API-uploaded files to the uploader's authentication method is not working correctly and the same session token is used for all token-based API users. Since API-uploaded files are refered to by randomly generated UUIDs and only exist for a day, there is virtually no risk, but it renders the added protection mechanism useless. | ||||
| CVE-2026-101270 | 1 Pretix | 1 Pretix | 2026-09-29 | N/A |
| Malicious HTML content could be injected into the help texts of various fields with organizer permissions. | ||||
| CVE-2026-101271 | 1 Pretix | 1 Pretix | 2026-09-29 | N/A |
| OAuth credentials (access tokens) are valid for the entirety of their lifetime, even if the application (OAuth client) they are bound to is manually disabled. | ||||
| CVE-2026-100773 | 1 Mozilla | 1 Firefox | 2026-09-29 | 8.8 High |
| Use-after-free in the Storage: IndexedDB component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-93402 | 1 Rsyslog | 1 Rsyslog | 2026-09-29 | 3.1 Low |
| A flaw was found in rsyslog. When using the imdtls input module configured for name or fingerprint authentication, permitted-peer identity checks are not enforced after a successful DTLS handshake. A remote attacker possessing a valid certificate signed by the listener's trusted Certificate Authority could bypass peer restrictions and inject unauthorized syslog records into the input stream. | ||||
| CVE-2026-65129 | 2 Linux, Nvidia | 3 Linux Kernel, Infra Controller, Infrastructure Controller | 2026-09-29 | 6.7 Medium |
| NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper certificate validation. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service. | ||||
| CVE-2026-102424 | 2026-09-29 | N/A | ||
| Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose `id` merely looks numeric, the component trusts the supplied `filename`, concatenates it below the configured upload directory, and adds the result to an array of local attachment paths. It does not load the referenced attachment row, verify ownership/session/form/field, require that the ID exists, canonicalize the path, or enforce containment. If the form's normal “auto reply” and “attach uploaded files” options are enabled, the component sends those local paths as email attachments to the address submitted in an email field. A Guest can therefore submit a nonexistent numeric ID plus a traversal filename such as `../../../../configuration.php` and receive any file readable by the Joomla process. | ||||
| CVE-2026-102425 | 2026-09-29 | N/A | ||
| Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable. | ||||
| CVE-2026-100748 | 1 Svenbluege.de | 1 Event Gallery For Joomla | 2026-09-29 | N/A |
| Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0 | ||||
| CVE-2026-97164 | 1 Svenbluege.de | 1 Event Gallery For Joomla | 2026-09-29 | N/A |
| Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in `clear cache` task in Event Gallery extension < 6.5.0 - Using the `images` parameter of the `cache.process` task, you can recursively delete any directories that the web server is authorized to write to. | ||||