Export limit exceeded: 373570 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 373570 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373570 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-7656 | 1 Zephyrproject | 1 Zephyr | 2026-08-06 | 8.1 High |
| The IPv6 Neighbor Discovery handlers in subsys/net/ip/ipv6_nbr.c (handle_ra_input, handle_ns_input, handle_na_input) used an incorrect boolean expression that combined the RFC 4861 validity checks with the ICMPv6 code check using the wrong operator precedence: the form was ((length/hop/source/target checks) && (icmp_hdr->code != 0)). Because every legitimate ND message carries ICMPv6 code 0, an attacker setting code == 0 (the normal value) caused the entire predicate to evaluate false, so the packet was never dropped and all of the other checks were silently skipped. The bypassed checks include the mandatory Hop Limit == 255 verification (which proves an ND packet originated on-link and was not forwarded) and, for Router Advertisements, the requirement that the source be a link-local address, as well as multicast-target sanity checks. As a result, an adjacent on-link attacker — and, because the Hop-Limit-255 guard is bypassed, potentially a remote/off-link attacker whose packets would otherwise be rejected — can have forged Router Advertisement, Neighbor Solicitation, and Neighbor Advertisement messages accepted. A forged RA lets the attacker reconfigure the victim's default router, on-link prefixes (SLAAC), MTU, reachable/retransmit timers, and (with CONFIG_NET_IPV6_RA_RDNSS) DNS servers, while forged NS/NA enable neighbor-cache poisoning, enabling man-in-the-middle, traffic redirection, and denial of service. The flaw is an input-validation/authentication weakness rather than a memory-safety issue: the underlying packet-parsing primitives (net_pkt_get_data, net_pkt_read, net_pkt_skip) are independently bounds-safe and the validated length is the true buffer length, so skipping the length check causes no out-of-bounds access. The defect has existed since the logic was introduced in 2018 and shipped in all releases through v4.4.0; it is fixed by splitting the condition so any failing check drops the packet. | ||||
| CVE-2026-19071 | 1 Itsourcecode | 1 Hospital Management System | 2026-08-06 | 6.3 Medium |
| A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2026-25403 | 2 Bdthemes, Wordpress | 2 Utlimate Store Kit Elementor Addons, Wordpress | 2026-08-06 | 6.5 Medium |
| Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. | ||||
| CVE-2026-28140 | 2 Jetmonsters, Wordpress | 2 Jetformbuilder, Wordpress | 2026-08-06 | 7.5 High |
| Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. | ||||
| CVE-2026-65575 | 2026-08-06 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions. | ||||
| CVE-2026-67864 | 1 Open62541 | 1 Open62541 | 2026-08-06 | 7.5 High |
| An issue in open62541 v.1.5.5 and before allows a remote attacker to cause a denial of service via the NodeManagement type-instantiation logic component | ||||
| CVE-2026-70429 | 1 Jenkins Project | 1 Jenkins | 2026-08-06 | 8.1 High |
| Jenkins 2.575 and earlier, LTS 2.568.1 and earlier handles case-insensitivity in user names and group names inconsistently, allowing attackers able to create new users or groups with names that case-insensitively match other characters to impersonate other users or be granted their permissions in some circumstances. | ||||
| CVE-2026-65548 | 2 Muffingroup, Wordpress | 2 Betheme, Wordpress | 2026-08-06 | 9.9 Critical |
| Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. | ||||
| CVE-2026-65507 | 2 Sergey, Wordpress | 2 Aiwu, Wordpress | 2026-08-06 | 9.8 Critical |
| Unauthenticated Privilege Escalation in AIWU <= 1.5.6 versions. | ||||
| CVE-2026-61963 | 2 Davidlingren, Wordpress | 2 Media Library Assistant, Wordpress | 2026-08-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.38 versions. | ||||
| CVE-2026-66451 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-08-06 | 6.5 Medium |
| Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. | ||||
| CVE-2026-66706 | 2 Markjaquith, Wordpress | 2 Subscribe To Comments, Wordpress | 2026-08-06 | 5.9 Medium |
| Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. | ||||
| CVE-2026-65581 | 2026-08-06 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions. | ||||
| CVE-2026-12605 | 1 Eclipse | 1 Glassfish | 2026-08-06 | 9.6 Critical |
| In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires. | ||||
| CVE-2026-66843 | 1 Rrrene | 1 Html Sanitize Ex | 2026-08-06 | N/A |
| Inclusion of Functionality from Untrusted Control Sphere vulnerability in the HTML5 scrubber in rrrene html_sanitize_ex allows a remote attacker to load a document of their choosing into a trusted page via the data attribute of an <object> element in sanitized HTML. object is the one URI-bearing element in lib/html_sanitize_ex/scrubber/html5.ex never registered through allow_tag_with_uri_attributes/3, and its only guard is a prefix match on lowercase "javascript:", so mixed-case variants, data: URIs, protocol-relative URLs and same-origin paths all survive. This is not unconditional cross-site scripting. A javascript: URL does not execute through <object data> in current browsers, data: documents load in an opaque origin, and host-origin script execution additionally requires the application to serve attacker-controlled content from a same-origin path. This issue affects html_sanitize_ex: from 0.3.1 before 1.5.3. | ||||
| CVE-2026-66663 | 2 Passionate Programmer Peter, Wordpress | 2 Wp Data Access, Wordpress | 2026-08-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | ||||
| CVE-2026-66690 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-08-06 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. | ||||
| CVE-2026-66711 | 2026-08-06 | 7.1 High | ||
| Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. | ||||
| CVE-2026-66699 | 2 Dokan, Wordpress | 2 Dokan, Wordpress | 2026-08-06 | 5.3 Medium |
| Custom role Broken Access Control in Dokan <= 5.0.10 versions. | ||||
| CVE-2026-67871 | 1 Systerel | 1 S2opc | 2026-08-06 | 7.5 High |
| Buffer Overflow vulnerability in Systerel S2OPC 1.7.3 allows a remote attacker to cause a denial of service via the AddNodes, address_space_bs.c, sopc_node_mgt_helper_internal.c, and toolkit_test_server | ||||