Export limit exceeded: 370159 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370159 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-23571 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-27 | 4.3 Medium |
| HCL Aftermarket EPC is vulnerable to attack since the application does not have an appropriate caching policy specifying the extent to which the page and its form fields should be cached. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time. | ||||
| CVE-2024-42214 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-27 | 5.3 Medium |
| HCL Aftermarket EPC is vulnerable to attack since HTTP OPTIONS method is enabled on this web server. The OPTIONS method provides a list of the methods that are supported by the Web server which allows an attacker to narrow and intensify their efforts. | ||||
| CVE-2024-23569 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-27 | 4.3 Medium |
| HCL Aftermarket EPC is vulnerable to attack since the server is not configured with “X-XSS-Protection" header | ||||
| CVE-2026-8505 | 1 Ibm | 1 Langflow Oss | 2026-07-27 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE). | ||||
| CVE-2026-65448 | 2026-07-27 | 6.5 Medium | ||
| Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner – AcyChecker <= 1.8.1 versions. | ||||
| CVE-2026-65447 | 2026-07-27 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. | ||||
| CVE-2026-65445 | 2026-07-27 | 6.5 Medium | ||
| Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. | ||||
| CVE-2026-65443 | 2026-07-27 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. | ||||
| CVE-2026-65442 | 2026-07-27 | 7.2 High | ||
| Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. | ||||
| CVE-2026-65437 | 2026-07-27 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions. | ||||
| CVE-2026-61957 | 2026-07-27 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. | ||||
| CVE-2026-61953 | 2026-07-27 | 7.2 High | ||
| Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. | ||||
| CVE-2026-66473 | 2026-07-27 | 7.5 High | ||
| Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | ||||
| CVE-2026-17107 | 1 Redhat | 1 Multicluster Engine | 2026-07-27 | 8.5 High |
| A flaw was found in the cluster-proxy service-proxy component used in Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. | ||||
| CVE-2026-16242 | 1 Redhat | 5 Acm, Logging, Multicluster Engine and 2 more | 2026-07-27 | 9.4 Critical |
| A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could connect as an unauthenticated agent, join the routing pool, and potentially proxy, inspect, modify, or drop control-plane-to-node traffic. | ||||
| CVE-2026-44891 | 1 Netty | 1 Netty | 2026-07-27 | 7.5 High |
| Netty is a network application framework for development of protocol servers and clients. Prior to 4.1.136.Final and 4.2.16.Final, io.netty.handler.codec.stomp.StompSubframeDecoder fails to limit the total number of headers or their cumulative size per frame, and the maxLineLength parameter only restricts individual header lines. An attacker can send a large number of short headers that are accumulated in memory inside DefaultStompHeadersSubframe until the JVM throws an OutOfMemoryError, causing denial of service for servers exposing a STOMP endpoint based on StompSubframeDecoder. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. | ||||
| CVE-2026-45623 | 1 Postcss | 1 Postcss | 2026-07-27 | 7.5 High |
| PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its content through the resulting JSON.parse SyntaxError message. The bug also yields a precise file-existence oracle and a controllable-read primitive that may be combined with large-file targets for DoS. The behaviour is triggered with PostCSS's default options — no from, no map, no plugins required — and is therefore reachable from any pipeline that runs untrusted CSS through PostCSS (CMS themes, user-uploaded styles, browser-extension/userstyle processors, build pipelines for third-party packages, blog comment renderers, etc.). This issue has been fixed in version 8.5.12. | ||||
| CVE-2026-51565 | 2026-07-27 | N/A | ||
| Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request | ||||
| CVE-2025-63913 | 2026-07-27 | N/A | ||
| An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension. | ||||
| CVE-2026-51564 | 2026-07-27 | N/A | ||
| An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request. | ||||