Export limit exceeded: 378217 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (378217 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58444 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.3 Medium |
| Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | ||||
| CVE-2026-58437 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.1 High |
| Repository Visibility Manipulation via Git Push Options | ||||
| CVE-2026-55986 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 5.4 Medium |
| Email Management API Bypasses ManageCredentials Feature Restrictions | ||||
| CVE-2026-18150 | 1 Ibm | 1 I | 2026-08-14 | 4.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition. | ||||
| CVE-2026-17445 | 1 Ibm | 1 I | 2026-08-14 | 8.2 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name. | ||||
| CVE-2026-17229 | 1 Ibm | 1 I | 2026-08-14 | 7.5 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop. | ||||
| CVE-2026-17078 | 1 Ibm | 1 I | 2026-08-14 | 5.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion. | ||||
| CVE-2026-16908 | 1 Ibm | 1 I | 2026-08-14 | 8.5 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability. | ||||
| CVE-2026-16896 | 1 Ibm | 1 I | 2026-08-14 | 7.1 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race condition. | ||||
| CVE-2026-16867 | 1 Ibm | 1 I | 2026-08-14 | 8.1 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to access server resources with the privileges of an authenticated user due to improper authentication during NTLM session negotiation. | ||||
| CVE-2026-16853 | 1 Ibm | 1 I | 2026-08-14 | 6.5 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. | ||||
| CVE-2026-16722 | 1 Ibm | 1 I | 2026-08-14 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management. | ||||
| CVE-2026-14525 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-08-14 | 9.4 Critical |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. | ||||
| CVE-2026-13610 | 2 Iqonic, Wordpress | 2 Kivicare, Wordpress | 2026-08-14 | 7.5 High |
| The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data. | ||||
| CVE-2026-13328 | 2026-08-14 | 5.3 Medium | ||
| The Food Menu WordPress plugin before 6.0.2 does not perform any capability or ownership check on its reservation-status update action, which is also exposed to unauthenticated users and gated only by a nonce that is publicly available to visitors, allowing unauthenticated attackers to change the status of arbitrary reservations. | ||||
| CVE-2026-11932 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-08-14 | 5.3 Medium |
| IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack. | ||||
| CVE-2026-66454 | 2 Maruti Mohanty, Wordpress | 2 Wp Social Avatar, Wordpress | 2026-08-14 | 6.5 Medium |
| Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions. | ||||
| CVE-2026-66426 | 2 Lesterchan, Wordpress | 2 Wp-stats, Wordpress | 2026-08-14 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP-Stats <= 2.56 versions. | ||||
| CVE-2026-5428 | 2 Wordpress, Wproyal | 2 Wordpress, Royal Addons For Elementor – Addons And Templates Kit For Elementor | 2026-08-14 | 6.4 Medium |
| The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget. | ||||
| CVE-2026-19654 | 1 Redhat | 1 Enterprise Linux | 2026-08-14 | 7.5 High |
| A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. | ||||