Export limit exceeded: 395060 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395060 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-61596 | 1 Djust-org | 1 Djust | 2026-09-17 | 7.1 High |
| djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object authorization (`get_object` + `has_object_permission`, ADR-017) was enforced on the WebSocket mount and event paths but not on three other render entry points: (a) the initial HTTP GET render, (b) SPA `url_change` navigation, and (c) `{% live_render %}` embedded child views. An authenticated user could therefore view (and on some paths act on) an object they are not authorized for by loading the page directly, navigating to it via SPA url-change, or composing it as an embedded child — a classic IDOR / broken object-level access control on object-scoped views. This is fixed in djust 1.0.7. All render entry points now route through a shared `enforce_object_permission` chokepoint: HTTP GET returns 403, `url_change` emits a `permission_denied` frame and skips the render, and `{% live_render %}` (eager + lazy) refuses the embed. Views without a custom `get_object` are unaffected (no-op). No reliable workaround short of upgrading. Do not expose object-scoped views through the HTTP-GET / url_change / live_render paths until patched. | ||||
| CVE-2026-50603 | 1 Acer | 1 Agent Service | 2026-09-17 | N/A |
| A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions. | ||||
| CVE-2026-25278 | 1 Qualcomm | 1 Snapdragon | 2026-09-17 | 7.8 High |
| Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying. | ||||
| CVE-2026-57846 | 2026-09-17 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-25283 | 1 Qualcomm | 1 Snapdragon | 2026-09-17 | 8.8 High |
| Memory Corruption when copying unverified data from an external source exceeds the allocated buffer size. | ||||
| CVE-2026-62101 | 2 Chris Åkerfeldt Wendel, Wordpress | 2 Eduadmin Booking, Wordpress | 2026-09-17 | 9.8 Critical |
| Unauthenticated Broken Authentication in EduAdmin Booking <= 5.4.2 versions. | ||||
| CVE-2026-66571 | 2 Gabe Livan, Wordpress | 2 Asset Cleanup: Page Speed Booster, Wordpress | 2026-09-17 | 7.1 High |
| Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions. | ||||
| CVE-2026-61793 | 1 Nuxt-modules | 1 Og-image | 2026-09-17 | N/A |
| Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0. | ||||
| CVE-2026-54692 | 2026-09-17 | 7.8 High | ||
| SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to 1.0.0, sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c allocates the decoded pixel buffer using the X11 one-byte-per-literal layout, but an X10 static short file causes the flat decode loop to write two file-controlled bytes per literal. When ceil(width/8) produces an odd row stride, the X10 literal count includes a padding byte for every row, but the destination has no space for those bytes, so loading the XBM through sail_load_from_file, sail_load_from_memory, or sail_start_loading_* produces a forward heap overwrite that scales with image height. The X11 static char path is not affected. The overwrite can corrupt process state, cause reliable crashes, and potentially enable code execution in a susceptible consuming application. This issue is fixed in version 1.0.0. | ||||
| CVE-2026-9160 | 1 Arma Digital Media | 1 Website Template | 2026-09-17 | 4.3 Medium |
| Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code Injection. This issue affects Website Template: through 11092026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2025-70819 | 1 Zettlab | 1 D6 Ultra | 2026-09-17 | 6.3 Medium |
| Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/h_etc:rw in a compose file. | ||||
| CVE-2025-70820 | 1 Zettlab | 1 D6 Ultra | 2026-09-17 | 3.5 Low |
| Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder. | ||||
| CVE-2026-38332 | 1 Cdcseacave | 1 Tinyexif | 2026-09-17 | 2.9 Low |
| TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. | ||||
| CVE-2025-63842 | 1 Repetico | 1 Web Backend | 2026-09-17 | 5.4 Medium |
| A Cross-Site Scripting (XSS) vulnerability in the web backend for the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field. | ||||
| CVE-2026-90774 | 1 Orhun | 1 Rustypaste | 2026-09-17 | 7.5 High |
| rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations. | ||||
| CVE-2025-68624 | 1 N-able | 1 Mail Assure | 2026-09-17 | 4.3 Medium |
| N-able Mail Assure through April 2026 contains a design-level authorization flaw that allows an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. When connecting to the SMTP TCP port and performing SMTP AUTH with valid credentials, the server accepts arbitrary sender domains without enforcing any domain-to-account binding. As a result, an attacker from any tenant can impersonate other tenant domains, producing messages that pass SPF and DMARC validation. NOTE: N-able's position is that the behavior is intended functionality of its shared SMTP relay architecture and that the service does not represent that it enforces per-tenant sender-domain binding. | ||||
| CVE-2023-24283 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which allows attackers to cause a Denial of Service (DoS) via a crafted save file. | ||||
| CVE-2023-24284 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the is_markable() function. | ||||
| CVE-2023-24285 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow which is triggered when an unusually long move is executed. | ||||
| CVE-2023-24286 | 1 Simon Tatham | 1 Portable Puzzle Collection | 2026-09-17 | 2.9 Low |
| Portable Puzzle Collection before 20230116.5782e29 was discovered to contain a buffer overflow via the game description parameter. | ||||