Export limit exceeded: 359267 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (359267 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-11576 | 2026-06-19 | 7.5 High | ||
| The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo refactors error handling in the HTTP server PUT process to use a shared cleanup label, but this unified cleanup path unconditionally calls fx_file_close() even when the file was never successfully opened. Multiple error branches jump to the shared cleanup label before any file open operation has occurred, causing fx_file_close() to operate on an uninitialized file handle, leading to undefined behavior, double-close issues, or memory corruption. | ||||
| CVE-2026-8296 | 2026-06-19 | N/A | ||
| In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting Payload via artifacts. | ||||
| CVE-2026-47835 | 1 Spring | 1 Spring Ai | 2026-06-19 | 8.6 High |
| In Spring AI Vector Stores, special characters could be used to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store. Affected versions: Spring AI 1.0.0 through 1.0.x (fix 1.0.9). Spring AI 1.1.0 through 1.1.x (fix 1.1.8). | ||||
| CVE-2026-41708 | 1 Spring | 1 Spring Cloud Sleuth | 2026-06-19 | 7.5 High |
| In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled. Affected versions: Spring Cloud Sleuth 3.1.0 through 3.1.13. | ||||
| CVE-2026-47825 | 1 Spring | 1 Spring Cloud Gateway | 2026-06-19 | 8.6 High |
| Spring Cloud Gateway Server forwards the X-Forwarded-For and Forwarded headers from untrusted proxies in certain configuration scenarios. This affects both the WebMVC and WebFlux Gateway Servers. Affected versions: Spring Cloud Gateway 3.1.x (fix 3.1.13). Spring Cloud Gateway 4.1.x (fix 4.1.13). Spring Cloud Gateway 4.2.x (fix 4.2.9). Spring Cloud Gateway 4.3.x (fix 4.3.5). Spring Cloud Gateway 5.0.x (fix 5.0.2). | ||||
| CVE-2026-8935 | 2 Wordpress, Wp Maps Pro | 2 Wordpress, Wp Maps Pro | 2026-06-19 | 9.8 Critical |
| The WP MAPS PRO WordPress plugin before 6.1.1 registers an unauthenticated AJAX action which, given a valid nonce that is publicly emitted on any frontend page enqueuing its map script, unconditionally creates an administrator account and returns a magic-login URL granting interactive admin access. | ||||
| CVE-2025-55642 | 1 Gpac | 2 Gpac, Mp4box | 2026-06-19 | 6.5 Medium |
| GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c). | ||||
| CVE-2025-55647 | 1 Gpac | 2 Gpac, Mp4box | 2026-06-19 | 5.5 Medium |
| An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | ||||
| CVE-2025-55648 | 1 Gpac | 2 Gpac, Mp4box | 2026-06-19 | 5.5 Medium |
| A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | ||||
| CVE-2025-55652 | 1 Gpac | 1 Mp4box | 2026-06-19 | 5.5 Medium |
| A heap buffer overflow in the gf_isom_vp_config_new function (isomedia/avc_ext.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | ||||
| CVE-2025-55660 | 1 Gpac | 1 Mp4box | 2026-06-19 | 5.5 Medium |
| A stack overflow in the gf_opus_read_length function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | ||||
| CVE-2025-55663 | 1 Gpac | 1 Mp4box | 2026-06-19 | 5.5 Medium |
| A segmentation violation in the Track_SetStreamDescriptor function (isomedia/track.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | ||||
| CVE-2025-56814 | 1 Opencpn | 1 Opencpn | 2026-06-19 | 7.8 High |
| A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters. | ||||
| CVE-2026-30121 | 1 Remotion-dev | 1 Remotion | 2026-06-19 | 9.1 Critical |
| remotion-dev remotion v4.0.409 was discovered to contain an arbitrary file write vulnerability. | ||||
| CVE-2026-38061 | 1 Tenda | 1 5g03 | 2026-06-19 | 9.8 Critical |
| Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_volume via the volume parameter. | ||||
| CVE-2026-38062 | 1 Tenda | 1 5g03 | 2026-06-19 | 9.8 Critical |
| Tenda 5G03 V05.03.02.04 (Version 1.0) is vulnerable to Command injection in the function action_set_rat_mode via the ratMode parameter. | ||||
| CVE-2026-36521 | 1 Publiccms | 1 Publiccms | 2026-06-19 | 6.1 Medium |
| PublicCMS V5.202506.d has a Cross Site Scripting (XSS) vulnerability in the site configuration management module. | ||||
| CVE-2026-38812 | 1 Ruoyi | 1 Ruoyi | 2026-06-19 | 9.8 Critical |
| RuoYi v4.8.2 is vulnerable to SQL Injection via the /tool/gen/createTable endpoint. The issue affects the code generation module and may allow an authenticated attacker with administrative privileges to access sensitive database information. | ||||
| CVE-2026-39118 | 1 Iru | 1 Kandji Agent | 2026-06-19 | 8.4 High |
| An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality. | ||||
| CVE-2026-39196 | 1 Datadoghq | 1 Vector | 2026-06-19 | 9.8 Critical |
| Datadog, Inc Vector v0.54.0 was discovered to contain a SQL injection vulnerability in the set_uri_query parameter in the KeyPartitioner::partition function. This vulnerability allows attackers to access sensitive database information via crafted SQL statements. | ||||