Export limit exceeded: 386742 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386742 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86144 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 5.6 Medium |
| In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). | ||||
| CVE-2026-86143 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 6.9 Medium |
| In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback. | ||||
| CVE-2026-86142 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 6.9 Medium |
| In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. | ||||
| CVE-2026-86141 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 2.9 Low |
| xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. | ||||
| CVE-2026-86140 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 8 High |
| In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. | ||||
| CVE-2026-86139 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 6.9 Medium |
| In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. | ||||
| CVE-2026-86138 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 6.9 Medium |
| In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. | ||||
| CVE-2026-86137 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 2.9 Low |
| In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. | ||||
| CVE-2026-79419 | 2026-09-05 | N/A | ||
| A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser. | ||||
| CVE-2026-71624 | 1 Esotalk | 1 Esotalk | 2026-09-05 | N/A |
| An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components | ||||
| CVE-2026-75438 | 1 Open5gs | 1 Open5gs | 2026-09-05 | N/A |
| Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function | ||||
| CVE-2026-9736 | 1 Ibm | 1 Netezza Software | 2026-09-05 | 5.3 Medium |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files. | ||||
| CVE-2026-85444 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.5 High |
| MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory. | ||||
| CVE-2026-85439 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.8 High |
| MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit. | ||||
| CVE-2026-85434 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 9.1 Critical |
| MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses. | ||||
| CVE-2026-85429 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.5 High |
| MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation. | ||||
| CVE-2026-85424 | 1 Themoos | 1 Core-moos | 2026-09-05 | 9.8 Critical |
| MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues. | ||||
| CVE-2026-85395 | 1 Webkul | 1 Unopim | 2026-09-05 | 7.1 High |
| UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware. | ||||
| CVE-2026-85225 | 1 Code-projects | 1 Doctor Appointment System | 2026-09-05 | 7.3 High |
| A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-85207 | 1 Itsourcecode | 1 Online Medicine Delivery System | 2026-09-05 | 3.5 Low |
| A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. | ||||