Export limit exceeded: 30126 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (30126 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78987 | 1 Google | 1 Chrome | 2026-08-28 | 4.3 Medium |
| Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78943 | 1 Google | 1 Chrome | 2026-08-28 | 3.1 Low |
| Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2025-61164 | 2026-08-28 | 7.5 High | ||
| Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. | ||||
| CVE-2026-75099 | 1 Apache | 1 Allura | 2026-08-28 | 5.3 Medium |
| Unauthenticated REST disclosure of certain content items in Apache Allura. This issue affects Apache Allura: through 1.19.1. Users are recommended to upgrade to version 1.20.0, which fixes the issue. | ||||
| CVE-2026-43678 | 1 Apple | 1 Swiftnio | 2026-08-28 | 5.3 Medium |
| An unauthenticated remote peer can crash any NIOWebSocket-based server (including Vapor and Hummingbird) with a single 11-byte frame sent after a completed WebSocket handshake, dropping all active connections until the process restarts. This vulnerability is addressed in swift-nio version 2.101.0. | ||||
| CVE-2026-19084 | 2026-08-28 | 7.5 High | ||
| The shared-files-pro WordPress plugin before 1.7.70 does not validate the file path supplied when creating a featured image, allowing unauthenticated attackers to read arbitrary files from the server and republish their contents at a public URL. | ||||
| CVE-2026-78500 | 1 Watchguard | 1 Dimension | 2026-08-28 | N/A |
| A blind server-side request forgery (SSRF) vulnerability WatchGuard Dimension Database Server Test configuration allows an authenticated privileged attacker to enumerate exposed network services on adjacent network systems. | ||||
| CVE-2026-80594 | 1 Linux | 1 Linux Kernel | 2026-08-28 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - fix potential infinite loop in CDC union descriptor parsing The driver parses CDC union descriptors in ims_pcu_get_cdc_union_desc() by iterating through the extra descriptor data. However, it does not verify that the bLength of each descriptor is at least 2. A malicious device could provide a descriptor with bLength = 0, leading to an infinite loop in the driver. Add a check to ensure bLength is at least 2 before proceeding with parsing. | ||||
| CVE-2026-57499 | 1 Limanmys | 1 Core | 2026-08-28 | 9.1 Critical |
| Liman is open source server management software. Prior to 2.2.2 - 1103, an OS command injection vulnerability in the log rotation configuration endpoint allows an authenticated administrator to execute arbitrary operating system commands on the Liman server. The `ip_address` parameter is embedded directly into a shell command without sanitization, enabling shell escape via single-quote injection. This is fixed in 2.2.2 - 1103. | ||||
| CVE-2026-59640 | 2 Bouncycastle, Legion Of The Bouncy Castle Inc. | 6 Bc-java, Bcpg-fips, Bouncy Castle For Java Lts and 3 more | 2026-08-28 | 5.3 Medium |
| In Bouncy Castle for Java before 1.85, OpenPGP CFB quick-check oracle active on symmetric/session-key paths. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). | ||||
| CVE-2026-14567 | 2026-08-28 | 5.3 Medium | ||
| The User Frontend WordPress plugin before 4.3.10 does not restrict access to its user directory search endpoint, allowing unauthenticated attackers to retrieve the email address and phone number of every registered user, including administrators. | ||||
| CVE-2026-81827 | 1 Flowintel | 1 Flowintel | 2026-08-28 | N/A |
| Affected versions of Flowintel incorrectly attempted to validate login email addresses by calling Email(email). That does not perform WTForms field validation; it merely constructs a validator object. Consequently, malformed attacker-controlled email input could continue through the login process and be written to security-relevant logs. The vulnerable code inserted the supplied email into both a warning log and the custom audit logger. Since CR/LF characters were not escaped, an unauthenticated attacker could potentially inject additional physical log lines or forge misleading log entries. The patch corrects the validation call to Email()(form, form.email), changes the standard logging call to parameterized logging, and introduces _sanitize_log_fragment() so carriage returns and line feeds are encoded instead of creating new records. Version impacted >=3.3.0 | ||||
| CVE-2026-11754 | 1 Seres Software | 1 Syweb | 2026-08-28 | 5.3 Medium |
| Observable discrepancy vulnerability in Seres Software syWEB allows Account Footprinting. This issue affects syWEB: through 27082026. NOTE: The vendor was contacted and it was learned that the product is not supported. | ||||
| CVE-2026-81732 | 1 Wwbn | 1 Avideo | 2026-08-28 | N/A |
| WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization. | ||||
| CVE-2026-78009 | 1 Watchguard | 1 Fireware Os | 2026-08-28 | N/A |
| An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic. | ||||
| CVE-2026-78980 | 1 Google | 1 Chrome | 2026-08-28 | 4.3 Medium |
| Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-79095 | 1 Google | 1 Chrome | 2026-08-28 | 4.3 Medium |
| Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79015 | 1 Google | 1 Chrome | 2026-08-28 | 4.3 Medium |
| Improper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-79105 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-08-28 | 4.3 Medium |
| Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-79220 | 1 Google | 1 Chrome | 2026-08-28 | 5.3 Medium |
| Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||