Export limit exceeded: 385329 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385329 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-40018 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 7.4 High |
| None None None No publicly available exploits are known. | ||||
| CVE-2026-84120 | 2026-09-01 | 5.4 Medium | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, and Firefox ESR 153.2. | ||||
| CVE-2026-84117 | 1 Mozilla | 1 Firefox | 2026-09-01 | 8.8 High |
| Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 155. | ||||
| CVE-2026-82922 | 1 Shopex | 1 Ecshop | 2026-09-01 | 7.3 High |
| A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82908 | 1 Msi | 1 Dragon Center | 2026-09-01 | 8.8 High |
| A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-40019 | 1 Open-xchange | 1 Ox Dovecot Ce | 2026-09-01 | 5.9 Medium |
| An unauthenticated attacker can send a truncated quoted argument to the ManageSieve login process, which makes it spin in an infinite loop consuming CPU. This can cause degradation or denial of service for Sieve script management, and repeated connections can consume all available CPU on the server. Monitor system for abnormal CPU usage and kill the offending process. Restrict network access to the ManageSieve service to trusted clients. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-82833 | 1 Doccano | 2 Auto Labeling Pipeline Module To Annotate A Document Automatically, Open Source Annotation Tools For Machine Learning Practitioners | 2026-09-01 | 6.3 Medium |
| A vulnerability was identified in Doccano Open Source Annotation Tools for Machine Learning Practitioners and Auto Labeling Pipeline Module to Annotate a Document Automatically up to 1.8.5. Affected by this issue is the function ExampleDetail of the file /v1/projects/1/examples/ of the component Project Example Detail Endpoint. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82487 | 1 Beetel | 1 450tc3 | 2026-09-01 | 6.3 Medium |
| A vulnerability was determined in Beetel 450TC3 01.00.00_01. This affects an unknown part. Executing a manipulation can lead to weak password recovery. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82482 | 1 Coppermine-gallery | 1 Coppermine Photo Gallery | 2026-09-01 | 3.5 Low |
| A security vulnerability has been detected in coppermine-gallery Coppermine Photo Gallery up to 1.6.28. This affects an unknown function of the file profile.php of the component edit_profile Endpoint. The manipulation of the argument Biography leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.6.29 mitigates this issue. Upgrading the affected component is recommended. | ||||
| CVE-2026-82395 | 1 Sulu | 1 Sulu | 2026-09-01 | N/A |
| Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the media move endpoint derives its permission check from the client-supplied collection value instead of the media item's actual source collection, and src/Sulu/Bundle/MediaBundle/Media/Manager/MediaManager.php allows MediaManager::move() to reassign the item without checking that source. An authenticated backend user with edit permission on one collection and knowledge of a target media identifier can name the allowed collection in the request, move an item out of a restricted collection, and then view or download content the user was not permitted to access. This issue is fixed in versions 2.6.25 and 3.0.8. | ||||
| CVE-2026-82226 | 2 Tickera, Wordpress | 2 Tickera, Wordpress | 2026-09-01 | 9.8 Critical |
| Unauthenticated PHP Object Injection in Tickera <= 3.6.0.2 versions. | ||||
| CVE-2026-40203 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 3.7 Low |
| When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can confirm whether the body of a small message matches a guessed text. Recovery of arbitrary unknown content was not demonstrated, but the attack can disclose whether a secret-like message body matches a candidate. Disable IMAP compression. Update to non-vulnerable version. No publicly available exploits are known. | ||||
| CVE-2026-81779 | 2 Silk Themes, Wordpress | 2 Newspapers X, Wordpress | 2026-09-01 | 10 Critical |
| Improper Validation of Specified Quantity in Input vulnerability in Silk Themes Newspapers X allows Malicious Software Implanted. This issue affects Newspapers X: from 1.0.46 through 1.0.48. | ||||
| CVE-2026-81778 | 2 The4, Wordpress | 2 Kalles Addons, Wordpress | 2026-09-01 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions. | ||||
| CVE-2026-81762 | 2 Magepeople, Wordpress | 2 Booking & Rental Manager, Wordpress | 2026-09-01 | 6.5 Medium |
| Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions. | ||||
| CVE-2026-40204 | 1 Open-xchange | 2 Ox Dovecot Ce, Ox Dovecot Pro | 2026-09-01 | 3.1 Low |
| None None None No publicly available exploits are known. | ||||
| CVE-2026-81296 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Forms Pro Add On Pack | 2026-09-01 | 7.5 High |
| Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions. | ||||
| CVE-2026-78576 | 2 Readabler, Wordpress | 2 Readabler, Wordpress | 2026-09-01 | N/A |
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||||
| CVE-2026-78572 | 2026-09-01 | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||||
| CVE-2026-78570 | 2 Klbtheme, Wordpress | 2 Total Donations, Wordpress | 2026-09-01 | N/A |
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||||