Export limit exceeded: 389787 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389787 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-21092 | 2026-09-10 | N/A | ||
| Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege. | ||||
| CVE-2026-21091 | 2026-09-10 | N/A | ||
| Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21090 | 2026-09-10 | N/A | ||
| Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21087 | 2026-09-10 | N/A | ||
| Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privilege. | ||||
| CVE-2026-21086 | 2026-09-10 | N/A | ||
| Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration. | ||||
| CVE-2026-21085 | 2026-09-10 | N/A | ||
| Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory. | ||||
| CVE-2026-19201 | 2026-09-10 | N/A | ||
| An uncontrolled recursion vulnerability in the Windows SIPA event log parser of Google go-attestation versions up to and including 0.6.1 allows an attacker to cause a denial of service (DoS). The (*WinEvents).readELAMAggregation function recurses for every nested elamAggregation sub-event without enforcing a maximum recursion depth limit, while the size guard is bypassed on recursive execution paths. By submitting a crafted Windows event log containing deeply nested elamAggregation headers, an attacker can exhaust the goroutine call stack, triggering an unrecoverable fatal runtime error (stack overflow) that immediately crashes the verifier application. | ||||
| CVE-2026-18147 | 1 Redhat | 1 Enterprise Linux | 2026-09-10 | 8.1 High |
| A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted. | ||||
| CVE-2025-71417 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 6.5 Medium |
| PocketMine-MP before 5.32.1 fails to validate uniqueness of pack UUIDs in ResourcePackClientResponsePacket STATUS_SEND_PACKS handling, allowing authenticated clients to trigger duplicate pack transmissions. Attackers can send multiple copies of valid pack UUIDs in a single packet to exhaust server memory and cause denial of service. | ||||
| CVE-2025-46808 | 2026-09-10 | 6.8 Medium | ||
| An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager container’s log This issue affects neuvector: before 5.4.5. | ||||
| CVE-2023-54395 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 4.3 Medium |
| PocketMine-MP versions before 4.12.5 contain a denial-of-service vulnerability in ModalFormResponsePacket processing that allows attackers to cause server resource exhaustion by sending large JSON payloads. Attackers can send numerous oversized modal form response packets to consume CPU time and prevent the server from processing legitimate connections. | ||||
| CVE-2023-54355 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 7.5 High |
| PocketMine-MP versions before 5.3.1 and 4.23.1 fail to validate that the identityPublicKey in LoginPacket uses the required secp384r1 elliptic curve. Attackers can provide LoginPackets with keys using different curves or non-EC key types to pass login verification but trigger an uncaught exception during ECDH key derivation, crashing the server. | ||||
| CVE-2026-78523 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-10 | 5.9 Medium |
| Use after free in Windows DNS allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-80075 | 1 Microsoft | 10 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-09-10 | 7.8 High |
| Heap-based buffer overflow in Windows Work Folders allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-87450 | 1 Google | 1 Chrome | 2026-09-10 | 7.5 High |
| Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-79741 | 1 Dell | 1 Secure Connect Gateway | 2026-09-10 | 5.3 Medium |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection. | ||||
| CVE-2026-78493 | 1 Dell | 1 Secure Connect Gateway | 2026-09-10 | 5.5 Medium |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution. | ||||
| CVE-2026-79945 | 1 Dell | 1 Secure Connect Gateway | 2026-09-10 | 5.5 Medium |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to command execution. | ||||
| CVE-2026-38626 | 2026-09-10 | N/A | ||
| Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. | ||||
| CVE-2026-86199 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-10 | 7.5 High |
| PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated players can trigger an uninitialized property access error that crashes the server. | ||||