Export limit exceeded: 384626 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (384626 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82462 | 1 Pac4j | 1 Pac4j | 2026-08-29 | 6.5 Medium |
| pac4j-oidc before 6.5.6 accepts OIDC callbacks carrying only an access token without authorization code or ID token validation. Attackers can substitute access tokens minted for other clients to create authenticated sessions without proper issuer, audience, nonce, or subject verification. | ||||
| CVE-2026-82461 | 1 Pac4j | 1 Pac4j | 2026-08-29 | 8.1 High |
| pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j role validation. | ||||
| CVE-2026-82460 | 2026-08-29 | 9.8 Critical | ||
| Cloud Commander before 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory. | ||||
| CVE-2026-65813 | 1 Microsoft | 9 Exchange Server, Exchange Server 2016, Exchange Server 2019 and 6 more | 2026-08-29 | 6.5 Medium |
| Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69836 | 1 Microsoft | 2 Entra Id, Microsoft Entra Id | 2026-08-29 | 10 Critical |
| Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-82453 | 1 Iot-ecology | 1 Rust-iot-platform | 2026-08-29 | 7.5 High |
| rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts. | ||||
| CVE-2026-82454 | 1 Omnivore-app | 1 Omnivore | 2026-08-29 | 9.1 Critical |
| The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account. | ||||
| CVE-2026-82477 | 2026-08-29 | 5.8 Medium | ||
| In MITRE SAF Heimdall 2.11.6 through 2.13.x before 2.14.0, an SSRF issue allows remote attackers to access internal network resources via the Tenable proxy endpoint. This occurs in apps/backend/src/tenable/tenable.controller.ts. | ||||
| CVE-2026-82452 | 1 Iot-ecology | 1 Rust-iot-platform | 2026-08-29 | 9.8 Critical |
| rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials. | ||||
| CVE-2026-37751 | 2026-08-29 | 9.8 Critical | ||
| An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary commands via a crafted input. | ||||
| CVE-2026-82457 | 2026-08-29 | 7.8 High | ||
| su-exec through 0.3 fails to validate numeric user and group identifiers parsed with strtol before assigning to uid_t and gid_t, allowing truncation of out-of-range values to zero. Attackers can supply large numeric identifiers that truncate to root's identifier, causing su-exec to execute target programs with root privileges instead of intended unprivileged accounts. | ||||
| CVE-2026-82456 | 2026-08-29 | 10 Critical | ||
| argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources. | ||||
| CVE-2026-82455 | 1 Rubygems | 1 Rubygems | 2026-08-29 | 7.1 High |
| RubyGems fails to re-validate path containment after filesystem symlink resolution during gem extraction. When a pre-existing symlink inside the destination directory points outside the extraction root, extracted files that appear to be written under the destination directory can instead be written outside of it, breaking the extraction safety boundary. The fix resolves the real path of the parent directory before writing and raises Gem::Package::PathError if it escapes the destination directory. | ||||
| CVE-2026-82451 | 1 Formwork Project | 1 Formwork | 2026-08-29 | 6.1 Medium |
| Formwork through 2.3.14 contains a stored cross-site scripting vulnerability in visit tracking that records the Referer header host unescaped. Unauthenticated attackers can craft malicious Referer headers to inject markup that executes in administrator browsers when viewing the Statistics panel. | ||||
| CVE-2026-82450 | 1 Bookstackapp | 1 Bookstack | 2026-08-29 | 8.8 High |
| BookStack before 26.05.4 contains a remote code execution vulnerability in the portable ZIP import functionality that allows users with Import Content and Create Books permissions to upload a PHP polyglot file as a book cover. Attackers can bypass image extension validation by embedding a PHP file with a .php filename in the ZIP archive, which is stored in the public web root and executed by unauthenticated requests. | ||||
| CVE-2026-14494 | 2 Bdthemes, Wordpress | 2 Sigmaforms Pro – Ai Generated Forms, Wordpress | 2026-08-29 | 9.8 Critical |
| The Sigma Forms Pro plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.4.5 via the handle_form_submission function. This is due to the plugin dynamically granting the unfiltered_upload capability to all users during form submissions and bypassing MIME type validation when allowed_file_types is not configured. This makes it possible for unauthenticated attackers to execute code on the server. Several default pre-built templates including Job Application, Support Ticket, and Wholesale Application have file upload fields with no file type restrictions configured by design, making this vulnerability immediately exploitable upon installation. | ||||
| CVE-2026-82449 | 1 Cockpit-hq | 1 Cockpit | 2026-08-29 | 5.3 Medium |
| Cockpit CMS before 2.14.1 contains an account enumeration vulnerability in the auth check endpoint due to timing discrepancies in password verification. Attackers can measure response times across multiple requests to determine which accounts exist by observing that existing accounts trigger bcrypt verification while non-existent accounts return immediately. | ||||
| CVE-2026-80591 | 1 Linux | 1 Linux Kernel | 2026-08-29 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: f2fs: fix listxattr handling of corrupted xattr entries Validate the xattr entry before reading its fields in f2fs_listxattr(). Return -EFSCORRUPTED when the entry is outside the valid xattr storage area instead of returning a successful partial result. | ||||
| CVE-2026-82448 | 2026-08-29 | 9.8 Critical | ||
| Shinobi before commit 5a76c74f contains a hardcoded connection key in the child node service that allows unauthenticated attackers to execute arbitrary database queries. Attackers reaching the child node port can present the hardcoded key during WebSocket handshake, then dispatch SQL queries through the onWebSocketDataFromChildNode handler to read and modify user records and camera configuration. | ||||
| CVE-2026-82447 | 2026-08-29 | 8.8 High | ||
| Skyvern before 1.0.45 contains a sandbox escape vulnerability in TextPromptBlock that renders prompts twice, first through a sandboxed Jinja environment and then through an unsandboxed environment. Attackers can inject malicious Jinja template syntax through workflow parameters or upstream block output to execute arbitrary code with server process privileges. | ||||