Export limit exceeded: 379111 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (379111 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-44846 | 1 Jumpserver | 1 Jumpserver | 2026-08-18 | 6.2 Medium |
| JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /api/v1/users/users/invite/, causing the organization invitation logic in apps/users/api/user.py to execute user.org_roles.set(org_roles) and replace the member's existing organization roles, which can escalate privileges or downgrade administrators. This issue is fixed in version 4.10.17. | ||||
| CVE-2026-43795 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-23938 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| An authenticated administrator is able to crash Zabbix server or proxy by creating specifically crafted preprocessing/script item JavaScript scripts, leading to potential denial of service. | ||||
| CVE-2026-23937 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| The Zabbix API host.get action can be exploited by authenticated users to extract a host's PSK key leading to potential loss of data integrity. | ||||
| CVE-2026-23935 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| A Zabbix administrator is able to read out of bounds memory by utilizing a flaw in script item/preprocessing (JavaScript) HttpRequest logic, leading to potential confidentiality loss. | ||||
| CVE-2026-23934 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| An authenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend validate.api.exists action, leading to potential denial of service. | ||||
| CVE-2026-23933 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed. Currently the only known exploitation scenario is for deployments that utilize both - SAML authentication and guest users. In such cases the key can be used to forge valid session cookies, potentially leading to unauthorized access. For other Zabbix deployments this does not have a known impact. | ||||
| CVE-2026-23931 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality. | ||||
| CVE-2026-23930 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential denial of service. | ||||
| CVE-2026-23929 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| Prototype pollution vulnerability in searchParamsToObject() is leading to a persistent XSS in Maps. URL parameter processing was not filtering dangerous properties like __proto__, combined with jQuery's unsafe element creation that traversed the prototype chain. | ||||
| CVE-2026-1199 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| Zabbix API and Frontend login lockout mechanism has a flaw where several unsuccessful login requests are not properly counted towards the block counter if sent simultaneously, potentially allowing for more password guesses than intended. | ||||
| CVE-2026-18077 | 1 Ibm | 1 I | 2026-08-18 | 7.5 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to a stack-based buffer overflow. | ||||
| CVE-2026-16046 | 1 Mattermost | 1 Mattermost | 2026-08-18 | 3.5 Low |
| Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21 fail to enforce run-state validation on write operations for finished playbook runs which allows a run participant to modify status, checklists, retrospective content, ownership, and participants on completed runs via REST and GraphQL API requests. Mattermost Advisory ID: MMSA-2026-00675 | ||||
| CVE-2024-44004 | 1 Wptaskforce | 2 Track \& Trace, Wpcargo Track \& Trace | 2026-08-18 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows SQL Injection. This issue affects WPCargo Track & Trace: before 8.0.4. | ||||
| CVE-2024-14045 | 1 Openboxes | 1 Openboxes | 2026-08-18 | 6.3 Medium |
| A weakness has been identified in OpenBoxes up to 0.9.2. This vulnerability affects unknown code of the file grails-app/controllers/org/pih/warehouse/RoleInterceptor.groovy of the component Product Supplier Edit Controller. Executing a manipulation can lead to improper authorization. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Upgrading to version 0.9.3 is able to resolve this issue. This patch is called f767ac1a5987d4865d9f158c6a967680f8e45468. It is suggested to upgrade the affected component. | ||||
| CVE-2026-67919 | 2026-08-18 | 9.8 Critical | ||
| An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the PluginEndpoint.java, installFromUri method, and DefaultPluginApplicationContextFactory components | ||||
| CVE-2026-74945 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Information disclosure in the Graphics: Text component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74989 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Internally found bugs present in Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-23922 | 1 Zabbix | 1 Zabbix | 2026-08-18 | N/A |
| The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint. | ||||
| CVE-2026-74974 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||