Export limit exceeded: 370924 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 370924 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370924 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55685 | 1 Remix-run | 1 React-router | 2026-07-28 | N/A |
| React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<RouterProvider>). This issue has been fixed in version 7.18.0. | ||||
| CVE-2026-65439 | 2 Themefic, Wordpress | 2 Ultimate Addons For Contact Form 7, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. | ||||
| CVE-2026-65446 | 2 Wordpress, Wp Chill | 2 Wordpress, Kali Forms | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. | ||||
| CVE-2026-9046 | 1 Lenovo | 2 App Store, Legion Zone | 2026-07-28 | 7 High |
| A potential insecure permissions vulnerability was reported in Legion Zone and the Lenovo App Store Windows applications, distributed exclusively in the Chinese market, that when installed on a non‑system partition, could allow a local user to execute arbitrary code. | ||||
| CVE-2026-10589 | 2026-07-28 | 6 Medium | ||
| A potential out of bounds write vulnerability could allow a local privileged attacker to execute code in System Management Mode. | ||||
| CVE-2026-64646 | 1 Vercel | 1 Next.js | 2026-07-28 | N/A |
| Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11. | ||||
| CVE-2026-56747 | 1 Cribl | 1 Cribl Stream | 2026-07-28 | 8.8 High |
| Improper control of generation of code in the JSON Pointer-to-accessor compiler in Cribl Stream before 4.18.2 allows a remote authenticated attacker with edit privileges to execute arbitrary JavaScript on the server via a crafted database connection identifier or pack configuration value. | ||||
| CVE-2026-56748 | 1 Cribl | 1 Cribl Stream | 2026-07-28 | 8.8 High |
| Improper validation of symbolic links in the Pack Git import feature in Cribl Stream before 4.18.2 allows a remote authenticated attacker with Pack import and pipeline preview permissions to execute arbitrary code as the Cribl server process via a crafted Git repository containing a symbolic link in the pack's functions directory. | ||||
| CVE-2026-43693 | 1 Apple | 1 Macos | 2026-07-28 | 7 High |
| A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges. | ||||
| CVE-2026-43755 | 1 Apple | 1 Macos | 2026-07-28 | 7 High |
| A race condition was addressed with improved state management. This issue is fixed in macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges. | ||||
| CVE-2026-43698 | 1 Apple | 1 Macos | 2026-07-28 | 7.8 High |
| An injection issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. An app may be able to gain root privileges. | ||||
| CVE-2026-43776 | 1 Apple | 2 Ios And Ipados, Macos | 2026-07-28 | 7.8 High |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15.7.8, macOS Tahoe 26.6. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution. | ||||
| CVE-2026-53666 | 1 Remix-run | 1 React-router | 2026-07-28 | 6.1 Medium |
| React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very specific (and unlikely) application-layer code. Note that this does not impact an application if it is using Declarative Mode. It only impacts Framework Mode and Data Mode applications that perform manual SSR/hydration. This issue has been fixed in version 7.18.0. | ||||
| CVE-2026-53667 | 1 Remix-run | 1 React-router | 2026-07-28 | 6.9 Medium |
| React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0. | ||||
| CVE-2026-53668 | 1 Remix-run | 1 React-router | 2026-07-28 | 6.9 Medium |
| React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0. | ||||
| CVE-2026-65438 | 2 Kofimokome, Wordpress | 2 Message Filter For Contact Form 7, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. | ||||
| CVE-2026-65440 | 2 Roxnor, Wordpress | 2 Getgenie, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. | ||||
| CVE-2026-65441 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. | ||||
| CVE-2021-32084 | 1 Quest | 1 Kace Systems Deployment Appliance | 2026-07-28 | N/A |
| An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. If a customer restricts access to the web console by IP address or subnets, the API endpoints are not restricted. If credentials/API keys are known to an attacker, the appliance can still be accessed via the API, leading to a potential compromise of the entire environment that is configured for KACE. | ||||
| CVE-2021-32087 | 1 Quest | 1 Kace Systems Deployment Appliance | 2026-07-28 | N/A |
| An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems. | ||||