Export limit exceeded: 372322 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372322 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-53412 | 1 Zoom Communications | 1 Zoom Workplace | 2026-07-30 | 9.8 Critical |
| Improper Input Validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an account takeover via network access. | ||||
| CVE-2026-58598 | 1 Microsoft | 10 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-07-30 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-51080 | 1 Proxmox | 2 Libpve-storage-perl, Libpvestorage-perl | 2026-07-30 | 9.8 Critical |
| libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. | ||||
| CVE-2026-51083 | 1 Proxmox | 1 Proxmox | 2026-07-30 | 6.5 Medium |
| Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API. | ||||
| CVE-2026-42168 | 1 Abhishek-ram | 1 Django-pyas2 | 2026-07-30 | 9.1 Critical |
| django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent. | ||||
| CVE-2026-52348 | 1 Cool-team-official | 1 Cool-admin-java | 2026-07-30 | 9.8 Critical |
| cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. | ||||
| CVE-2026-63071 | 1 Apache | 1 Syncope | 2026-07-30 | 9.8 Critical |
| Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox. | ||||
| CVE-2025-66390 | 1 Microsoft | 1 Azure Api Management | 2026-07-30 | 9.8 Critical |
| In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier states that they evaluated the report and determined it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). NOTE: The supplier evaluated this report and determined that it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). | ||||
| CVE-2025-63913 | 1 Luojia65 | 1 Opensbi | 2026-07-30 | 7.5 High |
| An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension. | ||||
| CVE-2026-51564 | 1 Giuliopanda | 1 Milk Admin | 2026-07-30 | 4.9 Medium |
| An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request. | ||||
| CVE-2026-51565 | 1 Giuliopanda | 1 Milk Admin | 2026-07-30 | N/A |
| Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request | ||||
| CVE-2026-17524 | 1 Fpsqdb | 1 Zip-lib | 2026-07-30 | 7.5 High |
| Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, only checks and caches the path status when the initial directory symlink is created during the first extraction. | ||||
| CVE-2025-65337 | 1 Sourcecodester | 1 Fantastic Blog Cms | 2026-07-30 | 6.1 Medium |
| Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting (XSS) in pageEditMember.php via the address field. | ||||
| CVE-2025-67403 | 1 Sourcecodester | 1 Casap Automated Enrollment System | 2026-07-30 | 9.8 Critical |
| Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_class.php via the parameter class_name. | ||||
| CVE-2025-67404 | 1 Sourcecodester | 1 Casap Automated Enrollment System | 2026-07-30 | 9.8 Critical |
| Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in save_stud.php via the parameters fname, lname, and student_class. | ||||
| CVE-2025-67405 | 1 Sourcecodester | 1 Casap Automated Enrollment System | 2026-07-30 | 7.3 High |
| Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password. | ||||
| CVE-2025-67407 | 1 Sourcecodester | 1 Sourcecodester Casap Automated Enrollment System | 2026-07-30 | 7.3 High |
| Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_student.php via parameters fname and student_class. | ||||
| CVE-2025-67408 | 1 Sourcecodester | 1 Casap Automated Enrollment System | 2026-07-30 | 7.3 High |
| Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in /save_user.php via the parameter status. | ||||
| CVE-2026-18201 | 1 Redhat | 7 Build Keycloak, Build Of Keycloak, Data Grid and 4 more | 2026-07-30 | 5.5 Medium |
| Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations. | ||||
| CVE-2026-58162 | 1 Apache | 1 Traffic Server | 2026-07-30 | 10 Critical |
| The Apache Traffic Server certifier plugin generates certificates based on attacker-controlled client SNI. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fix the issue. | ||||