Export limit exceeded: 380203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 380203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (380203 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-45124 | 1 Mybb | 1 Mybb | 2026-08-18 | 4.3 Medium |
| MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected as Read handler is reachable with canmodcp even without canmanagereportedcontent or canmanagereportedposts. When no forums are in scope, $flist_reports is empty and the UPDATE mybb_reportedcontent query executes without the expected permission-based limitation. This issue is fixed in version 1.8.40. | ||||
| CVE-2026-49225 | 1 Givanz | 1 Vvveb | 2026-08-18 | 8.3 High |
| Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor. The admin/controller/product/revisions.php route reuses admin/controller/content/revisions.php, while admin/sql/sqlite/product_content_revision.sql trusts caller-controlled product_id, language_id, and created_at values without applying the current admin_id to revision reads, restores, and deletes. An attacker can read historic product content, restore a revision over another Vendor's live product content, or delete revision records, exposing private copy, corrupting product pages, and removing audit history. This issue is fixed in version 1.0.8.4. | ||||
| CVE-2026-61574 | 1 Goauthentik | 1 Authentik | 2026-08-18 | 8.8 High |
| authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, the Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that can contain stored credentials. The endpoint listing does not apply the access controls governing the endpoints, and the connection flow does not confirm that an endpoint belongs to the Remote Access Control application through which it was launched. Any authenticated user can therefore read every endpoint together with its host and stored credentials and can open a connection to an endpoint belonging to another application. This exposes stored credentials for managed RDP, SSH, and VNC targets and grants interactive access to systems the user was never authorized to reach. Deployments that do not use the enterprise Remote Access Control provider are not affected. This issue is fixed in versions 2026.2.6 and 2026.5.5. | ||||
| CVE-2026-65329 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-08-18 | 5.9 Medium |
| An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic. | ||||
| CVE-2026-16480 | 1 Ibm | 1 Db2 | 2026-08-18 | 4.3 Medium |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is affected by an improper authorization vulnerability in the certain command, allowing a non-privileged user to bypass authority checks and modify database catalog data. | ||||
| CVE-2026-43667 | 1 Apple | 3 Ios And Ipados, Ipados, Iphone Os | 2026-08-18 | 6.5 Medium |
| A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. An attacker in a privileged network position may be able to cause a denial-of-service. | ||||
| CVE-2026-65343 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-08-18 | 7.5 High |
| A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. A remote attacker may be able to cause unexpected system termination. | ||||
| CVE-2026-65346 | 1 Apple | 4 Ios And Ipados, Ipados, Iphone Os and 1 more | 2026-08-18 | 8.8 High |
| An integer overflow was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing an image may lead to arbitrary code execution. | ||||
| CVE-2026-14866 | 1 Ibm | 1 I Access Client Solutions | 2026-08-18 | 7.7 High |
| IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to injection of rogue certificate authority due to publicly writeable truststore. | ||||
| CVE-2026-12139 | 1 Tanium | 1 Connect | 2026-08-18 | 4.4 Medium |
| Tanium addressed an information disclosure vulnerability in Connect. | ||||
| CVE-2026-11925 | 1 Tanium | 2 Server, Tanium Server | 2026-08-18 | 2.7 Low |
| Tanium addressed a User Interface (UI) Misrepresentation of Critical Information vulnerability in Tanium Server. | ||||
| CVE-2026-17572 | 1 Hdfgroup | 1 Hdf5 | 2026-08-18 | 5.5 Medium |
| Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max, triggering out-of-bounds heap reads and writes in H5SM__cache_list_deserialize and H5SM__cache_list_verify_chksum. | ||||
| CVE-2026-17573 | 1 Hdfgroup | 1 Hdf5 | 2026-08-18 | 5.5 Medium |
| A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free. | ||||
| CVE-2026-17574 | 1 Hdfgroup | 1 Hdf5 | 2026-08-18 | 5.5 Medium |
| HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read. | ||||
| CVE-2026-74970 | 1 Mozilla | 1 Firefox | 2026-08-18 | 5.4 Medium |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-74968 | 1 Mozilla | 1 Firefox | 2026-08-18 | 5.4 Medium |
| Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | ||||
| CVE-2026-16441 | 1 Eclipse | 1 Openj9 | 2026-08-18 | 9.6 Critical |
| In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method. | ||||
| CVE-2026-74983 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74973 | 1 Mozilla | 1 Firefox | 2026-08-18 | 4.2 Medium |
| Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74969 | 1 Mozilla | 1 Firefox | 2026-08-18 | N/A |
| Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||