Export limit exceeded: 373341 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 373341 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373341 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48063 | 1 Whiskeysockets | 1 Baileys | 2026-08-05 | N/A |
| Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious payload via the placeholderResendMessage and trigger a fake messages.upsert event with a fake message key and payload. This allows anyone to spoof messages. The same exploit also allows an attacker to corrupt the app state sync system by sending fake key shares, and also allows for history sync spoofing which also serves the same problem, injecting fake previous context or "on-demand" sync. This issue has been fixed in versions 6.7.22 and 7.0.0-rc12. | ||||
| CVE-2026-41447 | 1 Zucchetti S.p.a. | 1 Firmacheck | 2026-08-05 | 7.8 High |
| FirmaCheck for Windows before 1.3.16 contains a dll hijacking vulnerability that allows local attackers to execute arbitrary code by placing a crafted openssl.cnf file in the unvalidated C:\Program Files (x86)\Common Files\SSL\ directory path. Attackers can write a malicious OpenSSL configuration file referencing an attacker-controlled DLL to achieve code execution at startup process privilege level when FirmaCheck.exe runs automatically at system startup. | ||||
| CVE-2026-18667 | 1 Tenable | 1 Sensor Proxy | 2026-08-05 | 9.6 Critical |
| A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host. | ||||
| CVE-2026-66316 | 1 Microsoft | 2 Edge Chromium, Microsoft Edge (chromium-based) | 2026-08-05 | 5.4 Medium |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2025-29296 | 1 H3c | 7 Magic Be18000, Magic Ne36 Pro, Magic Nx15 and 4 more | 2026-08-05 | 9.8 Critical |
| H3C Magic BE18000 V200R007, H3C NX400 V100R015, H3C Magic NX30 Pro V100R0011, H3C Magic R3010 V100R009, H3C Magic NX15 V100R017, H3C Magic R1510 V100R016, and H3C NE36 Pro V100R002 contain multiple command injection vulnerabilities in the /api/esps request handler. The affected object interfaces and methods are esps.dhcpd.vlan (getlist, delete), esps.filter.url (add, modify), esps.apcm.version (delete, H3C Magic NX15 only), esps.swcm.version (delete, upgrade, all affected models except H3C Magic NX15), and esps.system.ntp (set, all affected models except H3C Magic NX15). Attacker-controlled request parameters are incorporated into shell expressions executed by eval without adequate validation, allowing a remote attacker to execute arbitrary commands as root and gain complete control of the affected device. | ||||
| CVE-2026-11835 | 1 Caliptra | 1 Core Rom | 2026-08-05 | N/A |
| Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1. | ||||
| CVE-2026-16547 | 2 Pete Nelson, Wordpress | 2 Rest Api Log, Wordpress | 2026-08-05 | 5.9 Medium |
| The REST API Log WordPress plugin before 1.7.1 does not bind the token protecting its log download feature to the log entry being requested, nor does it check the capability of the requester, allowing unauthenticated users in possession of any such token to download the logged REST API requests and responses of any entry, which may contain sensitive data such as credentials, authentication tokens or private content. | ||||
| CVE-2026-16548 | 2 Chat Widget, Wordpress | 2 Floating Customer Support Button For 30+ Channels, Supporting Sms, Calls, And Chat, Wordpress | 2026-08-05 | 5.4 Medium |
| The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an unauthenticated user can upload arbitrary files. The original extension is discarded (files are stored under a bare UUID), so this does not yield code execution or stored XSS; impact is bounded to disk consumption and content hosting. The storing path requires the channel's response storage or mail-forwarding to be configured. | ||||
| CVE-2026-67243 | 1 Refirio | 1 Freo2 | 2026-08-05 | N/A |
| freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands. | ||||
| CVE-2026-18754 | 1 Geovision Inc. | 1 Gv-as1620 (gv-cloud) | 2026-08-05 | 9.1 Critical |
| The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing. | ||||
| CVE-2026-18759 | 1 Asustor | 1 Abp And Aes | 2026-08-05 | N/A |
| The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication (IPC) mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the key and forge valid IPC requests. Furthermore, the service does not check the identity of the requesting process and validates destination paths using an insufficient substring check. A local attacker can submit crafted encrypted requests containing directory traversal sequences to perform arbitrary file reads and arbitrary file writes as NT AUTHORITY\SYSTEM, leading to full local privilege escalation. Affected products and versions include: ABP (ASUSTOR Backup Plan) 2.0.7.10171 and earlier as well as AES (ASUSTOR EZSync) 1.1.1.3113 and earlier. | ||||
| CVE-2026-15721 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 9.8 Critical |
| Cleartext storage of sensitive information vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows SQL Injection. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14175 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 9.8 Critical |
| Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14194 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 6.5 Medium |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Path Traversal. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14219 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 5.4 Medium |
| URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14804 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 9.1 Critical |
| Use of hard-coded cryptographic key vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Read Sensitive Constants Within an Executable. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14838 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 7.4 High |
| Use of GET request method with sensitive query strings vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Session Hijacking. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14192 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14465 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 6.5 Medium |
| Insufficient session expiration vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Reusing Session IDs (aka Session Replay). This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||
| CVE-2026-14202 | 1 Bilin Software And Informatics Consultancy Inc. | 1 Humanist Digital Human Resources | 2026-08-05 | 5.3 Medium |
| Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1. | ||||