Export limit exceeded: 395503 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 395503 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (395503 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91925 | 1 Polyaxon | 1 Polyaxon | 2026-09-17 | 8.8 High |
| Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens. | ||||
| CVE-2026-91997 | 2 Cs-technologies, Evolution-foundation | 2 Evolution, Evolution-api | 2026-09-17 | 5.3 Medium |
| evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version, database client name, configured server URL, and WhatsApp instance details. | ||||
| CVE-2026-92016 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92018 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92021 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16 and Thunderbird 140.16. | ||||
| CVE-2026-92022 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the DOM: HTML Parser component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92023 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92024 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92025 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92026 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92027 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the DOM: Streams component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92028 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92029 | 1 Mozilla | 1 Firefox | 2026-09-17 | 7.5 High |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, Firefox ESR 153.3, Thunderbird 156, Thunderbird 140.16, and Thunderbird 153.3. | ||||
| CVE-2026-92033 | 1 Mozilla | 1 Firefox | 2026-09-17 | 8.8 High |
| Privilege escalation in Firefox for Android. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92040 | 1 Mozilla | 1 Firefox | 2026-09-17 | 6.1 Medium |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | ||||
| CVE-2026-25282 | 1 Qualcomm | 1 Snapdragon | 2026-09-17 | 7.9 High |
| Transient DOS when processing unverified data from a neighboring system causes out of bound memory access. | ||||
| CVE-2026-66578 | 2 Propertyhive, Wordpress | 2 Propertyhive, Wordpress | 2026-09-17 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in PropertyHive <= 2.2.6 versions. | ||||
| CVE-2026-66608 | 2 Unlimited-elements, Wordpress | 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Wordpress | 2026-09-17 | 6.4 Medium |
| Contributor Server Side Request Forgery (SSRF) in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 2.0.19 versions. | ||||
| CVE-2021-3030 | 2026-09-17 | N/A | ||
| Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx. A remote, unauthenticated attacker can craft a URL that, once opened by a victim in a browser session authenticated to a site running the vulnerable component, executes arbitrary JavaScript in the security context of that site. | ||||
| CVE-2026-54237 | 2026-09-17 | N/A | ||
| Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile() in install/includes/core/core_class.php, allowing a remote unauthenticated attacker to read or write log files and place attacker-controlled content into PHP configuration files. The resulting PHP configuration content can execute on the server. This issue is fixed in version 2.4.2. | ||||