Export limit exceeded: 377663 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377663 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377663 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377663 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65940 | 2 Progress, Progress Software | 2 Whatsup Gold, Whatsup Gold | 2026-09-02 | 6.8 Medium |
| In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can write arbitrary files to a web-accessible location on the host server. | ||||
| CVE-2026-65941 | 2 Progress, Progress Software | 2 Whatsup Gold, Whatsup Gold | 2026-09-02 | 8.8 High |
| In WhatsUp Gold versions released before 2026.0.2, an unauthenticated remote attacker with network access to the affected service can execute arbitrary code in the context of the IIS application service account. | ||||
| CVE-2026-84200 | 1 Kyverno | 1 Kyverno | 2026-09-02 | 9 Critical |
| Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0. | ||||
| CVE-2026-83744 | 1 Invoiceninja | 1 Invoice Ninja | 2026-09-02 | 4.3 Medium |
| A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHostSafe of the file app/Services/Pdf/Purify.php of the component invoices Endpoint. The manipulation of the argument notes leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-82661 | 1 Nodemailer | 1 Nodemailer | 2026-09-02 | 5.4 Medium |
| Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics. | ||||
| CVE-2026-82637 | 1 Browser-use | 2 Browser Use, Web-ui | 2026-09-02 | 5.3 Medium |
| browser-use web-ui versions 2.0.0 through 3.0.0 fail to validate browser settings paths in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access. | ||||
| CVE-2026-82474 | 1 Sudo Project | 1 Sudo | 2026-09-02 | 7.8 High |
| Sudo through 1.9.17p2 fails to apply intercept policy checks to the execveat system call in ptrace-based intercept mode. Users permitted to run specific commands can execute denied programs by calling execveat directly or through fexecve, bypassing policy enforcement and logging. | ||||
| CVE-2026-82397 | 1 Tornadoweb | 1 Tornado | 2026-09-02 | 7.5 High |
| Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. RequestHandler._execute in tornado/web.py parses the body before handler dispatch through HTTPServerRequest._parse_body and parse_body_arguments in tornado/httputil.py, so an unauthenticated request body containing millions of separator-delimited fields can synchronously stall the single-threaded event loop and delay every connection. The body is bounded only by max_buffer_size, which defaults to 104857600 bytes. This issue is fixed in version 6.5.8. | ||||
| CVE-2026-82394 | 1 Sulu | 1 Sulu | 2026-09-02 | N/A |
| Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for the target resource in PreviewLinkManager::generate() or PreviewLinkManager::revoke(). An authenticated administration user who knows a target resource identifier can create or revoke a preview link for any page, article, or snippet, including content in a webspace or area the user cannot view. A generated preview URL is public and resolves content by an opaque token, allowing the user or anyone receiving the link to read restricted content without authentication. This issue is fixed in versions 2.6.25 and 3.0.8. | ||||
| CVE-2026-82224 | 2 Iova.mihai, Wordpress | 2 Slicewp, Wordpress | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in SliceWP <= 1.2.10 versions. | ||||
| CVE-2026-81765 | 2 Tailored Media, Wordpress | 2 Tailored Tools, Wordpress | 2026-09-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Tailored Tools <= 3.0.2 versions. | ||||
| CVE-2026-81201 | 1 Drupal | 1 Monster Menus | 2026-09-02 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3. | ||||
| CVE-2026-81160 | 1 Drupal | 1 Slick Carousel | 2026-09-02 | 6.1 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0. | ||||
| CVE-2026-79991 | 1 Craftcms | 1 Cms | 2026-09-02 | N/A |
| Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument. | ||||
| CVE-2026-79990 | 1 Craftcms | 1 Cms | 2026-09-02 | N/A |
| Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManagerprepareArguments(), which is the function that enforces site-scope filtering via array_intersect against the GraphQL schema’s allowed sites. The query path (ElementResolverprepareElementQuery) correctly calls prepareArguments()`, so queries to unauthorized sites return empty. But mutations bypass this entirely — an attacker with a token scoped to Site A can create, modify, or delete entries in Site B by passing siteId in the mutations argument. | ||||
| CVE-2026-77189 | 2 Smub, Wordpress | 2 Charitable – Donation & Fundraising Platform (donation Forms, Recurring Donations & Fundraising Campaigns), Wordpress | 2026-09-02 | 6.5 Medium |
| The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The [charitable_donors] shortcode is accessible to Contributor-level users via draft or pending post previews, providing an authenticated but low-privileged entry point for exploitation. | ||||
| CVE-2026-76006 | 2 Ays-pro, Wordpress | 2 Photo Gallery By Ays – Responsive Image Gallery, Wordpress | 2026-09-02 | 4.9 Medium |
| The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 6.8.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. The vulnerability exists across two execution paths — $wpdb->get_var() in record_count() and $wpdb->get_results() in prepare_items()/get_image_categories() — enabling both blind and UNION-based exfiltration techniques. | ||||
| CVE-2026-62993 | 1 Smarty-php | 1 Smarty | 2026-09-02 | N/A |
| Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 4.5.7 and 5.8.2, depending on the release line, Smarty's {fetch} handling in libs/plugins/function.fetch.php and src/FunctionHandler/Fetch.php used Security::isTrustedUri() to validate only the initial remote URL against trusted_uri when a security policy was active. For resources handled by file_get_contents(), including HTTPS URLs, PHP followed HTTP redirects by default. An attacker who could supply or influence a fetch target and had an open redirect on a trusted host could redirect the request to an attacker-chosen internal endpoint, bypass the trusted_uri allowlist, and perform server-side request forgery. This issue is fixed in versions 4.5.7 and 5.8.2. | ||||
| CVE-2026-61419 | 1 Dell | 1 Thinos | 2026-09-02 | 7.8 High |
| Dell ThinOS 10, versions prior to 2605_10.2518, contain an Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. | ||||
| CVE-2026-59286 | 2 Spring, Vmware | 2 Spring For Graphql, Spring For Graphql | 2026-09-02 | 8.1 High |
| The GraphiQL page bundled with Spring for GraphQL loads JavaScript libraries from a public CDN, without Subresource Integrity checks. An attacker can inject malicious code in those scripts and execute arbitrary code on the browser loading the GraphiQL page. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0 - 1.4.6 Spring for GraphQL 1.1.0 - 1.3.9 Spring for GraphQL 1.0.0 - 1.0.7 | ||||