Export limit exceeded: 372488 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372488 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-21069 | 1 Samsung | 2 Android, Mobile Devices | 2026-08-19 | 7.8 High |
| Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-20484 | 2 Mediatek, Mediatek, Inc. | 79 Mt6739, Mt6739 Firmware, Mt6761 and 76 more | 2026-08-19 | 4.4 Medium |
| In TFA, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11053160; Issue ID: MSV-8004. | ||||
| CVE-2026-21067 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-08-19 | 7.8 High |
| Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-14474 | 1 Redhat | 9 Enterprise Linux, Enterprise Linux Eus, Openshift and 6 more | 2026-08-19 | 8.8 High |
| A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts. | ||||
| CVE-2026-19680 | 1 Tenable | 1 Security Center | 2026-08-19 | 7.1 High |
| A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. | ||||
| CVE-2026-20485 | 2 Mediatek, Mediatek, Inc. | 3 Mt6993, Mt6993 Firmware, Mediatek Chipset | 2026-08-19 | 6 Medium |
| In HFRP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11049569; Issue ID: MSV-7931. | ||||
| CVE-2026-20486 | 1 Mediatek | 23 Mediatek Chipset, Mt2718, Mt2718 Firmware and 20 more | 2026-08-19 | 6.7 Medium |
| In imgsensor, there is a possible application crash due to incorrect error handling. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11012302; Issue ID: MSV-7833. | ||||
| CVE-2026-20488 | 2 Mediatek, Mediatek, Inc. | 35 Mt6991, Mt6991 Firmware, Mt6993 and 32 more | 2026-08-19 | 4.4 Medium |
| In display, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004276; Issue ID: MSV-7757. | ||||
| CVE-2026-19681 | 1 Tenable | 1 Security Center | 2026-08-19 | 9.9 Critical |
| An authenticated command injection vulnerability exists in Security Center related to file upload processing. An attacker could exploit this issue by uploading a specially crafted file, potentially resulting in arbitrary command execution on the underlying operating system. | ||||
| CVE-2026-20489 | 2 Mediatek, Mediatek, Inc. | 35 Mt6991, Mt6991 Firmware, Mt6993 and 32 more | 2026-08-19 | 4.4 Medium |
| In display, there is a possible information disclosure due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11004274; Issue ID: MSV-7749. | ||||
| CVE-2026-19682 | 1 Tenable | 1 Security Center | 2026-08-19 | 9.9 Critical |
| A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary commands on the underlying operating system with the privileges of the service account. | ||||
| CVE-2026-73896 | 1 Oracle | 1 Helidon | 2026-08-19 | 6.5 Medium |
| Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 4.5.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP/2 to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized read access to a subset of Helidon accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Helidon. CVSS 3.1 Base Score 6.5 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). | ||||
| CVE-2026-40508 | 1 Openemr | 1 Openemr | 2026-08-19 | 5.4 Medium |
| OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the patient portal template import handler that allows authenticated attackers with Forms Administration permissions to upload template files containing arbitrary HTML or JavaScript. Attackers can inject malicious scripts through the template upload functionality, which are stored without sanitization and execute in the browser of any other Forms Administration user who views the template in the HTML editor. | ||||
| CVE-2026-61607 | 1 Getgrav | 1 Grav-plugin-api | 2026-08-19 | 4.6 Medium |
| Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.2, the Grav API plugin POST /api/v1/media pipeline in HandlesMediaUploads::processUploadedFile() validates an SVG filename extension but does not invoke Security::sanitizeSVG(). An attacker with api.media.write permission can store an SVG containing JavaScript, and the server returns the file as Content-Type: image/svg+xml so the script executes when a victim opens it, allowing session data theft and authenticated actions. This issue is fixed in version 1.0.2. | ||||
| CVE-2026-61690 | 1 Getgrav | 1 Grav | 2026-08-19 | 6.5 Medium |
| Grav is a file-based Web platform. Prior to 2.0.1, Grav ZipArchiver::extract() in system/src/Grav/Common/Filesystem/ZipArchiver.php passes archives to ZipArchive::extractTo() without enforcing the system.gpm.archive uncompressed-size, file-count, or nesting-depth limits. Code using Archiver::create('zip') to extract an attacker-controlled archive can exhaust disk space or inodes and make the site unavailable. This issue is fixed in version 2.0.1. | ||||
| CVE-2026-15423 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 8.5 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation. | ||||
| CVE-2026-15216 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 8.7 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component. | ||||
| CVE-2026-15217 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 8.7 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component. | ||||
| CVE-2026-4879 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 4.3 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint. | ||||
| CVE-2026-6821 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 4.3 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restrictions and read limited merge request information from a private project due to missing authorization checks in a merge requests API endpoint. | ||||