Export limit exceeded: 377502 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377502 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377502 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84380 | 2026-09-02 | 5.6 Medium | ||
| HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding header because its setdefault() processing checks each default header independently rather than treating the two framing headers as mutually exclusive. Fixed-size byte, JSON, form, and known-length multipart bodies can therefore be serialized over HTTP/1.1 with both headers, allowing request smuggling or connection desynchronization when downstream intermediaries disagree about which framing header takes precedence. This issue is fixed in version 2.11.0. | ||||
| CVE-2026-84357 | 1 Google | 1 Chrome | 2026-09-02 | 6.5 Medium |
| Improper input validation in Omnibox in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass web origin policy via crafted network traffic. (Chromium security severity: High) | ||||
| CVE-2026-84356 | 1 Google | 1 Chrome | 2026-09-02 | 4.3 Medium |
| UI misrepresentation in FullScreen in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-84332 | 1 Google | 1 Chrome | 2026-09-02 | 6.5 Medium |
| Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-84325 | 1 Google | 1 Chrome | 2026-09-02 | 9.8 Critical |
| Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a co-installed app. (Chromium security severity: High) | ||||
| CVE-2026-82641 | 1 Keploy | 1 Keploy | 2026-09-02 | 8.6 High |
| Keploy versions 3.1.0 through 3.6.25, fixed in 3.6.26, bind the agent control-plane HTTP server to all interfaces without authentication, exposing endpoints that stream TLS session keys and traffic data. Attackers can access the /agent/pcap/keylog endpoint to retrieve NSS keylog lines and decrypt recorded TLS traffic, or invoke /agent/stop and /agent/storemocks to manipulate recording sessions. | ||||
| CVE-2026-82463 | 1 Pac4j | 1 Pac4j | 2026-09-02 | 8.1 High |
| pac4j-core before 6.5.6 contains an authentication bypass vulnerability in CheckProfileTypeAuthorizer that reverses the profile type validation logic. Attackers can authenticate through a weaker client and access resources requiring a stronger profile type by satisfying generic profile checks. | ||||
| CVE-2026-81269 | 1 Drupal | 1 Data Field | 2026-09-02 | 5.3 Medium |
| Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13. | ||||
| CVE-2026-81168 | 1 Drupal | 1 Captcha Protected Page | 2026-09-02 | 3.7 Low |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2. | ||||
| CVE-2026-81166 | 1 Drupal | 1 Digital Signage Framework | 2026-09-02 | 5.3 Medium |
| Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1. | ||||
| CVE-2026-81165 | 1 Drupal | 1 Blazy | 2026-09-02 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. | ||||
| CVE-2026-81162 | 1 Drupal | 1 Dxpr Builder: The Best Editing (ai) Experience For Drupal | 2026-09-02 | 5.3 Medium |
| Insertion of Sensitive Information Into Sent Data vulnerability in Drupal DXPR Builder: The Best Editing (AI) Experience for Drupal allows Forceful Browsing. This issue affects DXPR Builder: The Best Editing (AI) Experience for Drupal versions: from 0.0.0 to 2.8.1. | ||||
| CVE-2026-81161 | 1 Drupal | 1 Content Moderation Notifications | 2026-09-02 | 3.3 Low |
| Privilege Defined With Unsafe Actions vulnerability in Drupal Content Moderation Notifications allows Privilege Escalation. This issue affects Content Moderation Notifications versions: from 0.0.0 to 3.9.0. | ||||
| CVE-2026-81159 | 2026-09-02 | 3.7 Low | ||
| Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0. | ||||
| CVE-2026-81158 | 2026-09-02 | 5.3 Medium | ||
| Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. | ||||
| CVE-2026-76782 | 1 Drupal | 1 Screenshot | 2026-09-02 | 7.3 High |
| Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | ||||
| CVE-2026-76759 | 1 Drupal | 1 Screenshot | 2026-09-02 | 7.3 High |
| Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | ||||
| CVE-2026-76758 | 1 Drupal | 1 Link Content Parser | 2026-09-02 | 5.9 Medium |
| Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. | ||||
| CVE-2026-76757 | 1 Drupal | 1 Gammu Sms Daemon | 2026-09-02 | 5.9 Medium |
| Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. | ||||
| CVE-2026-76756 | 1 Drupal | 1 Gammu Sms Daemon | 2026-09-02 | 5.9 Medium |
| Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. | ||||