Export limit exceeded: 373203 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373203 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76921 | 1 Wireshark | 1 Wireshark | 2026-08-20 | 5.5 Medium |
| CMS protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76920 | 1 Wireshark | 1 Wireshark | 2026-08-20 | 4.7 Medium |
| 3gpp phone log file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76918 | 1 Wireshark | 1 Wireshark | 2026-08-20 | 5.5 Medium |
| SSH protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76917 | 1 Wireshark | 1 Wireshark | 2026-08-20 | 5.5 Medium |
| Bluetooth AVRCP Profile protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76891 | 1 Wireshark | 1 Wireshark | 2026-08-20 | 3.1 Low |
| Crash in sharkd in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76885 | 1 Wireshark | 1 Wireshark | 2026-08-20 | 3.1 Low |
| Tektronix K12xx file parser crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76880 | 1 Wireshark | 1 Wireshark | 2026-08-20 | 7.5 High |
| RRC protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-76785 | 1 Amirsanni | 1 Mini-inventory-and-sales-management-system | 2026-08-20 | 6.3 Medium |
| A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-76404 | 1 Splunk | 1 Splunk Mcp Server App | 2026-08-20 | 9.1 Critical |
| In Splunk MCP Server app versions below 1.2.1, a user who holds the "admin" Splunk role could execute arbitrary commands on the underlying operating system. The vulnerability is possible because of missing input validation in the app's credential management component, which deserializes stored data without checking whether the content is of the expected type. | ||||
| CVE-2026-76400 | 1 Splunk | 1 Splunk Connect For Kafka | 2026-08-20 | 5.9 Medium |
| In Splunk Connect for Kafka versions below 2.2.7, an unauthenticated user who can reach the Kafka Connect Representational State Transfer (REST) API and influence responses from a Hypertext Transfer Protocol (HTTP) Event Collector endpoint in Splunk Enterprise could cause the connector to retry failed event batches until event delivery stops. The vulnerability is possible because HTTP Event Collector delivery retry handling uses an unbounded default for failed batches instead of a finite retry limit. For more information see Install Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/install/install-splunk-connect-for-kafka), Data ingestion parameters for Splunk Connect for Kafka (https://help.splunk.com/en/data-management/integrate-data-with-add-ons/splunk-connect-for-kafka/2.2/overview/data-ingestion-parameters-for-splunk-connect-for-kafka), and Set up and use HTTP Event Collector with configuration files (https://help.splunk.com/en/splunk-enterprise/get-data-in/get-started-with-getting-data-in/9.4/get-data-with-http-event-collector/set-up-and-use-http-event-collector-with-configuration-files) in the Splunk documentation. | ||||
| CVE-2026-76386 | 1 Splunk | 1 Zoom App For Splunk Soar | 2026-08-20 | 4.3 Medium |
| In versions below 3.2.2 of the Zoom app for Splunk SOAR, a user who holds a role with permission to run actions could expose meeting and personal meeting ID passwords by invoking one of the create meeting, update meeting, or update user settings actions, because the affected password and pmi_password parameters are not masked and are shown in cleartext in the user interface. The information disclosure is possible because the app does not mark the affected action parameters as passwords. For more information see Run an action in Splunk SOAR (https://help.splunk.com/en/splunk-soar/soar-on-premises/use-splunk-soar-on-premises/8.6.0/use-the-command-line-interface-to-perform-tasks-in-splunk-soar-on-premises/run-an-action-in-splunk-soar-on-premises). | ||||
| CVE-2026-75952 | 1 Cmsjunkie.com | 1 J-businessdirectory Extension For Joomla | 2026-08-20 | N/A |
| Joomla Extension - cmsjunkie.com - Cross-site request forgery in J-BusinessDirectory < 6.2.3 - Tokens were missing on many AJAX/state-changing tasks: contact/quote forms, cart, bookmarks, uploads, messages, AI text generation, and several administrator actions (app install, demo-data wipe, cache/statistics archive, payment notification send, mobile push). Frontend CSRF needs a registered/listing-owner session; admin CSRF needs a backend admin session. | ||||
| CVE-2026-75920 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-08-20 | 5.3 Medium |
| phpMyFAQ before v4.1.6 writes content backup ZIP archives to the web-accessible document root at content.zip, exposing sensitive files including database credentials. Unauthenticated attackers can race concurrent requests to download the temporary ZIP file before deletion, or exploit XSS in admin contexts to trigger authenticated backups and retrieve the archive. | ||||
| CVE-2026-73347 | 2 Themetechmount, Wordpress | 2 Truebooker, Wordpress | 2026-08-20 | 9.8 Critical |
| Unauthenticated Privilege Escalation in TrueBooker <= 1.2.6 versions. | ||||
| CVE-2026-73185 | 2 Wordpress, Wpo-hr | 2 Wordpress, Ngg Smart Image Search | 2026-08-20 | 9.3 Critical |
| Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions. | ||||
| CVE-2026-66680 | 2 Plainwaire, Wordpress | 2 Locatoraid Store Locator, Wordpress | 2026-08-20 | 9.3 Critical |
| Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions. | ||||
| CVE-2026-66668 | 2 Peepso, Wordpress | 2 Community By Peepso, Wordpress | 2026-08-20 | 8.5 High |
| Subscriber SQL Injection in Community by PeepSo <= 9.0.5.2 versions. | ||||
| CVE-2026-66604 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-08-20 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in GeoDirectory <= 2.8.173 versions. | ||||
| CVE-2026-66595 | 2 Passionate Programmer Peter, Wordpress | 2 Wp Data Access, Wordpress | 2026-08-20 | 5.9 Medium |
| Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions. | ||||
| CVE-2026-65612 | 1 Nnn | 1 Nnn | 2026-08-20 | N/A |
| nnn does not sanitize the filename variable. An attacker can place a file with a crafted name on a shared filesystem, removable media, or inside an extracted archive whose name contains a single quote followed by shell syntax. If the victim navigates to that file and opens it with preview-tabbed, the filename is embedded into the generated shell command and the injected payload executes with the privileges of the nnn process. Maintainer of this project was notified about this vulnerability. It might has been addressed, but the maintainer did not provide a vulnerable version range. Only version 5.2 was tested and confirmed as vulnerable. | ||||