Export limit exceeded: 377452 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377452 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75760 | 1 Ash-project | 1 Ash Ai | 2026-08-31 | N/A |
| Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash_ai discloses provider request state and credentials in a user-facing validation error. In AshAi.Changes.Vectorize, when the embedding provider call fails the change added a changeset error whose message inspected the raw error term (An error occurred while generating embeddings: #{inspect(error)}). A plain-string add_error produces an Ash.Error.Changes.InvalidChanges in the :invalid class, which AshJsonApi and AshGraphql render back to the caller. The embedding client's error term is not sanitized, so it can carry the request URL, the provider response body, and, for HTTP clients that keep the request in the error struct, the outbound Authorization header with the provider API key. Failures are attacker-reachable via oversized or malformed vectorized content. The fix logs the raw error and returns a generic message. This issue affects ash_ai: from 0.1.0 before 1.0.0. | ||||
| CVE-2026-52491 | 1 Libtiff | 1 Libtiff | 2026-08-31 | 8.4 High |
| An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main() component | ||||
| CVE-2026-38343 | 1 Ffmpeg | 1 Ffmpeg | 2026-08-31 | 6.5 Medium |
| An integer overflow in the libavfilter/vf_scale.c component of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted video file. | ||||
| CVE-2026-71217 | 2 Iperf3 Project, Redhat | 2 Iperf3, Enterprise Linux | 2026-08-31 | 7.5 High |
| A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server. | ||||
| CVE-2026-78986 | 1 Google | 1 Chrome | 2026-08-31 | 3.1 Low |
| Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-79007 | 1 Google | 1 Chrome | 2026-08-31 | 3.1 Low |
| Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-73125 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 9.8 Critical |
| Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability. | ||||
| CVE-2026-74872 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 contain an arbitrary code execution vulnerability in the Whirlpool hash implementation that uses broad glob patterns to load .so modules without integrity verification. Attackers can place malicious .so files matching the whirlpool*py313*.so pattern in site-packages directories to achieve native code execution when the module is loaded. | ||||
| CVE-2026-74877 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 8.8 High |
| openssl_encrypt versions before 1.4.0 contain a missing ownership verification vulnerability in the revoke_key method that allows authenticated clients to revoke any other client's key. Attackers can revoke arbitrary keys by providing a valid ML-DSA signature, bypassing the intended ownership restriction. | ||||
| CVE-2026-76179 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 9.8 Critical |
| An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality. | ||||
| CVE-2026-74882 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 7.5 High |
| openssl_encrypt versions before 1.4.0 contain an insecure default configuration that trusts the entire RFC 1918 private address space in IntegrityProxyConfig trusted_proxies. Attackers on private networks can forge client certificate headers to bypass mTLS authentication when ProxyAuth validation is relaxed or modified. | ||||
| CVE-2026-75814 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 8.8 High |
| The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability. | ||||
| CVE-2026-74887 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 3.7 Low |
| openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0. | ||||
| CVE-2026-74892 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 7.5 High |
| openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication. | ||||
| CVE-2026-76940 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 7.5 High |
| The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication. | ||||
| CVE-2026-79272 | 1 Google | 1 Chrome | 2026-08-31 | 3.1 Low |
| Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-34616 | 1 Adobe | 1 Dng Software Development Kit | 2026-08-31 | 5.5 Medium |
| DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-73809 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 7.5 High |
| A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device. Successful exploitation could result in disclosure of sensitive information and unauthorized access to device management functionality. | ||||
| CVE-2026-51686 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-71187 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 9.8 Critical |
| The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device. | ||||