Export limit exceeded: 374865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 374865 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 86906 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (86906 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-10032 | 1 A2ui-project | 1 A2ui | 2026-08-05 | N/A |
| The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary JavaScript executes in the victim application's browser origin, constituting a stored/reflected XSS with Critical severity. No non-default configuration is required; the Basic Catalog is enabled by default. | ||||
| CVE-2026-24253 | 2 Linux, Nvidia | 2 Linux Kernel, Dynamo | 2026-08-05 | 8.2 High |
| NVIDIA Dynamo for Linux contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service and data tampering. | ||||
| CVE-2026-66300 | 1 Snomed International | 1 Snowstorm | 2026-08-05 | 5 Medium |
| SNOMED International Snowstorm contains a reflected XSS vulnerability within the "Web Route" redirection functionality. An attacker can inject arbitrary JavaScript which will execute upon a target user navigating to a crafted, malicious link. Fixed in 10.12.2 and 10.9.3. | ||||
| CVE-2026-48254 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-48257 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-48255 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-48262 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-48253 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-48261 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-48355 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-48260 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed. | ||||
| CVE-2026-48263 | 1 Adobe | 3 Adobe Experience Manager, Experience Manager, Experience Manager Cloud Service | 2026-08-05 | 5.4 Medium |
| Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed. | ||||
| CVE-2026-50651 | 3 Apple, Linux, Microsoft | 7 Macos, Linux Kernel, .net and 4 more | 2026-08-05 | 7.5 High |
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-12898 | 2 Wordpress, Yaniiliev | 2 Wordpress, All In One Wp Migration And Backup | 2026-08-05 | 6.5 Medium |
| The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory. | ||||
| CVE-2026-69185 | 1 Socket | 1 Socket.io | 2026-08-05 | 7.5 High |
| Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6. | ||||
| CVE-2026-14824 | 2 Quizandsurveymaster, Wordpress | 2 Quiz And Survey Master, Wordpress | 2026-08-05 | 4.8 Medium |
| The Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing the affected quiz. | ||||
| CVE-2026-15233 | 2 Nested Pages Project, Wordpress | 2 Nested Pages, Wordpress | 2026-08-05 | 4.8 Medium |
| The Nested Pages WordPress plugin before 3.2.15 does not properly escape post titles before outputting them into HTML attributes on an administrative listing screen, allowing users with the Editor role (or Contributor/Author when the Nested Pages WordPress plugin before 3.2.15 is enabled for the post type) to inject arbitrary JavaScript that executes in the session of any higher-privileged user who views that screen. | ||||
| CVE-2026-16293 | 2 Blubrry, Wordpress | 2 Powerpress Podcasting Plugin By Blubrry, Wordpress | 2026-08-05 | 6.8 Medium |
| The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | ||||
| CVE-2026-66275 | 1 Apache | 1 Qpid Proton-j | 2026-08-05 | 6.5 Medium |
| An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue. | ||||
| CVE-2026-66274 | 1 Apache | 1 Qpid Proton-j | 2026-08-05 | 7.5 High |
| A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue. | ||||