Export limit exceeded: 370709 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 370709 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370709 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59940 | 2026-08-18 | 9.8 Critical | ||
| Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3. | ||||
| CVE-2026-75032 | 1 Redhat | 1 Enterprise Linux | 2026-08-18 | 6.3 Medium |
| A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device. | ||||
| CVE-2026-75850 | 1 Arcadedata | 1 Arcadedb | 2026-08-18 | 4.2 Medium |
| ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile) does not execute for these handlers. In deployments that use per-type or per-group ACLs, a user with database access but only limited per-type permissions can read from and write to types they are not authorized to access by submitting requests to the batch/time-series endpoints. Deployments that rely solely on database-level access control are not affected. | ||||
| CVE-2026-75851 | 1 Arcadedata | 1 Arcadedb | 2026-08-18 | 9.9 Critical |
| ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads. When an HTTP command is submitted with awaitResponse:false, it executes on an async worker whose DatabaseContext has no bound user, causing the scripting authorization gate to become a no-op. A user with only read access to a single database can submit an asynchronous JavaScript (language=js) command via the /api/v1/command endpoint to run code with unrestricted host access (e.g., database.getSecurity().createUser) and create a server-wide administrator, escalating to full administrative control. Fixed in 26.8.1. | ||||
| CVE-2026-75833 | 1 Getgrav | 1 Grav | 2026-08-18 | 4.2 Medium |
| The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function rejects a literal '//' prefix but does not account for browsers normalizing backslashes to slashes in special (http/https) schemes, so a returnTo value such as '/\evil.com' passes the guard and is later resolved by the browser as the protocol-relative URL '//evil.com'. Following a legitimate OAuth login flow, an attacker-supplied returnTo parameter could redirect an authenticated victim to an attacker-controlled site for post-login phishing. Full browser-side exploitability depends on the admin-next SPA's client-side oauth-callback handler and was not independently verified by the reporter. | ||||
| CVE-2026-75831 | 1 Getgrav | 1 Grav | 2026-08-18 | 7.6 High |
| Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions. | ||||
| CVE-2026-75828 | 1 Getgrav | 1 Grav | 2026-08-18 | 8.7 High |
| Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers when page content is rendered. | ||||
| CVE-2026-74906 | 1 B3log | 1 Siyuan | 2026-08-18 | 7.5 High |
| SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list. Anonymous visitors can discover and read content from documents explicitly marked as forbidden from publishing by accessing search, backlink, asset content, saved criteria, recent documents, graph, and tag endpoints. | ||||
| CVE-2026-69148 | 1 Mlflow | 1 Mlflow | 2026-08-18 | 7.1 High |
| MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handlers.py verifies only path containment, allowing authenticated users to create a model version that references another user's artifact directory and read files through GET /model-versions/get-artifact without the required READ permission. This issue is fixed in version 3.15.0. | ||||
| CVE-2026-65349 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 6.6 Medium |
| An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to cause unexpected system termination or read kernel memory. | ||||
| CVE-2026-65343 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 7.5 High |
| A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. A remote attacker may be able to cause unexpected system termination. | ||||
| CVE-2026-65341 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 5.4 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to memory corruption. | ||||
| CVE-2026-65340 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-65339 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 5 Medium |
| A logic issue was addressed with improved checks. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. An app may be able to leak sensitive user information. | ||||
| CVE-2026-65338 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-65337 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-65336 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-65335 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-65334 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-65333 | 1 Apple | 2 Ios And Ipados, Macos | 2026-08-18 | 4.3 Medium |
| This issue was addressed through improved state management. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||