Export limit exceeded: 370826 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370826 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13073 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 4.3 Medium |
| An authenticated user with read-only privileges can cause the mongod process to terminate abnormally by issuing a crafted aggregation command, resulting in denial of service for all connected clients until the process is restarted. The issue stems from an internal engine selection inconsistency triggered by a specific combination of aggregation options. | ||||
| CVE-2026-13074 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 5.3 Medium |
| An unauthenticated remote client can cause excessive CPU consumption on a MongoDB server by sending a specific combination of parameters to the awaitable hello command in exhaust mode. The server's handling of this combination results in a response loop that bypasses normal throttling, allowing a small number of connections to degrade server availability. | ||||
| CVE-2026-73380 | 2026-08-18 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions. | ||||
| CVE-2026-68565 | 2 Paolo, Wordpress | 2 Geodirectory, Wordpress | 2026-08-18 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions. | ||||
| CVE-2026-73189 | 2 Themeum, Wordpress | 2 Wp Crowdfunding, Wordpress | 2026-08-18 | 6.5 Medium |
| Subscriber Insecure Direct Object References (IDOR) in WP Crowdfunding < 2.2.1 versions. | ||||
| CVE-2026-13075 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 6.5 Medium |
| An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries. | ||||
| CVE-2026-13076 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 6.5 Medium |
| An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries. | ||||
| CVE-2026-13077 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 7.1 High |
| A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents. | ||||
| CVE-2026-13078 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 7.7 High |
| A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process. | ||||
| CVE-2026-50185 | 1 Rustcrypto | 2 Cmov, Utils | 2026-08-18 | 3.3 Low |
| RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4. | ||||
| CVE-2026-35616 | 1 Fortinet | 1 Forticlientems | 2026-08-18 | 9.1 Critical |
| A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | ||||
| CVE-2026-32465 | 2 G5theme, Wordpress | 2 Essential Real Estate, Wordpress | 2026-08-18 | 8.8 High |
| Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | ||||
| CVE-2026-66627 | 2026-08-18 | 9.9 Critical | ||
| Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions. | ||||
| CVE-2026-32481 | 2 Ezoic, Wordpress | 2 Ezoic, Wordpress | 2026-08-18 | 7.5 High |
| Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions. | ||||
| CVE-2026-32549 | 2 Codexpert, Wordpress | 2 Thumbpress, Wordpress | 2026-08-18 | 7.5 High |
| Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. | ||||
| CVE-2026-66046 | 1 Libexpat Project | 1 Libexpat | 2026-08-18 | 7.5 High |
| Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. | ||||
| CVE-2026-47632 | 1 Microsoft | 2 Azure Connected Machine Agent, Azure Monitor Agent Metrics Extension | 2026-08-18 | 8.8 High |
| Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-20757 | 1 Gallagher | 1 Command Centre | 2026-08-18 | 2.5 Low |
| Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. This issue affects Command Centre Server: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior. | ||||
| CVE-2026-26053 | 1 Gallagher | 1 Command Centre | 2026-08-18 | 5.3 Medium |
| An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10. | ||||
| CVE-2026-46420 | 1 Shivammathur | 2 Setup-php, Setup Php | 2026-08-18 | 5.6 Medium |
| setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1. | ||||