Export limit exceeded: 370672 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370672 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75103 | 2026-08-18 | 8.8 High | ||
| Crawlab fails to verify user ownership or administrative role on the password-change endpoint, allowing any authenticated user to reset any account's password. Attackers can enumerate user accounts through the user listing endpoint and change administrator credentials to achieve full account takeover and arbitrary code execution. | ||||
| CVE-2026-75080 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-08-18 | 7.3 High |
| A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_subject1.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-74973 | 1 Mozilla | 1 Firefox | 2026-08-18 | 4.2 Medium |
| Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74970 | 1 Mozilla | 1 Firefox | 2026-08-18 | 5.4 Medium |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | ||||
| CVE-2026-74965 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Shell Integration component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74953 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Networking: Cookies component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74952 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Application Update component. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-74950 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Downloads API component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | ||||
| CVE-2026-74949 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation due to use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74947 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 154 and Firefox ESR 153.1. | ||||
| CVE-2026-74946 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74942 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Remote Settings Client component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74941 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74939 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-74935 | 1 Mozilla | 1 Firefox | 2026-08-18 | 8.8 High |
| Privilege escalation in the DOM: Networking component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, and Firefox ESR 153.1. | ||||
| CVE-2026-73692 | 1 Dolibarr | 1 Erp Crm | 2026-08-18 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-73073 | 2026-08-18 | N/A | ||
| Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command separator to execute arbitrary Ex and operating-system commands when a user invokes C omni-completion with CTRL-X CTRL-O on a member access whose type is resolved from that tags file. This issue is fixed in version 9.2.0845. | ||||
| CVE-2026-71477 | 2026-08-18 | 6.7 Medium | ||
| mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.1, release tar archives record mise/bin/mise with user and group ID 1001 and packaging/standalone/install.envsubst extracts and moves it without normalizing ownership, allowing a local user with those IDs to replace a root-installed executable, especially when MISE_INSTALL_PATH targets a shared location such as /usr/local/bin. This issue is fixed in version 2026.7.1. | ||||
| CVE-2026-69189 | 2026-08-18 | 7.6 High | ||
| Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data, while toggleHistoryStarStatus and removeRequestFromHistory in the UserHistory service accept another user's history identifier without enforcing userUid ownership, allowing an authenticated workspace member to read private request history, session data, request contents, authorization headers, environment values, and settings and to modify or delete the victim's private history entries. This issue is fixed in version 2026.6.0. | ||||
| CVE-2026-68765 | 1 Hashcat | 1 Hashcat | 2026-08-18 | 6.1 Medium |
| hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301) that allows attackers to corrupt adjacent heap memory by supplying an oversized ninth hash field token. The module accepts up to 600 hex characters for the ninth token field but decodes it into a fixed 256-byte buffer with no length check, allowing a maximal input to write up to 44 bytes past the buffer boundary into adjacent esalt fields and heap chunk metadata, potentially enabling heap corruption or memory access violations. | ||||