Export limit exceeded: 372407 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372407 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71470 | 1 Redhat | 1 Acm | 2026-08-19 | 9.1 Critical |
| A flaw was found in the search-v2-operator. This vulnerability allows a privileged user, specifically a Custom Resource (CR) editor, to manipulate Search CR fields such as imageOverride, arguments, and environment variables without proper validation. By exploiting this, an attacker can mount arbitrary secrets into a search container's environment or replace the container image with an attacker-controlled one. This leads to privilege escalation and can result in a full cluster compromise due to the ServiceAccount's extensive impersonation permissions. | ||||
| CVE-2026-19629 | 1 Tenable | 1 Security Center | 2026-08-19 | 8.1 High |
| A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management. | ||||
| CVE-2026-21076 | 2 Samsung, Samsung Mobile | 2 Health, Samsung Health | 2026-08-19 | 5.5 Medium |
| Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | ||||
| CVE-2026-21072 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-08-19 | 7.8 High |
| Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-74971 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 4.3 Medium |
| Information disclosure in the DOM: UI Events & Focus Handling component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-19631 | 1 Tenable | 1 Security Center | 2026-08-19 | 4.9 Medium |
| A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials. | ||||
| CVE-2026-19679 | 1 Tenable | 1 Security Center | 2026-08-19 | 8.8 High |
| An input validation vulnerability exists in Security Center's file upload handling, where insufficient sanitization of uploaded filenames could contribute to a downstream command injection issue. | ||||
| CVE-2026-74972 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 4.3 Medium |
| Information disclosure in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-74973 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 4.2 Medium |
| Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-21071 | 2 Samsung, Samsung Mobile | 2 Android, Samsung Mobile Devices | 2026-08-19 | 7.8 High |
| Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-74974 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 5.4 Medium |
| Same-origin policy bypass in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-19626 | 1 Tenable | 1 Security Center | 2026-08-19 | 9.9 Critical |
| A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in arbitrary code execution with the privileges of the service account. | ||||
| CVE-2026-19635 | 1 Tenable | 1 Security Center | 2026-08-19 | 8.8 High |
| A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could achieve arbitrary code execution with elevated privileges, without requiring further user or victim interaction. | ||||
| CVE-2026-19636 | 1 Tenable | 1 Security Center | 2026-08-19 | 5.3 Medium |
| An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a security control. This has been addressed by improving the randomness and entropy of token generation. | ||||
| CVE-2026-19639 | 1 Tenable | 1 Security Center | 2026-08-19 | 4.3 Medium |
| An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings outside of their assigned scope. | ||||
| CVE-2026-50173 | 2026-08-19 | N/A | ||
| Flow-Like is a platform for building end-to-end use cases. Prior to version 1.0.4, `GET /api/v1/apps/{app_id}/invoke/presign` grants Azure Blob Storage SAS credentials with write and delete access to app content to any app member that has `ExecuteEvents`, even when that member lacks `ReadFiles` and `WriteFiles`. The route treats file permissions as optional after the `ExecuteEvents` gate. When the caller has neither file permission, it selects `CredentialsAccess::InvokeNone`. In the Azure credential provider, `InvokeNone` still mints a `content_sas_token` for `apps/{app_id}` with `sp=rwdl`, plus user-content and log SAS tokens. The returned shared credential is enough for the low-privilege caller to directly write or delete blobs under the app content prefix. Version 1.0.4 patches the issue. Flow-Like Studio and the hosted Flow-Like Web App are not affected. These deployments use AWS-backed storage. Self-hosted deployments are only affected if they use Azure Blob Storage as the storage backend. In affected deployments, the issue only applies to authenticated app members who have workflow execution permissions but should not have app file write/delete permissions. Users of affected self-hosted Azure deployments should update to version 1.0.4 or the latest dev branch. | ||||
| CVE-2026-20482 | 2 Mediatek, Mediatek, Inc. | 11 Mt7902, Mt7902 Firmware, Mt7921 and 8 more | 2026-08-19 | 6.5 Medium |
| In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote (proximal/adjacent) denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00486814; Issue ID: MSV-6824. | ||||
| CVE-2026-20483 | 2 Mediatek, Mediatek, Inc. | 71 Mt6739, Mt6739 Firmware, Mt6761 and 68 more | 2026-08-19 | 7.7 High |
| In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11087526; Issue ID: MSV-8243. | ||||
| CVE-2026-71158 | 1 Oracle | 1 Helidon | 2026-08-19 | 7.5 High |
| Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-71159 | 1 Oracle | 1 Helidon | 2026-08-19 | 8.2 High |
| Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). The supported version that is affected is 3.2.18. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Helidon accessible data as well as unauthorized update, insert or delete access to some of Helidon accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N). | ||||