Export limit exceeded: 375803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 375803 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (375803 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16919 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-08-27 | 9.8 Critical |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper validation of network-supplied pointers. | ||||
| CVE-2026-16895 | 2026-08-27 | N/A | ||
| A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the application resets the internal state flag msf.auth_initialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher. | ||||
| CVE-2026-12556 | 1 Hp Inc | 1 Hp Easy Start For Macos | 2026-08-27 | N/A |
| Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities. | ||||
| CVE-2026-12555 | 1 Hp Inc | 1 Hp Easy Start For Macos | 2026-08-27 | N/A |
| Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities. | ||||
| CVE-2026-12554 | 1 Hp Inc | 1 Hp Easy Start For Macos | 2026-08-27 | N/A |
| Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities. | ||||
| CVE-2025-62300 | 1 Hcl Software | 1 Iem | 2026-08-27 | 5.9 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a race condition. A "timing window" can occur where an attacker can modify the resource causing unpredictable behavior. | ||||
| CVE-2025-62299 | 1 Hcl Software | 1 Iem | 2026-08-27 | 6.6 Medium |
| HCL IntelliOps Event Management (IEM) is affected by a least privileges violation which could allow an attacker to access the resource with the elevated privilege that could not be accessed with the attacker's original privileges. | ||||
| CVE-2022-50998 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-08-27 | 7.5 High |
| Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity reference cycle when entity content is allocated from a dict) and CVE-2022-40303 (integer overflows when parsing with XML_PARSE_HUGE). Nokogiri 1.13.9 upgrades the packaged libxml2 to v2.10.3 to address these issues. Processing crafted XML input may lead to denial of service or memory corruption. (The advisory also references CVE-2022-2309, a NULL pointer dereference via iterwalk/canonicalize, which maintainers determined does not affect Nokogiri users.) | ||||
| CVE-2026-43670 | 1 Apple | 5 Ios And Ipados, Ipados, Iphone Os and 2 more | 2026-08-27 | 8.8 High |
| A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy. | ||||
| CVE-2026-64705 | 1 Apple | 1 Macos | 2026-08-27 | 5.5 Medium |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.7, macOS Sonoma 14.8.7. An app may be able to cause unexpected system termination or write kernel memory. | ||||
| CVE-2026-47857 | 2026-08-27 | 5.9 Medium | ||
| In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier | ||||
| CVE-2026-47863 | 2026-08-27 | 5.9 Medium | ||
| In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier | ||||
| CVE-2026-47884 | 1 Spring | 1 Spring Framework | 2026-08-27 | 9.8 Critical |
| Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/**" mapping that results in view rendering, and where the view name is not explicitly specified. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier | ||||
| CVE-2026-47886 | 1 Spring | 1 Spring Framework | 2026-08-27 | 7.5 High |
| Applications that evaluate user-supplied Spring Expression Language (SpEL) expressions may be vulnerable to a Denial of Service (DoS) attack when the power operator (^) is used with a BigDecimal or BigInteger operand and a large exponent value. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier | ||||
| CVE-2026-47889 | 1 Spring | 1 Spring Framework | 2026-08-27 | 7.5 High |
| A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 | ||||
| CVE-2026-16567 | 2026-08-27 | 5.3 Medium | ||
| The Document Embedder WordPress plugin before 2.3.1 does not check a document's status before issuing a download token and streaming the file, allowing unauthenticated attackers to download arbitrary Document Embedder WordPress plugin before 2.3.1 documents, including private and draft ones, by enumerating IDs. | ||||
| CVE-2026-19223 | 2026-08-27 | 7.2 High | ||
| The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-19225 | 2026-08-27 | 6.6 Medium | ||
| The Defender Security WordPress plugin before 6.2.0 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network. | ||||
| CVE-2026-19715 | 2026-08-27 | 7.5 High | ||
| The WP OAuth Server ( Login with WordPress ) WordPress plugin before 6.3.1 does not restrict access to the debug log it writes, which is stored at a fixed and publicly reachable location, allowing unauthenticated users to read the OAuth tokens and authorisation codes it has issued as well as user records including password hashes when debug logging is enabled. | ||||
| CVE-2021-48005 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||