Export limit exceeded: 372074 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372074 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2017-20258 | 1 Extro | 2 Responsive Portfolio, Rpc | 2026-08-19 | 8.2 High |
| Joomla! Component RPC Responsive Portfolio 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_pofos&view=pofo&id=[SQL] to extract sensitive database information. | ||||
| CVE-2026-20497 | 2 Mediatek, Mediatek, Inc. | 23 Mt6989, Mt6989 Firmware, Mt8755 and 20 more | 2026-08-19 | 6 Medium |
| In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965550 / ALPS11393405; Issue ID: MSV-6941. | ||||
| CVE-2026-20496 | 1 Mediatek | 35 Mediatek Chipset, Mt6983, Mt6983 Firmware and 32 more | 2026-08-19 | 4.4 Medium |
| In geniezone, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11036877; Issue ID: MSV-7132. | ||||
| CVE-2026-20495 | 2 Mediatek, Mediatek, Inc. | 13 Mt7902, Mt7902 Firmware, Mt7920 and 10 more | 2026-08-19 | 7.8 High |
| In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00488300; Issue ID: MSV-7296. | ||||
| CVE-2026-20494 | 1 Mediatek | 7 Mediatek Chipset, Mt6890, Mt6890 Firmware and 4 more | 2026-08-19 | 5.5 Medium |
| In wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10960006 / BORA00155314, BORA00155001, BORA00154907; Issue ID: MSV-7570. | ||||
| CVE-2026-20493 | 2 Mediatek, Mediatek, Inc. | 7 Mt6890, Mt6890 Firmware, Mt6988 and 4 more | 2026-08-19 | 4.4 Medium |
| In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575. | ||||
| CVE-2026-20492 | 2 Mediatek, Mediatek, Inc. | 13 Mt2735, Mt2735 Firmware, Mt2737 and 10 more | 2026-08-19 | 5.5 Medium |
| In Audio HAL, there is a possible system becoming unresponsive due to a race condition. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10960026 (Note: For MT6880, MT6890, MT6990, MT6988) / AUTO00851250 (Note: For MT2735, MT2737); Issue ID: MSV-7583. | ||||
| CVE-2026-74951 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-08-19 | 6.5 Medium |
| Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154. | ||||
| CVE-2026-60797 | 1 Oracle | 1 Siebel Crm Integration | 2026-08-19 | 7.4 High |
| Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Integration accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-20491 | 2 Mediatek, Mediatek, Inc. | 11 Mt2735, Mt2735 Firmware, Mt2737 and 8 more | 2026-08-19 | 5.5 Medium |
| In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652. | ||||
| CVE-2026-20490 | 2 Mediatek, Mediatek, Inc. | 11 Mt6813, Mt6813 Firmware, Mt6982vb and 8 more | 2026-08-19 | 4.4 Medium |
| In ccci, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10981501; Issue ID: MSV-7669. | ||||
| CVE-2017-20259 | 1 Joomlashack | 1 Osdownloads | 2026-08-19 | 8.2 High |
| Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_osdownloads&view=item&id=[SQL] to extract sensitive database information including credentials and configuration data. | ||||
| CVE-2026-76213 | 1 Phpmyfaq | 1 Phpmyfaq | 2026-08-19 | 7.4 High |
| phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing. | ||||
| CVE-2026-74038 | 1 Wazuh | 1 Wazuh-manager | 2026-08-19 | 7.1 High |
| Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery. | ||||
| CVE-2026-16819 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-19 | 7.7 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service and compromise data integrity due to a time-of-check time-of-use race condition. | ||||
| CVE-2026-63642 | 1 Magicmirrororg | 1 Magicmirror | 2026-08-19 | N/A |
| MagicMirror² is an open source modular smart mirror platform. Prior to 2.37.0, checkArticleUrl in defaultmodules/newsfeed/node_helper.js accepts the CHECK_ARTICLE_URL notification through the unauthenticated Socket.IO namespace /newsfeed and performs fetch(url, { method: "HEAD" }) without validating the attacker-controlled URL. The helper returns ARTICLE_URL_STATUS containing the URL and framing result, providing a response and timing oracle that can identify internal hosts and ports and trigger side effects on services that react to HEAD requests. This issue is fixed in version 2.37.0. | ||||
| CVE-2026-60766 | 1 Oracle | 1 Siebel Crm Integration | 2026-08-19 | 7.4 High |
| Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST). Supported versions that are affected are 17.0-26.6. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Siebel CRM Integration. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Integration accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Integration accessible data. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2017-20260 | 1 Weborange | 1 Price Alert | 2026-08-19 | 8.2 High |
| Joomla! Component Price Alert 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the product_id parameter. Attackers can send requests to the subscribeajax view with crafted SQL payloads in the product_id parameter to extract sensitive database information including credentials and configuration data. | ||||
| CVE-2026-62705 | 1 Microsoft | 6 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-08-19 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bind Filter Driver allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-53477 | 2026-08-19 | 7.8 High | ||
| Dell Command Update (DCU), versions prior to 5.7.1, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges. | ||||