Export limit exceeded: 377463 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377463 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84233 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-09-01 | 7 High |
| A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. | ||||
| CVE-2026-75418 | 2026-09-01 | 7.5 High | ||
| A path traversal vulnerability exists in the built-in preview/development web server of Lektor <3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensitive information such as system files and deployment configuration files containing credentials. | ||||
| CVE-2026-51745 | 1 Totolink | 1 T6 | 2026-09-01 | 5.3 Medium |
| Incorrect access control in the updatePriStaList function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to refresh the primary station list via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2020-8619 | 7 Canonical, Debian, Fedoraproject and 4 more | 7 Ubuntu Linux, Debian Linux, Fedora and 4 more | 2026-09-01 | 4.9 Medium |
| In ISC BIND9 versions BIND 9.11.14 -> 9.11.19, BIND 9.14.9 -> 9.14.12, BIND 9.16.0 -> 9.16.3, BIND Supported Preview Edition 9.11.14-S1 -> 9.11.19-S1: Unless a nameserver is providing authoritative service for one or more zones and at least one zone contains an empty non-terminal entry containing an asterisk ("*") character, this defect cannot be encountered. A would-be attacker who is allowed to change zone content could theoretically introduce such a record in order to exploit this condition to cause denial of service, though we consider the use of this vector unlikely because any such attack would require a significant privilege level and be easily traceable. | ||||
| CVE-2024-10085 | 2026-09-01 | N/A | ||
| CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent to the platform. | ||||
| CVE-2026-13337 | 2026-09-01 | N/A | ||
| CWE-564: SQL Injection: Hibernate vulnerability exists that could allow the injection of a malicious HQL query in the NetBotz database when a malicious user is logged into the NetBotz via the web-service interface or webui. | ||||
| CVE-2026-13336 | 2026-09-01 | N/A | ||
| CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause execution of Linux Operating system commands when a system back up is restored that has been maliciously modified. | ||||
| CVE-2026-13348 | 1 Schneider-electric | 1 Powerchute Serial Shutdown | 2026-09-01 | N/A |
| CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to a user account by performing an arbitrary number of authentication attempts when redirect handling is disabled. | ||||
| CVE-2026-84165 | 1 Opennebula Systems | 1 Opennebula | 2026-09-01 | N/A |
| A vulnerability relating to incorrect access control in OpenNebula by OpenNebula Systems, affecting all versions prior to 7.4. This vulnerability could allow an authenticated user with basic permissions to execute commands on virtual machines belonging to other users via the `one.vm.exec` function, without proper verification of access permissions. To exploit the vulnerability, it is only necessary to know the virtual machine’s identifier and for qemu-agent to be enabled on that machine. Exploitation could allow commands to be executed and compromise the confidentiality, integrity and availability of the affected virtual machines. | ||||
| CVE-2026-13611 | 2 Kivicare, Wordpress | 2 Kivicare, Wordpress | 2026-09-01 | 5.3 Medium |
| The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key. | ||||
| CVE-2026-78363 | 2 Mw Wp Form Project, Wordpress | 2 Mw Wp Form, Wordpress | 2026-09-01 | 4.8 Medium |
| The MW WP Form WordPress plugin before 5.1.5 does not prevent shortcodes in user-submitted values from being executed when it merges those values into a message that it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site. Exploitation requires the site to have been configured to echo a submitted value back to the visitor after submission. | ||||
| CVE-2026-74916 | 2 Wordpress, Wpfastestcache | 2 Wordpress, Wp Fastest Cache | 2026-09-01 | 6.5 Medium |
| The WP Fastest Cache WordPress plugin before 1.5.1 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor. | ||||
| CVE-2026-9625 | 2 Rockwell Automation, Rockwellautomation | 2 Rslinx Classic , Rslinx Classic | 2026-09-01 | N/A |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet with an oversized embedded message request can cause the RSLinx® Classic service to crash, requiring a restart of the service to recover. | ||||
| CVE-2026-9624 | 2 Rockwell Automation, Rockwellautomation | 2 Rslinx Classic , Rslinx Classic | 2026-09-01 | N/A |
| A denial-of-service security issue exists within RSLinx® Classic. A crafted CIP packet can cause the RSLinx® Classic service to crash due to insufficient data length validation, requiring a restart of the service to recover. | ||||
| CVE-2026-19472 | 2 Rockwell Automation, Rockwellautomation | 2 Armorstart Lt, Armorstart Lt | 2026-09-01 | N/A |
| A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability | ||||
| CVE-2026-12663 | 1 Rockwell Automation | 1 Controlflash | 2026-09-01 | N/A |
| A security issue exists within ControlFLASH™, where the installer grants write permissions to the "Everyone" group on a product installation directory. This could allow arbitrary code execution, resulting in an attacker being given the ability to run any commands or code of the attacker's choice on a target machine at the logged-in user's permission level. | ||||
| CVE-2026-12661 | 1 Rockwell Automation | 1 Factorytalk Historian Machine Edition | 2026-09-01 | N/A |
| A denial-of-service security issue exists within FactoryTalk® Historian Machine Edition. A network adjacent attacker who is authenticated could send crafted requests to the web interface, resulting in buffer overflow conditions that may cause the device to crash and become unresponsive. | ||||
| CVE-2025-12768 | 1 Rockwell Automation | 1 Factorytalk Historian Machine Edition | 2026-09-01 | N/A |
| A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerability to achieve remote code execution on the affected device. | ||||
| CVE-2024-7952 | 1 Rockwell Automation | 1 Dataedgeplatform Datamosaix Private Cloud | 2026-09-01 | N/A |
| A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data. | ||||
| CVE-2024-7953 | 1 Rockwell Automation | 1 Dataedgeplatform Datamosaix Private Cloud | 2026-09-01 | N/A |
| A vulnerability exists in the affected products that allows a threat actor to create a project and become the administrator for it. If exploited, a threat actor could create, modify, and delete their own project. | ||||