Export limit exceeded: 373833 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 86747 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (86747 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71218 | 2 Iperf3 Project, Redhat | 2 Iperf3, Enterprise Linux | 2026-08-11 | 5.3 Medium |
| A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service. | ||||
| CVE-2026-67591 | 1 Apache | 2 Qpid Proton-j, Qpid Protonj2 | 2026-08-11 | 6.5 Medium |
| An authenticated attacker could exceed the session flow control incoming window potentially leading to denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue. | ||||
| CVE-2026-67592 | 1 Apache | 2 Qpid Proton-j, Qpid Protonj2 | 2026-08-11 | 7.5 High |
| It was not possible to govern the maximum number of transfer frames per incoming delivery, enabling an authenticated attacker to cause excessive resource usage and potential denial of service. This issue affects Apache Qpid ProtonJ2: through 1.1.0. Users are recommended to upgrade to version 1.2.0, which fixes the issue | ||||
| CVE-2026-19379 | 2 Efm, Iptime | 2 Iptime Ax8004m, Ax8004m | 2026-08-11 | 7.3 High |
| A vulnerability was determined in EFM ipTIME AX8004M 15.09.0. Impacted is the function popen of the file /cgi/d.cgi of the component CGI Endpoint. This manipulation of the argument fname causes os command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-57279 | 1 Cybozu | 1 Cybozu Garoon | 2026-08-11 | N/A |
| Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product. | ||||
| CVE-2026-59686 | 1 Progress | 6 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 3 more | 2026-08-11 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interface, potentially resulting in complete system compromise. | ||||
| CVE-2026-59687 | 1 Progress | 6 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 3 more | 2026-08-11 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location management interface, potentially resulting in complete system compromise. | ||||
| CVE-2026-59688 | 1 Progress | 6 Connection Manager For Objectscale, Ecs Connection Manager, Loadmaster and 3 more | 2026-08-11 | 8.4 High |
| An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore functionality, potentially resulting in complete system compromise. | ||||
| CVE-2026-18478 | 1 Magnolia-cms | 1 Magnolia Cms | 2026-08-11 | N/A |
| Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10 | ||||
| CVE-2026-56619 | 1 Hcltech | 1 Bigfix Mobile | 2026-08-11 | 5.4 Medium |
| HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input. | ||||
| CVE-2026-72914 | 1 Joinmastodon | 1 Mastodon | 2026-08-11 | 7.5 High |
| Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1, the administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and Api::V1::Admin::RetentionController checked authorization only after beginning expensive calculations. Anonymous callers could submit keys, start_at, and end_at parameters that caused long-running SQL queries in Admin::Metrics::Measure, Admin::Metrics::Retention, and Admin::Metrics::Dimension::BaseDimension, allowing repeated requests to exhaust server resources. This issue is fixed in versions 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1. | ||||
| CVE-2026-34089 | 1 Wikimedia | 1 Scribunto | 2026-08-11 | 7.5 High |
| Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2. | ||||
| CVE-2026-9698 | 2 Hmbrand, Perl | 2 Dbi, Dbi | 2026-08-11 | 7.5 High |
| DBI versions before 1.648 for Perl saved errors in a limited-sized buffer. Error messages that were returned when RaiseError, PrintError or HandleError were set were written to a 200-byte buffer without a length limit. Attackers that can influence the error text in an application can trigger a buffer overflow. | ||||
| CVE-2026-8091 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-11 | 9.8 Critical |
| Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2. | ||||
| CVE-2026-58049 | 1 Ffmpeg | 1 Ffmpeg | 2026-08-11 | 8.6 High |
| FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption. | ||||
| CVE-2026-43003 | 1 Openstack | 2 Ironic-python-agent, Ironic Python Agent | 2026-08-11 | 8 High |
| An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image. | ||||
| CVE-2026-3014 | 1 Milestone Systems | 1 Xprotect Management Server | 2026-08-11 | 9.1 Critical |
| Milestone has released a new version of XProtect® (and several cumulative patch updates) which fix security vulnerability in Management Server API. The vulnerability causes users with edit permissions to the Management Server to be able to execute arbitrary code in context of the Management Server Service. | ||||
| CVE-2026-31984 | 2 Nozomi Networks, Nozominetworks | 4 Cmc, Guardian, Cmc and 1 more | 2026-08-11 | 7.5 High |
| A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable. | ||||
| CVE-2026-31981 | 2 Nozomi Networks, Nozominetworks | 4 Cmc, Guardian, Cmc and 1 more | 2026-08-11 | 5.9 Medium |
| A Stored HTML Injection vulnerability was discovered in the Diagram tab and Graph view due to a shared input validation function being insufficiently restrictive. An authenticated user with administrative privileges can inject malicious HTML tags into N2OS configuration data through multiple input vectors. When a victim views the affected data in the Diagram tab and Graph view, the injected HTML renders in their browser, enabling phishing and possibly open redirect attacks. Full XSS exploitation and direct information disclosure are prevented by the existing input validation and Content Security Policy configuration. | ||||
| CVE-2026-23573 | 1 Fortinet | 3 Fortios, Fortipam, Fortiproxy | 2026-08-11 | 6.1 Medium |
| An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests. | ||||