Search
Search Results (367644 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-37064 | 2026-09-02 | 5.3 Medium | ||
| User enumeration in /vfm-admin/ajax/usr-check.php in Veno File Manager Project 4.4.9 allows an unauthenticated attacker to enumerate the application users via sending a specially crafted POST request to the affected endpoint with a chosen 'user_name' parameter to test if the user exists. | ||||
| CVE-2026-51620 | 1 Totolink | 1 T6 | 2026-09-02 | 7.5 High |
| Incorrect access control in the getNetInfoCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain network topology and interface configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-62442 | 1 Oracle | 2 Siebel Crm, Siebel Crm Cloud Applications | 2026-09-02 | 8.1 High |
| Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.6. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the Siebel CRM Cloud Applications executes to compromise Siebel CRM Cloud Applications. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Siebel CRM Cloud Applications accessible data as well as unauthorized access to critical data or complete access to all Siebel CRM Cloud Applications accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-51618 | 1 Totolink | 1 T6 | 2026-09-02 | 7.5 High |
| Incorrect access control in the getWizardCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain setup wizard and onboarding configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51622 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the getWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WAN configuration data via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51631 | 1 Totolink | 1 T6 | 2026-09-02 | 4.3 Medium |
| Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain WPS runtime status via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51694 | 1 Totolink | 1 T6 | 2026-09-02 | 7.5 High |
| Incorrect access control in the setStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to add or change static DHCP rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-84144 | 1 Mozilla | 1 Firefox | 2026-09-02 | N/A |
| Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. | ||||
| CVE-2026-23591 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23590 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23589 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23588 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23587 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23586 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23585 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23584 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-23583 | 2026-09-02 | N/A | ||
| Withdrawn by requester. | ||||
| CVE-2026-75411 | 1 Jeecgboot | 1 Jeecgboot | 2026-09-02 | 9.8 Critical |
| JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the `SecurityCheck` class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection. | ||||
| CVE-2025-7963 | 2026-09-02 | 6.4 Medium | ||
| The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-26897 | 2026-09-02 | 9.8 Critical | ||
| An issue in EcoOnline EHS (com.airsweb.v10) application for Android, version 0.2.499 allows a remote attacker to obtain sensitive information and execute arbitrary code via the AndroidManifest.xml component | ||||