Export limit exceeded: 367383 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (367383 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-26445 | 2026-09-01 | 7.5 High | ||
| stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the broker s use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), causes sockets to enter a permanent half-read state. When enough such connections accumulate, the broker stops receiving any further epoll events for those sockets and eventually hangs in epoll_wait, effectively refusing to process new messages. | ||||
| CVE-2026-72636 | 1 Elastic | 1 Elasticsearch | 2026-09-01 | 6.5 Medium |
| Uncontrolled Recursion (CWE-674) in the Elasticsearch wildcard matching helper can lead to a denial of service via Excessive Allocation (CAPEC-130). The matcher used to resolve wildcard patterns against names is implemented recursively and had no bound on recursion depth or on the total number of match operations performed. A search request containing a wildcard pattern with a large number of wildcard groups, evaluated against a sufficiently long name, exhausts the thread stack. Elasticsearch treats a stack overflow as an unrecoverable condition and shuts the node down, so the request terminates the affected node rather than failing gracefully. | ||||
| CVE-2026-42170 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-09-01 | 7.8 High |
| A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution. | ||||
| CVE-2026-75363 | 1 Comfast | 1 Cf-wr630ax | 2026-09-01 | 6.8 Medium |
| An issue in Comfast CF-WR630AX v.2.7.0.2 allows a remote attacker to execute arbitrary code via the /usr/bin/webmgnt, /cgi-bin/mbox-config, and the parameters timestr, display_n. | ||||
| CVE-2026-75797 | 2 Ai Engine Project, Wordpress | 2 Ai Engine, Wordpress | 2026-09-01 | 7.7 High |
| The AI Engine WordPress plugin before 3.7.2 does not confine a caller-supplied URL when mapping it to a local filesystem path before reading the file and forwarding its contents to an external service, allowing users with a subscriber-level account to read arbitrary files from the server and exfiltrate them off-host. Reaching the issue at subscriber level requires a non-default public API feature to be enabled; otherwise the same issue is reachable by an administrator, which on multisite allows a non-super subsite administrator to read the network-shared configuration and its secrets. | ||||
| CVE-2026-75798 | 2 Ai Engine Project, Wordpress | 2 Ai Engine, Wordpress | 2026-09-01 | 5.3 Medium |
| The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI queries of their own choosing against the site owner's configured provider account. | ||||
| CVE-2026-18431 | 2 Themefusion, Wordpress | 3 Avada | Website Builder For Wordpress & Woocommerce, Fusion Builder, Wordpress | 2026-09-01 | 9.8 Critical |
| The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authorization and input validation weaknesses across the two components that makes it possible for unauthenticated attackers to write attacker-controlled files to the server. This can be used to create and execute arbitrary PHP files, resulting in remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder to be installed and active, as well as certain administrator-authored content to be present. | ||||
| CVE-2026-9668 | 1 Zte | 1 Scp | 2026-09-01 | 6.3 Medium |
| With legitimate user credentials in hand, attackers can construct malicious SQL statements to bypass authentication logic and execute arbitrary database queries directly. This will consequently lead to slow database queries and expanded query coverage. This vulnerability features a low exploitation threshold, wide scope of impact, requires no external privilege escalation, and is classified as a high-priority fix. | ||||
| CVE-2026-18664 | 1 Nlnetlabs | 1 Nsd | 2026-09-01 | N/A |
| When ranges are used for access control (i.e. of the form 1.2.3.4-1.2.3.25), because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compared with IPv4 ranges as unsigned 32 bit numbers directly with the endianness of the host, but the values to compare are in network byte order (big-endian). With IPv6 addresses the comparison is done in 4 times a unsigned 32 bit number comparison, again with the endianness of the host where all values are actually in network bye order. | ||||
| CVE-2026-18916 | 1 Nlnetlabs | 1 Nsd | 2026-09-01 | N/A |
| Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance. | ||||
| CVE-2026-19401 | 1 Nlnetlabs | 1 Nsd | 2026-09-01 | N/A |
| Any remote client can crash a (debugging/non-release build type) NSD serve child by sending it a special crafted message with a specially tuned number of DNS Cookie options (17 when UDP payload size is 512). By continuously crashing the serve childs, the remote client can severely hamper or, when positioned sufficiently close, deny all DNS service. | ||||
| CVE-2026-19538 | 1 Nlnetlabs | 1 Nsd | 2026-09-01 | N/A |
| The BLOCKED access control list items that are evaluated to deny access on the the proxy protocol port can be bypassed completely when connecting over TCP or TLS and sending the query twice on connection that is kept open. | ||||
| CVE-2026-19197 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-09-01 | 6.3 Medium |
| A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access control). | ||||
| CVE-2026-77533 | 1 Ubiquiti | 1 Protect Application | 2026-09-01 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device. | ||||
| CVE-2026-77546 | 1 Ui | 1 Unifi Access Application | 2026-09-01 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device. | ||||
| CVE-2026-77547 | 1 Ui | 1 Unifi Access Application | 2026-09-01 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Access Application to execute a Command Injection on the host device. | ||||
| CVE-2026-77548 | 1 Ubiquiti | 1 Protect Application | 2026-09-01 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerability found in UniFi Protect Application to execute a Command Injection on the host device. | ||||
| CVE-2026-77553 | 1 Ui | 1 Unifi Access Application | 2026-09-01 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability found in UniFi Access Application to escalate privileges on the host device. | ||||
| CVE-2026-15990 | 2 Strategy11, Wordpress | 2 Formidable Forms, Wordpress | 2026-09-01 | 7.5 High |
| The Formidable Charts plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.0.1 via the 'frm_graph' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Successful exploitation requires Formidable Forms Lite, Formidable Forms Pro, and Formidable Charts to be active and requires the wp-content/uploads/frm-charts/ directory to exist, normally after an image-format chart is rendered. | ||||
| CVE-2026-79902 | 3 Gimp, Gnome, Redhat | 3 Gimp, Gimp, Enterprise Linux | 2026-09-01 | 5.5 Medium |
| A flaw was found in the Seattle FilmWorks plugin in GIMP. When processing a specially crafted SFW image file, the plugin allocates a Variable-Length Array (VLA) on the stack without integer overflow checks, causing an unbounded stack allocation. This issue leads to an application crash, resulting in a denial of service. | ||||