Export limit exceeded: 358816 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (358816 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19744 | 1 Maalfer | 1 Pentestify | 2026-08-13 | N/A |
| Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization step does not escape quotes | ||||
| CVE-2026-50105 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698) | ||||
| CVE-2026-56443 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118 | ||||
| CVE-2026-58434 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-13 | N/A |
| Private Repository Metadata Remains Accessible After Access Revocation | ||||
| CVE-2026-19747 | 1 Tenda | 10 Ch10, Ch7, Ch7g and 7 more | 2026-08-13 | 9.8 Critical |
| A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely. | ||||
| CVE-2026-16853 | 1 Ibm | 1 I | 2026-08-13 | 6.5 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to obtain sensitive information due to an out-of-bounds read. | ||||
| CVE-2026-16815 | 1 Ibm | 1 I | 2026-08-13 | 8.6 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and potentially obtain sensitive information due to a stack-based buffer overflow. | ||||
| CVE-2026-16722 | 1 Ibm | 1 I | 2026-08-13 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management. | ||||
| CVE-2026-16713 | 1 Ibm | 1 Documentation Offline | 2026-08-13 | 4.3 Medium |
| IBM Documentation Offline 1.0.0 through 1.4.1 IBM Documentation could allow a remote attacker to obtain sensitive information due to a security misconfiguration where the documentation server binds to an unrestricted IP address. | ||||
| CVE-2026-16692 | 1 Ibm | 1 I | 2026-08-13 | 6.5 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow. | ||||
| CVE-2026-16674 | 1 Ibm | 1 I | 2026-08-13 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an untrusted search path. | ||||
| CVE-2026-14875 | 1 Ibm | 1 I Access Client Solutions | 2026-08-13 | 7.3 High |
| IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to arbitrary code execution on Windows when installed for all users due to publicly writeable directory. | ||||
| CVE-2026-14525 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-08-13 | 9.4 Critical |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. | ||||
| CVE-2026-13460 | 1 Ibm | 1 Storage Scale | 2026-08-13 | 7.5 High |
| IBM Storage Scale 5.2.3.0 through 5.2.3.8, and 6.0.0.0 through 6.0.1.0 GUI contains a hardcoded token in the source code, which was used for inter-node cluster communication and REST API authentication between GUI. | ||||
| CVE-2026-13365 | 1 Ibm | 1 Planning Analytics | 2026-08-13 | 7.1 High |
| IBM Planning Analytics 2.0, and 2.1 Local is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. | ||||
| CVE-2021-40490 | 5 Debian, Fedoraproject, Linux and 2 more | 31 Debian Linux, Fedora, Linux Kernel and 28 more | 2026-08-13 | 7.0 High |
| A race condition was discovered in ext4_write_inline_data_end in fs/ext4/inline.c in the ext4 subsystem in the Linux kernel through 5.13.13. | ||||
| CVE-2022-2586 | 3 Canonical, Linux, Redhat | 5 Ubuntu Linux, Linux Kernel, Enterprise Linux and 2 more | 2026-08-13 | 5.3 Medium |
| It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. | ||||
| CVE-2022-1055 | 5 Canonical, Fedoraproject, Linux and 2 more | 22 Ubuntu Linux, Fedora, Linux Kernel and 19 more | 2026-08-13 | 7.8 High |
| A use-after-free exists in the Linux Kernel in tc_new_tfilter that could allow a local attacker to gain privilege escalation. The exploit requires unprivileged user namespaces. We recommend upgrading past commit 04c2a47ffb13c29778e2a14e414ad4cb5a5db4b5 | ||||
| CVE-2026-10571 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-08-13 | 5.7 Medium |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by a denial of service caused by insecure deserialization. A low-privileged, administrative user could exploit this vulnerability to consume system resources when the restConnector-2.0 feature is enabled. | ||||
| CVE-2026-53015 | 1 Linux | 1 Linux Kernel | 2026-08-13 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: erofs: unify lcn as u64 for 32-bit platforms As sashiko reported [1], `lcn` was typed as `unsigned long` (or `unsigned int` sometimes), which is only 32 bits wide on 32-bit platforms, which causes `(lcn << lclusterbits)` to be truncated at 4 GiB. In order to consolidate the logic, just use `u64` consistently around the codebase. [1] https://sashiko.dev/r/20260420034612.1899973-1-hsiangkao%40linux.alibaba.com | ||||