Export limit exceeded: 366060 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366060 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78037 | 1 Xiiaozet | 1 Xiiaozet Lk100w | 2026-08-28 | 8.8 High |
| Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise. | ||||
| CVE-2026-77977 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 8.1 High |
| Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings, resulting in a loss of configuration and service availability. | ||||
| CVE-2026-77365 | 2 Optimole, Wordpress | 2 Optimole – Optimize Images | Convert Webp & Avif | Cdn & Lazy Load | Image Optimization, Wordpress | 2026-08-28 | 7.2 High |
| The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-76945 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 7.5 High |
| The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality. | ||||
| CVE-2026-76943 | 1 Xiiaozet | 1 Xiiaozet Lk100w | 2026-08-28 | 9.8 Critical |
| Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to complete device compromise. | ||||
| CVE-2026-76940 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 7.5 High |
| The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication. | ||||
| CVE-2026-76843 | 1 Flair | 1 Flair | 2026-08-28 | 7.8 High |
| The official Flair wheels for 0.15.0 and 0.15.1 still contain flair/models/clustering.py, whose ClusteringModel.load static method returns pickle.loads(joblib.load(str(model_file))) and so executes arbitrary Python while loading a model file. Loading a model supplied by an attacker therefore runs that attacker's code with the privileges of the loading process. This is the same sink and the same file as CVE-2024-10073, which records 0.15.0 as the fixed version on the basis that clustering support was dropped in that release; the module was removed from the documented API but remains present in the distributed artifact and reachable by importing flair.models.clustering directly, so the earlier record's fixed version does not hold for the shipped package. | ||||
| CVE-2026-76179 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 9.8 Critical |
| An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality. | ||||
| CVE-2026-75889 | 1 Grafana | 1 Alloy | 2026-08-28 | 7.7 High |
| Grafana Alloy’s prometheus.operator.servicemonitors component allows a user who can create or modify ServiceMonitor resources in a watched namespace to specify an arbitrary local file through bearerTokenFile. Alloy reads the file and sends its contents as a bearer token to an attacker-controlled scrape endpoint. This may disclose files accessible to the Alloy process, including its projected Kubernetes service account token, potentially granting the attacker Alloy’s Kubernetes permissions. Exploitation requires ServiceMonitor write access and lower privileges than Alloy’s service account. | ||||
| CVE-2026-75814 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 8.8 High |
| The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized configuration changes or a disruption of device availability. | ||||
| CVE-2026-75813 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 7.5 High |
| Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality. | ||||
| CVE-2026-75628 | 1 Punk | 1 Oauth2 | 2026-08-28 | 5.7 Medium |
| Punk::OAuth2 versions before 0.03 for Perl allow an attacker-chosen off-site redirect after login because same_origin_path accepts a backslash or tab in the return parameter. oauth2_login reads the return parameter from the initiation request, runs same_origin_path over it, and stores the survivor in the session flow record as the post-login redirect target. That check rejects a value that does not begin with a slash, one with a slash as its second byte, and one containing CR or LF. A backslash and a tab pass. The URL Standard treats a backslash as equivalent to a slash for special schemes, so `/\evil.example` parses with the authority `evil.example`. It also strips ASCII tab before parsing, so a tab between two leading slashes leaves `//evil.example`. A crafted link to the application's own login route lands the victim on the attacker's site after a genuine authentication. The redirect carries no authorization code or access token. | ||||
| CVE-2026-75548 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 5.4 Medium |
| The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions. | ||||
| CVE-2026-74802 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-28 | 8.2 High |
| SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket connections to this endpoint and direct the SiYuan kernel process to proxy arbitrary network traffic to attacker-chosen targets, enabling authenticated network pivoting through the victim's machine. | ||||
| CVE-2026-73839 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 4.6 Medium |
| Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access. | ||||
| CVE-2026-73809 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 7.5 High |
| A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device. Successful exploitation could result in disclosure of sensitive information and unauthorized access to device management functionality. | ||||
| CVE-2026-73125 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 9.8 Critical |
| Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability. | ||||
| CVE-2026-72831 | 1 Getgrav | 1 Grav | 2026-08-28 | 8.8 High |
| The Flex Objects plugin (through 1.4.6, tested with Grav 2.0.11) contains an incorrect authorization vulnerability in its Flex Objects API. FlexApiController::update() checks only the general Flex directory permission and does not apply the additional target/field/super-admin checks enforced by the dedicated Users and Groups API controllers. An authenticated account with api.access, admin.login, and users.update permissions (but without api.users.write or admin.super) can use the generic /api/v1/flex-objects/user-accounts endpoint to change a super administrator's password, or the /api/v1/flex-objects/user-groups endpoint to grant its group admin.super, resulting in full site takeover. Fixed in Flex Objects 1.4.7. | ||||
| CVE-2026-71187 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-28 | 9.8 Critical |
| The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device. | ||||
| CVE-2026-6876 | 2026-08-28 | N/A | ||
| ServiceNow has remediated a sandbox escape security issue that was identified in the Now Platform. This security issue could allow an unauthenticated user to execute arbitrary code within the Now Platform, potentially leading to more access to the Now Platform than intended. ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances. We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so. | ||||