Export limit exceeded: 11452 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11452 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55732 | 1 Loytec | 8 L-dali, L-gate, L-inx and 5 more | 2026-07-27 | N/A |
| Out-of-bounds Read (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64 allows an unauthenticated remote attacker to crash `linx_a64.exe` and ultimately reboot the device via a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value. The same vulnerability affects multiple other Loytec products. | ||||
| CVE-2026-49326 | 1 Apache | 1 Hbase | 2026-07-27 | 6.5 Medium |
| Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for identifying the scanner instances stored at server side. We missed the owner check in fetch and close steps which means a user can fetch rows from the scanner which is opened by other users, and close scanners which belongs to other users. This issue affects Apache HBase:from 3.0.0-alpha-1 through 3.0.0-beta-1, from 2.6.0 through 2.6.5, from 2.5.0 through 2.5.14, through 2.4.*. Users are recommended to upgrade to version 3.0.0-beta-2, 2.6.6 and 2.5.15, which fixes the issue. | ||||
| CVE-2026-60135 | 1 Weintek | 2 Cmt3092x Firmware, Easyweb | 2026-07-27 | 6.5 Medium |
| An attacker can modify data that should be restricted to read‑only access. | ||||
| CVE-2026-61886 | 1 Weintek | 2 Cmt3092x Firmware, Easyweb | 2026-07-27 | 6.5 Medium |
| Weintek cMT3092X HMI stores user account passwords in plaintext. | ||||
| CVE-2026-61892 | 1 Weintek | 2 Cmt3092x Firmware, Easyweb | 2026-07-27 | 8.8 High |
| Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges. | ||||
| CVE-2026-60134 | 1 Weintek | 2 Cmt3092x Firmware, Easyweb | 2026-07-27 | 8.8 High |
| Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges. | ||||
| CVE-2026-66339 | 2 Libsoup, Redhat | 2 Libsoup, Enterprise Linux | 2026-07-27 | 6.5 Medium |
| A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure. | ||||
| CVE-2026-66338 | 2 Libsoup, Redhat | 2 Libsoup, Enterprise Linux | 2026-07-27 | 5.4 Medium |
| A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests. | ||||
| CVE-2026-65764 | 1 Phoca | 1 Phoca Commander Extension For Joomla | 2026-07-27 | N/A |
| Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability. | ||||
| CVE-2026-48144 | 1 Apache | 1 Thrift | 2026-07-27 | N/A |
| Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-50162 | 1 Oras-project | 1 Oras-go | 2026-07-27 | 5.3 Medium |
| oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1. | ||||
| CVE-2026-17059 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-07-27 | 6.5 Medium |
| A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access. | ||||
| CVE-2026-61501 | 1 Rejetto | 1 Hfs | 2026-07-27 | 6.1 Medium |
| Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges. | ||||
| CVE-2026-61502 | 1 Rejetto | 1 Hfs | 2026-07-27 | 4.3 Medium |
| Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine. | ||||
| CVE-2026-61505 | 1 Rejetto | 1 Hfs | 2026-07-27 | 5.3 Medium |
| Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact. | ||||
| CVE-2026-44745 | 1 Sap Se | 1 Sap Approuter | 2026-07-27 | 8.1 High |
| SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application. | ||||
| CVE-2026-12482 | 1 Keras-team | 1 Keras | 2026-07-27 | 4.2 Medium |
| A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues. | ||||
| CVE-2026-15043 | 1 Hmbrand | 1 Dbi::sql::nano | 2026-07-27 | 9.8 Critical |
| DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator. SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly. The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows. | ||||
| CVE-2026-58475 | 1 Dan-in-ca | 1 Sip | 2026-07-27 | 6.1 Medium |
| Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript by supplying malicious script payloads within program names submitted via HTTP requests. Attackers can exploit the lack of output encoding on rendered program names to execute arbitrary JavaScript in the browsers of any users viewing the affected page, with exploitation facilitated by the absence of a required passphrase or the default passphrase 'opendoor'. | ||||
| CVE-2026-60114 | 1 Dan-in-ca | 1 Sip | 2026-07-27 | 7.5 High |
| Sustainable Irrigation Platform (SIP) through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths. Attackers can exploit the lack of key validation in the JSON restore process, combined with the absence of a required passphrase in the default configuration or the default passphrase 'opendoor', to write arbitrary JSON files outside the intended data directory. | ||||