Export limit exceeded: 11452 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11452 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17458 | 1 Mf-yang | 1 Openclaw-cn | 2026-07-27 | 6.3 Medium |
| A vulnerability was found in mf-yang openclaw-cn up to 0.2.1. This affects the function clickViaPlaywright of the file src/browser/routes/agent.act.ts of the component Browser Control HTTP API. Performing a manipulation results in server-side request forgery. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-17514 | 1 Zjonsson | 1 Node-unzipper | 2026-07-27 | 5.3 Medium |
| A vulnerability was determined in ZJONSSON node-unzipper up to 0.12.3. Affected by this vulnerability is the function Extract of the file lib/extract.js. This manipulation causes path traversal. The attack requires local access. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-65430 | 1 Regularlabs.com | 1 Geoip Extension For Joomla | 2026-07-27 | 7.5 High |
| Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability. | ||||
| CVE-2026-64793 | 1 Regularlabs.com | 2 Articles Anywhere Extension For Joomla, Modules Anywhere Extension For Joomla | 2026-07-27 | 9.1 Critical |
| Joomla Extension - regularlabs.com - Content access and publication bypass in Articles Anywhere and Modules Anywhere extensions - Content tags could use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author could thereby expose content to visitors who lacked the required access. | ||||
| CVE-2026-64875 | 1 Regularlabs.com | 1 Geoip Extension For Joomla | 2026-07-27 | 6.5 Medium |
| Joomla Extension - regularlabs.com - IP spoofing vulnerability in GeoIP extension - GeoIP lookups trusted spoofable forwarded client-IP headers, this could cause GeoIP-rule bypass. | ||||
| CVE-2026-55968 | 1 Apache | 1 Thrift | 2026-07-27 | 7.5 High |
| Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-64795 | 1 Regularlabs.com | 5 Articles Anywhere Pro Extension For Joomla, Modals Extension For Joomla, Modules Anywhere Pro Extension For Joomla and 2 more | 2026-07-27 | 5.4 Medium |
| Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers. | ||||
| CVE-2026-17457 | 1 Mf-yang | 1 Openclaw-cn | 2026-07-27 | 4.3 Medium |
| A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-58023 | 1 Apache | 1 Thrift | 2026-07-27 | 6.5 Medium |
| Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-48586 | 1 Apache | 1 Thrift | 2026-07-27 | 7.5 High |
| Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-48145 | 1 Apache | 1 Thrift | 2026-07-27 | N/A |
| Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-45112 | 1 Apache | 1 Thrift | 2026-07-27 | 7.5 High |
| Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-60462 | 1 Oracle | 1 Webcenter Content | 2026-07-27 | 8.1 High |
| Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-48125 | 1 Faisalman | 1 Ua-parser-js | 2026-07-27 | 5.3 Medium |
| UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By sending a crafted Sec-CH-UA-Model header to an application that calls UAParser(headers).withClientHints(), an attacker can cause excessive CPU time due to catastrophic backtracking in the device regex because Client Hints values are copied without the UA_MAX_LENGTH limit used for User-Agent values. This issue is fixed in version 2.0.10. | ||||
| CVE-2026-48334 | 1 Adobe | 2 Illustrator Desktop 2025, Illustrator Desktop 2026 | 2026-07-27 | 9.3 Critical |
| Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-48337 | 1 Adobe | 2 Illustrator Desktop 2025, Illustrator Desktop 2026 | 2026-07-27 | 7.8 High |
| Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-57832 | 1 Joomdonation.com | 1 Edocman Extension For Joomla | 2026-07-27 | N/A |
| Joomla Extension - joomdonation.com - Unauthenticated blind SQL injection in EDocman < 3.9 - The Joomla extension EDocman is vulnerable to an unauthenticated SQL injection. | ||||
| CVE-2026-57833 | 1 Weeblr.com | 1 4analytics Extension For Joomla | 2026-07-27 | N/A |
| Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature. | ||||
| CVE-2026-65695 | 1 Gongrzhe | 1 Office-word-mcp-server | 2026-07-27 | 6.8 Medium |
| Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation. | ||||
| CVE-2026-65696 | 1 Sct | 1 Overseerr | 2026-07-27 | 5.4 Medium |
| Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values. | ||||