Export limit exceeded: 365581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 365581 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365581 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2022-51002 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2022-51001 | 2026-08-27 | N/A | ||
| This CVE ID has been rejected. | ||||
| CVE-2026-75871 | 1 Gitlab | 1 Ai-gateway | 2026-08-27 | 8.2 High |
| GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an externally-controlled endpoint via a crafted inline flow configuration that overrides the HTTP Host header, resulting in disclosure of Google Cloud Vertex cloud service credentials and private signing keys. | ||||
| CVE-2026-19889 | 1 Gitlab | 1 Ai-gateway | 2026-08-27 | 8.2 High |
| GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an externally-controlled endpoint via crafted model metadata, resulting in the disclosure of Google Vertex AI or AWS Bedrock cloud service credentials. | ||||
| CVE-2026-13415 | 2026-08-27 | 7.2 High | ||
| The CMP WordPress plugin before 4.1.18 does not enforce an option-name allow-list when importing settings via one of its AJAX actions, allowing users with the Editor role (when the administrator has granted the Editor role access to the CMP WordPress plugin before 4.1.18's admin-bar controls) to update arbitrary WordPress options, including options that lead to privilege escalation to Administrator. | ||||
| CVE-2026-16568 | 2026-08-27 | 4.3 Medium | ||
| The Mobile App for WooCommerce: ShopApper Mobile App Builder Service for WooCommerce WordPress plugin through 0.4.62 does not verify that the requesting user owns the customer profile being queried through one of its REST endpoints, allowing any authenticated user (e.g. a customer/subscriber) to retrieve other users' personal data, including their email address, name, and roles. | ||||
| CVE-2026-5680 | 1 Redhat | 9 Apache Camel Hawtio, Camel Spring Boot, Enterprise Linux and 6 more | 2026-08-27 | 7.5 High |
| A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application. | ||||
| CVE-2026-78893 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78894 | 1 Google | 1 Chrome | 2026-08-27 | 3.1 Low |
| Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78896 | 1 Google | 1 Chrome | 2026-08-27 | 4.3 Medium |
| Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-78897 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-78900 | 1 Google | 1 Chrome | 2026-08-27 | 9.6 Critical |
| Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-78904 | 1 Google | 1 Chrome | 2026-08-27 | 9.6 Critical |
| Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-78907 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78911 | 1 Google | 1 Chrome | 2026-08-27 | 8.3 High |
| Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-78251 | 1 Dji | 15 Air 3, Air 3s, Dji Avata 2 and 12 more | 2026-08-27 | N/A |
| DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in **/blackbox/upgrade/**, as well as overwrite existing files in that directory. An attacker with access to the drone's internal network or USB RNDIS interface can exhaust the available storage, preventing the aircraft from writing flight records, logs, and telemetry and potentially preventing subsequent firmware updates. Uploaded files persist across reboot and factory reset. Affected models are DJI Neo until 01.00.0400, DJI Neo 2 until 01.00.0500, DJI Flip until 01.00.1200, DJI Air 3 until 01.00.1600, DJI Air 3S until 01.00.1400, DJI Avata 2 until 01.00.0400, DJI Avata 360 until 01.00.0300, DJI Mavic 3 until 01.00.1400, DJI Mavic 3 Classic until 01.00.0800, DJI Mavic 3 Pro until 01.01.0700, DJI Mavic 4 Pro until 01.00.0500, DJI Mini 2 until 01.07.0200, DJI Mini 3 until 01.00.0500, DJI Mini 3 Pro until 01.00.0900, DJI Mini 4 Pro until 01.00.1100, and DJI Mini 5 Pro until 01.00.0600. Remediation requires a firmware update from the vendor. | ||||
| CVE-2026-78914 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-78934 | 1 Google | 1 Chrome | 2026-08-27 | 8.3 High |
| Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-44902 | 1 Opentelemetry | 7 Auto-instrumentations-node, Exporter-prometheus, Opentelemetry-js and 4 more | 2026-08-27 | 7.5 High |
| opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0. | ||||
| CVE-2026-78002 | 1 Redhat | 1 Enterprise Linux | 2026-08-27 | 7.5 High |
| A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system. | ||||