Export limit exceeded: 15860 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (15860 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-44979 | 1 Hapijs | 1 Wreck | 2026-07-23 | N/A |
| @hapi/wreck is an HTTP client utility. Prior to 18.1.1, when @hapi/wreck follows a 3xx redirect to a different hostname, only the Authorization and Cookie headers are stripped, and the standard credential header Proxy-Authorization is forwarded intact to the redirect target, potentially exposing forward-proxy credentials to a host outside the original trust boundary when redirects are enabled through the redirects option or Wreck.defaults({ redirects: ... }). This issue is fixed in version 18.1.1. | ||||
| CVE-2026-12484 | 1 Keras-team | 1 Keras | 2026-07-23 | 7.8 High |
| A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method invokes `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in, such as a `safe_mode=False` parameter. When called outside a `SafeModeScope(True)` context, the absence of an ambient safe mode state permits unsafe deserialization by default. This issue can lead to arbitrary code execution if untrusted Keras layer configurations are processed using this method. The vulnerability arises because the method does not enforce safe deserialization practices unless explicitly guarded by Keras safe mode. | ||||
| CVE-2026-13577 | 1 Cromedome | 1 Dancer2 | 2026-07-23 | 8.2 High |
| Dancer2 versions through 2.1.0 for Perl generate insecure session ids when required CSPRNG modules are unavailable. Dancer2::Core::Role::SessionFactory::generate_id silently falls back to a built-in rand-derived session id unless both Math::Random::ISAAC::XS and Crypt::URandom are available. The fallback session id is generated from a SHA-1 hash of a call to the built-in rand function, the absolute path of the Dancer2::Core::Role::SessionFactory module, an internal counter, the process id, the module instance memory address, and a shuffled string of characters (using the List::Util::shuffle function, which also uses the built-in rand function). These are all low-entropy and easily guessed sources. The built-in rand() function is seeded with 32-bits and considered unsuitable for security applications. Predictable session ids could allow an attacker to gain access to systems. | ||||
| CVE-2026-16246 | 1 Bizerba | 1 Brain2 | 2026-07-23 | 7.3 High |
| In BRAIN2 versions prior to 3.09, the application LogPathConfig.exe is executed during setup. As a result, the Windows group Everyone is granted full control over %ProgramData% instead of being restricted to %ProgramData%\Bizerba\BRAIN2\. Starting with BRAIN2 3.09, the setup no longer executes this tool. However, the optional component Bizerba ScriptService still executes it. Bizerba ScriptService is being deprecated and will no longer be included starting with BRAIN2 version 3.11. | ||||
| CVE-2026-16247 | 1 Bizerba | 1 Connect.brain | 2026-07-23 | 7.3 High |
| In _connect.BRAIN versions prior to 5.06, the application LogPathConfig.exe is executed during setup. During this process, existing permissions on %ProgramData% are deleted and replaced, granting the Windows group Everyone full control instead of restricting access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT. Starting with _connect.BRAIN 5.06, the setup no longer executes this tool. | ||||
| CVE-2026-60032 | 1 Themexpert.com | 1 Jmedia Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits. | ||||
| CVE-2026-60033 | 1 Themexpert.com | 1 Jmedia Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - SSRF via remote download in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to an SSRF vulnerability. Remote-URL download could target internal/reserved addresses. | ||||
| CVE-2026-60030 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an improper access control. Authenticated users could upload media files regardless of their media management permissions. | ||||
| CVE-2026-60034 | 1 Themexpert.com | 1 Jmedia Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated stored XSS in JMedia Extension < 1.6.0 - The Joomla extension JMedia is vulnerable to a stored XSS vulnerability. Unsanitised SVG uploads served without nosniff, leading to stored/reflected XSS. | ||||
| CVE-2026-60026 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated PHP code execution in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated PHP code execution. Authenticated builder user (core.create/core.edit) could inject PHP tags in element content, that got executed via view-cache include(). Requires caching on (default). | ||||
| CVE-2026-60029 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder users could break out of id/class fields that render for public users. | ||||
| CVE-2026-60031 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an information disclosure. Raw exceptions reflected in AJAX handler responses. | ||||
| CVE-2026-60027 | 1 Themexpert.com | 1 Quix Page Builder Pro Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder < 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to a unauthenticated path traversal via form elements. Unauthenticated users frontend users are allowed traversal paths and read arbitrary files. Requires a published page with a Form element. | ||||
| CVE-2026-61901 | 1 Hikashop.com | 1 Hikashop Extension For Joomla | 2026-07-23 | 6.1 Medium |
| Joomla Extension - hikashop.com - Open redirect in Hikashop < 6.5.2 - The Joomla extension Hikashop is vulnerable to an open redirect. | ||||
| CVE-2026-61900 | 1 Dj-extensions.com | 1 Jdownloads Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE. | ||||
| CVE-2026-61424 | 1 Dj-extensions.com | 1 Dj-classifieds Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE. | ||||
| CVE-2026-61425 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-07-23 | N/A |
| Joomla Extension - balbooa.com - Authentication bypass in Gridbox < 1.6.0 - The Joomla extension Gridbox is vulnerable an authenticated bypass, potentially leading to full admin access. | ||||
| CVE-2026-13380 | 1 Vsee | 1 Clinic | 2026-07-23 | N/A |
| VSee Clinic 7.1.26 and VSee Clinic API 1.3.0 exposes cleartext SFTP credentials in the HTTP responses of three unauthenticated endpoints. The credentials are present in these responses only when SFTP connections have been configured within the application. No authentication is required to retrieve these credentials. An unauthenticated remote attacker who observes any of these HTTP responses on an instance where SFTP is configured can obtain the credentials and use them to access the associated SFTP server. | ||||
| CVE-2026-47128 | 1 Always-further | 1 Nono | 2026-07-23 | 6.1 Medium |
| nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets (concrete and abstract). This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version 0.55.0 patches the issue. | ||||
| CVE-2026-57852 | 1 Trilby Media | 1 Grav Cms Scheduler-webhook Plugin | 2026-07-23 | 5.6 Medium |
| Grav CMS scheduler-webhook plugin contains an authentication bypass vulnerability that allows unauthenticated remote attackers to trigger configured scheduled jobs by exploiting a short-circuit logic flaw in the webhook token validation. Attackers can send a single unauthenticated POST request to the scheduler webhook endpoint to execute all configured scheduled jobs or target a specific job, causing unintended execution of operator-defined commands under the web server process user. | ||||