Export limit exceeded: 17433 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17433 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-44090 | 1 Ohsoft | 1 Coffeezip | 2026-08-04 | 8.8 High |
| An issue in OhSoft CoffeeZip v4.8.0.0 allows attackers to execute arbitrary code via downloading and executing a crafted archive file. | ||||
| CVE-2025-50324 | 1 Onecommander | 1 Onecommander | 2026-08-04 | 8.8 High |
| An issue in Milos Paripovic OneCommander v.3.96.0.0 allows a remote attacker to execute arbitrary code via the OneCommander.exe component. | ||||
| CVE-2025-50329 | 1 Conexware | 1 Powerarchiver | 2026-08-04 | 9.8 Critical |
| An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe. | ||||
| CVE-2026-56844 | 1 Veeam | 1 Backup And Replication | 2026-08-04 | N/A |
| A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system. | ||||
| CVE-2026-57599 | 1 Hikvision | 1 Ds-2cd Series | 2026-08-04 | 6.6 Medium |
| There is a privilege escalation vulnerability in some Hikvision cameras. Due to incorrect permission allocation in the device program, attackers can escalate privileges and gain full control of the device after authenticating via SSH. | ||||
| CVE-2026-61390 | 1 Hikvision | 2 Ds-2cd Series, Ds-2de Series | 2026-08-04 | 7.7 High |
| There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets. | ||||
| CVE-2026-61391 | 1 Hikvision | 2 Ds-2cd Series, Ds-2de Series | 2026-08-04 | 7.2 High |
| There is a stack-based buffer overflow vulnerability in some Hikvision cameras, which may allow authenticated attackers to cause device malfunction by sending specially crafted packets. | ||||
| CVE-2026-61392 | 1 Hikvision | 2 Ds-2cd Series, Ds-2de Series | 2026-08-04 | 5.3 Medium |
| There is a information disclosure vulnerability in some Hikvision cameras, allowing unauthenticated attackers to obtain partial information from the device’s memory. | ||||
| CVE-2026-11835 | 2026-08-04 | N/A | ||
| Time-of-check time-of-use (TOCTOU) vulnerability combined with missing input validation in Caliptra Core ROM (UpdateResetFlow::run()) in subsystem mode allows a compromised local attacker to silently bypass secure boot by supplying an AXI staging address that is not validated against the strap-configured SS_EXTERNAL_STAGING_AREA_BASE_ADDR, enabling firmware to be modified between verification and loading into ICCM. Attestation continues to report the originally verified image digest, masking the compromise. Exploitation requires a compromised MCU firmware with AXI manager access to unprotected SRAM reachable by Caliptra. This issue affects Core ROM: 2.1.0 through 2.1.1. | ||||
| CVE-2026-11836 | 2026-08-04 | N/A | ||
| Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware (validate_debug_unlock_token()) in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued for a different device sharing the same debug unlock key hash. The 384-bit challenge nonce continues to prevent replay of previously issued tokens. Practical impact is limited to loss of per-device scope enforcement within a set of devices that share the same unlock authority by design; it does not enable debug unlock on devices outside that set. This issue affects Core ROM: 2.0.0 through 2.0.2, 2.1.0 through 2.1.1; Core Firmware: 2.0.0 through 2.0.1, 2.1.0. | ||||
| CVE-2026-67969 | 1 Nasa | 1 Cfs | 2026-08-04 | N/A |
| An issue in the HS_MonitorApplications() component of NASA cFS v7.0.1 allows attackers to force the processor to reset via supplying a crafted HS.AppMon_Tbl entry. | ||||
| CVE-2026-67974 | 1 Nasa | 1 Cfs | 2026-08-04 | N/A |
| A parser boundary flaw in the Software Bus Network (SBN) application's peer subscription message handling in NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via sending a crafted packet. | ||||
| CVE-2026-67975 | 1 Nasa | 1 Cfs | 2026-08-04 | N/A |
| Incorrect access control in NASA cFS v7.0.1 allows attackers to arbitrarily remove low-index subscriptions and add new streams via sending TO_LAB add/remove subscription commands. | ||||
| CVE-2026-67617 | 1 Microweber | 1 Microweber | 2026-08-04 | 4.8 Medium |
| Microweber CMS through 2.0.20 contains a stored cross-site scripting vulnerability in the content tagging system that allows admin-authenticated attackers to inject arbitrary JavaScript by submitting malicious payloads via the tag_names parameter of the GET /api/save_content_admin endpoint, bypassing three independent sanitization controls including XSS middleware that ignores GET requests, a strip_unsafe() function that only matches double-quoted onerror attributes, and a titlecase normalizer that passes HTML decimal entity-encoded payloads through unchanged. Attackers can store malicious scripts that execute without user interaction for every visitor to the public blog page and within the admin post editor, enabling session riding through same-origin fetch requests using the CSRF token embedded in the page. | ||||
| CVE-2026-44276 | 1 Dell | 1 Powerprotect Data Manager | 2026-08-03 | 6 Medium |
| Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the REST API. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information exposure. | ||||
| CVE-2026-40712 | 1 Dell | 1 Powerprotect Data Manager | 2026-08-03 | 9.1 Critical |
| Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. | ||||
| CVE-2026-46738 | 1 Dell | 1 Powerprotect Data Manager | 2026-08-03 | 9.1 Critical |
| Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. | ||||
| CVE-2026-65650 | 1 Elgg | 1 Elgg | 2026-08-03 | 4.3 Medium |
| Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload. | ||||
| CVE-2026-22049 | 1 Netapp | 1 Ontap 9 | 2026-08-03 | N/A |
| ONTAP versions 9.16.1 and higher with WebAuthn multi-factor authentication (MFA) configured are susceptible to a vulnerability related to the Relying Party ID which when successfully exploited could allow an attacker with valid credentials to bypass MFA. | ||||
| CVE-2026-67978 | 1 Nasa | 1 Cfs | 2026-08-03 | N/A |
| An issue in the SBN UDP interface of NASA cFS v7.0.1 allows attackers to cause a Denial of Service (DoS) via transmitting a crafted SBN frame. | ||||