Export limit exceeded: 366768 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 366768 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 366768 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366768 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74892 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-31 | 7.5 High |
| openssl_encrypt versions before 1.4.0 contain a hardcoded default secret key in the standalone telemetry server configuration that is used for API key hashing. Attackers who know this default value can predict or forge API key hashes to compromise telemetry API authentication. | ||||
| CVE-2026-21827 | 2026-08-31 | 3.1 Low | ||
| HCL Connections is vulnerable to an information disclosure vulnerability which could allow a user to obtain sensitive information they are not entitled to, caused by improper handling of request data they are not entitled to, caused by improper handling of request data. | ||||
| CVE-2026-76940 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 7.5 High |
| The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication. | ||||
| CVE-2026-77966 | 2026-08-31 | 8.8 High | ||
| The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker could access security sensitive configuration functions and modify settings that affect the confidentiality, integrity, or availability of the device. | ||||
| CVE-2026-79272 | 1 Google | 1 Chrome | 2026-08-31 | 3.1 Low |
| Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-34616 | 1 Adobe | 1 Dng Software Development Kit | 2026-08-31 | 5.5 Medium |
| DNG SDK versions 1.7.1 2502 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information from memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-73809 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 7.5 High |
| A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device. Successful exploitation could result in disclosure of sensitive information and unauthorized access to device management functionality. | ||||
| CVE-2026-51686 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to reconfigure or disable wireless networks via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51687 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setWiFiEasyGuestCf function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to create or weaken guest wireless access via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51689 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setUpgradeFW function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger firmware-upgrade workflow changes via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51690 | 1 Totolink | 1 T6 | 2026-08-31 | N/A |
| Incorrect access control in the setWanCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to alter upstream provisioning and connectivity via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-71187 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 9.8 Critical |
| The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device. | ||||
| CVE-2026-75548 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 5.4 Medium |
| The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions. | ||||
| CVE-2026-7487 | 1 Gitlab | 1 Gitlab | 2026-08-31 | 3.5 Low |
| GitLab has remediated an issue in GitLab EE affecting all versions from 13.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with reporter-role permissions who authored a merge request could have reset merge request approval rules due to improper authorization checks. | ||||
| CVE-2026-69658 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 9.8 Critical |
| MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions. | ||||
| CVE-2026-77801 | 1 Gitlab | 1 Gitlab | 2026-08-31 | 6.5 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an authenticated user to cause a denial of service affecting background job processing, due to missing object count limits. | ||||
| CVE-2026-3035 | 1 Gitlab | 1 Gitlab | 2026-08-31 | 5.5 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with project Maintainer permissions could have accessed the terminal of a protected environment they were not authorized to use due to improper authorization checks. | ||||
| CVE-2026-18252 | 1 Gitlab | 1 Gitlab | 2026-08-31 | 7.3 High |
| GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have executed arbitrary commands in a CI context, due to the Claude agent processing configuration from a user-controlled source. | ||||
| CVE-2026-77977 | 1 Ebyte | 1 Ebyte Ne2-d11 Firmware | 2026-08-31 | 8.1 High |
| Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings, resulting in a loss of configuration and service availability. | ||||
| CVE-2026-15387 | 1 Gitlab | 1 Gitlab | 2026-08-31 | 4.3 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, an authenticated user with developer-role permissions could have influenced the execution environment of Pipeline Execution Policy enforcement jobs, due to improper handling of job dependencies. | ||||