Export limit exceeded: 368613 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (368613 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79419 | 2026-09-05 | N/A | ||
| A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser. | ||||
| CVE-2026-86141 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 2.9 Low |
| xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking. | ||||
| CVE-2026-86144 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 5.6 Medium |
| In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. This has security relevance for, for example, the XML_PARSE_NONET flag, if (without it) a custom resource loader accesses the internet and triggers XML external entity injection, SSRF, or a denial of service (e.g., for an attacker-controlled internet resource that is intentionally slow). | ||||
| CVE-2026-86138 | 1 Xmlsoft | 1 Libxml2 | 2026-09-05 | 6.9 Medium |
| In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. | ||||
| CVE-2026-83711 | 1 Microsoft | 2 Azure Active Directory B2c, Entra Id | 2026-09-05 | 10 Critical |
| Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-80098 | 1 Microsoft | 1 Copilot Studio | 2026-09-05 | 9.3 Critical |
| Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70352 | 1 Microsoft | 1 Azure Ai Language Authoring | 2026-09-05 | 10 Critical |
| Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70178 | 1 Microsoft | 1 Microsoft Fabric | 2026-09-05 | 8.5 High |
| Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-65818 | 1 Microsoft | 1 Power Platform | 2026-09-05 | 8.5 High |
| Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62916 | 1 Microsoft | 2 Entra Id, Microsoft Entra Id | 2026-09-05 | 9.1 Critical |
| Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-71624 | 1 Esotalk | 1 Esotalk | 2026-09-05 | N/A |
| An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components | ||||
| CVE-2026-75438 | 1 Open5gs | 1 Open5gs | 2026-09-05 | N/A |
| Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function | ||||
| CVE-2026-9736 | 1 Ibm | 1 Netezza Software | 2026-09-05 | 5.3 Medium |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files. | ||||
| CVE-2026-85444 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.5 High |
| MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory. | ||||
| CVE-2026-85439 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.8 High |
| MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit. | ||||
| CVE-2026-85434 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 9.1 Critical |
| MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses. | ||||
| CVE-2026-85429 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.5 High |
| MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation. | ||||
| CVE-2026-85424 | 1 Themoos | 1 Core-moos | 2026-09-05 | 9.8 Critical |
| MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues. | ||||
| CVE-2026-85395 | 1 Webkul | 1 Unopim | 2026-09-05 | 7.1 High |
| UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware. | ||||
| CVE-2026-85225 | 1 Code-projects | 1 Doctor Appointment System | 2026-09-05 | 7.3 High |
| A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||