Export limit exceeded: 367920 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 367920 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (367920 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84205 | 1 Growi | 1 Growi | 2026-09-02 | 6.5 Medium |
| GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter but returns the revision identified by the path parameter without confirming they reference the same page. Authenticated attackers can pair a page identifier they can access with an arbitrary revision identifier to read revision content from pages they lack permission to view. | ||||
| CVE-2026-83551 | 2 Amazon, Aws | 2 Sagemaker Python Sdk, Sagemaker-python-sdk | 2026-09-02 | 7.2 High |
| Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11.0 and v2.256.0 might allow an authenticated remote user to extract the HMAC signing key from SageMaker DescribePipeline API responses and forge valid integrity signatures for specially crafted function payloads, achieving code execution in another user's pipeline execution context within the same AWS account. | ||||
| CVE-2026-84363 | 1 Hono | 1 Hono | 2026-09-02 | 5.9 Medium |
| Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, Hono's query helpers treat a question mark after a literal hash fragment as the start of a query string, so the application can read request parameters that browsers, new URL(), reverse proxies, filtering rules, parameter allow and deny lists, access logging, request validation, and other middleware do not observe. The Cache Middleware removes the fragment when building its cache key, allowing a response influenced by parameters inside the fragment to be stored under a key that omits those parameters and later served to other users. This can bypass filtering and auditing, poison cached responses, and enable stored cross-site scripting when an affected parameter is reflected into cached HTML without escaping. Exploitation requires a runtime and intermediary path that passes a literal hash character through to the request URL; Cloudflare Workers and intermediaries that strip fragments are not affected. This issue is fixed in version 4.13.5. | ||||
| CVE-2026-84364 | 1 Hono | 1 Hono | 2026-09-02 | 5.3 Medium |
| Hono is a Web application framework that provides support for any JavaScript runtime. Prior to 4.13.5, when parseBody() expands dot-separated form field names into nested objects with dot-notation parsing enabled, it does not limit the nesting depth or the total number of intermediate objects created. Empty segments are preserved, so one deeply dotted field name can encode one nesting level per byte, while a large number of shallowly dotted fields can create the same amplification across a request. A request body within a normal size limit can therefore allocate an object graph far larger than the request after the body has already been accepted. An unauthenticated attacker who can reach an affected endpoint can send concurrent requests that exhaust the JavaScript heap, terminate the server process, and leave the service unavailable until restart. Dot-notation parsing is not enabled by default, and applications using the default behavior are not affected. This issue is fixed in version 4.13.5. | ||||
| CVE-2026-84365 | 1 Hono | 1 Hono | 2026-09-02 | 6.5 Medium |
| Hono is a Web application framework that provides support for any JavaScript runtime. From 4.12.12 until 4.13.5, the fix released for CVE-2026-39408 does not cover every traversal sequence, and toSSG() can still write files outside the configured output directory when a route parameter contains consecutive parent-directory segments. Static site generation builds each output path from the route path and values supplied through ssgParams, then verifies that the result stays inside the output directory using the same normalization routine that built the path. That routine does not fully collapse runs of consecutive parent-directory segments, allowing a path that the check accepts to resolve outside the output directory, and the check also treats output directories that differ in how they are rooted as equivalent. This arises when an application generates a static site from route parameter values it does not fully control, such as slugs from a CMS, API, or user submission. An untrusted ssgParams value can create or overwrite files elsewhere in the build environment and alter generated artifacts or deployment output. The vulnerability affects build-time static site generation only; request-time routing and applications with entirely developer-controlled ssgParams values are not affected. This issue is fixed in version 4.13.5. | ||||
| CVE-2026-84371 | 1 Apostrophecms | 1 Apostrophecms | 2026-09-02 | 5.4 Medium |
| ApostropheCMS is an open-source Node.js content management system, and sanitize-html provides a simple HTML sanitizer with a clear API. From version 1.9.0 until version 2.17.7, packages/sanitize-html/index.js validates an animation value attribute as one flat URL and does not recognize that attributeName selecting href or xlink:href gives the sibling values, from, to, or by attribute SVG SMIL URL semantics. In configurations that allow the animate, animateColor, animateMotion, animateTransform, or set elements, a values list can begin with a safe fragment and contain a later executable destination that survives allowedSchemesAppliedToAttributes checking. When the sanitized SVG is rendered, the browser can copy that later destination into the live link, and a victim who activates the link can execute script in the application's origin. This issue is fixed in version 2.17.7. | ||||
| CVE-2026-84175 | 1 Eclipse | 1 Eclipse Ditto | 2026-09-02 | N/A |
| In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API users in the definition field of a Thing or Feature, without validating the target host, and follows HTTP redirects without re-validating the redirect target and without a hop limit. An authenticated user who is permitted to create a Thing, or who holds WRITE permission on an existing Thing, can thereby cause the Things service to issue arbitrary HTTP GET requests from inside the deployment's network — including to cloud instance-metadata endpoints and other internal services — and can use the differing error responses returned to the caller to enumerate internal services. Versions 2.4.0 to 2.5.x contain the same code, but are only affected where the operator explicitly enabled the WoT integration feature toggle, which is disabled by default in those versions. | ||||
| CVE-2026-82958 | 1 Eclipse | 1 Eclipse Ditto | 2026-09-02 | N/A |
| In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by substituting placeholder values (e.g. {{ header:device_id }}) resolved from inbound message headers into a pre-configured JSON "thing" template as raw, un-escaped strings, and then parses the resulting string as JSON. Because the placeholder engine performs no JSON escaping and is unaware of the surrounding JSON string context, a resolved value containing a double-quote character can break out of its string and inject additional JSON structure. When a connection is configured to use this mapper with a template that reflects a header whose value a publishing device can control (for example an MQTT 5 user property, an AMQP 1.0 application property, or a Kafka record header), an attacker able to publish on that connection can inject an inline _policy object. The inline policy overrides the administrator-configured policyId, letting the attacker assign an arbitrary access-control policy to the newly created digital twin — gaining full read/write access to it and potentially revoking the legitimate owner's access, with no administrator interaction. Exploitation requires all of the following: the connection uses the (non-default) ImplicitThingCreation mapper; its template reflects an attacker-controllable header; and, for the policy-override impact, the connection's authorization subjects are permitted to create policies (the default). Deployments that restrict the connection's subjects to thing creation only via the entity-creation configuration are not affected by the policy-override impact. | ||||
| CVE-2026-81769 | 2 Liquidthemes, Wordpress | 2 Booking Hub, Wordpress | 2026-09-02 | 8.8 High |
| Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from n/a through 1.3.1. | ||||
| CVE-2026-84771 | 2 Publishpress, Wordpress | 2 Publishpress Permissions, Wordpress | 2026-09-02 | 5.3 Medium |
| Unauthenticated Insecure Direct Object References (IDOR) in PublishPress Permissions <= 4.8.3 versions. | ||||
| CVE-2026-81164 | 1 Drupal | 1 Entity Pdf | 2026-09-02 | 5.4 Medium |
| Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. | ||||
| CVE-2026-81158 | 1 Drupal | 1 Entity Api | 2026-09-02 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1.8.0. | ||||
| CVE-2026-81159 | 1 Drupal | 1 Commerce Cybersource | 2026-09-02 | 3.7 Low |
| Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versions: from 0.0.0 to 1.10.0. | ||||
| CVE-2026-73478 | 1 Drupal | 1 Diff | 2026-09-02 | 5.3 Medium |
| Incorrect Authorization vulnerability in Drupal Diff allows Forceful Browsing. This issue affects Diff versions: from 0.0.0 to 2.0.1, from 2.1.0 to 2.1.1. | ||||
| CVE-2026-18986 | 1 Drupal | 1 Entity Browser | 2026-09-02 | 4.8 Medium |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0. | ||||
| CVE-2026-16658 | 1 Proxmox | 1 Proxmox | 2026-09-02 | 9.9 Critical |
| A flaw was found in the community.proxmox Ansible collection's proxmox_pct_remote connection plugin. The _build_pct_command() method constructs a pct exec command string using unquoted string concatenation and passes it to the Proxmox host's shell via Paramiko. Shell metacharacters in the command (such as >, |, ;, &&, or $()) are interpreted on the host instead of inside the target LXC container, allowing commands intended for an unprivileged container to execute on the hypervisor host as root. This constitutes a container-to-host trust boundary crossing. The put_file and fetch_file methods in the same plugin correctly use shell quoting, indicating this is an oversight on the exec path. | ||||
| CVE-2026-19625 | 1 Quarkus | 1 Oidc | 2026-09-02 | 8.7 High |
| A flaw was found in Quarkus OIDC. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass. | ||||
| CVE-2026-19651 | 1 Quarkus | 1 Quarkus-spring-web | 2026-09-02 | N/A |
| A flaw was found in quarkus-spring-web. A remote attacker could exploit this vulnerability by manipulating the URL query string. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources. | ||||
| CVE-2026-77849 | 1 Grafana | 1 Global Hub | 2026-09-02 | 9.8 Critical |
| No description is available for this CVE. | ||||
| CVE-2026-80221 | 1 Grafana | 1 Global Hub | 2026-09-02 | 4.4 Medium |
| No description is available for this CVE. | ||||