Export limit exceeded: 33730 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (33730 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66338 | 2 Libsoup, Redhat | 2 Libsoup, Enterprise Linux | 2026-07-27 | 5.4 Medium |
| A flaw was found in libsoup. The chunked transfer encoding parser uses a permissive parsing function for chunk sizes that silently accepts inputs violating RFC 9112, including leading whitespace, plus sign prefixes, and trailing invalid characters. When libsoup operates behind a strict frontend proxy, this parsing differential can be exploited to smuggle HTTP requests. | ||||
| CVE-2026-14837 | 1 Lenze | 7 C430, C4xx Firmware, C550 and 4 more | 2026-07-27 | 7.8 High |
| Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the SSH enable file signature and enable SSH access on the device. Successful exploitation may result in unauthorized administrative access and complete system compromise. | ||||
| CVE-2026-65764 | 1 Phoca | 1 Phoca Commander Extension For Joomla | 2026-07-27 | N/A |
| Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability. | ||||
| CVE-2026-65765 | 1 Phoca | 1 Phoca Commander Extension For Joomla | 2026-07-27 | N/A |
| Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.1 - Improper limitation of paths for save and download actions lead to path traversal vulnerabilities. | ||||
| CVE-2026-48144 | 1 Apache | 1 Thrift | 2026-07-27 | N/A |
| Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-55969 | 1 Apache | 1 Thrift | 2026-07-27 | 7.5 High |
| Integer Overflow or Wraparound vulnerability in Apache Thrift C++, c_glib, Go, netstd, Delphi and Haxe bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. | ||||
| CVE-2026-66053 | 1 Apache | 1 Thrift | 2026-07-27 | 5.9 Medium |
| Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603 | ||||
| CVE-2026-59690 | 2 Process Software, Progress | 5 Multi Tenant, Ecs Connection Manager, Loadmaster and 2 more | 2026-07-27 | 8 High |
| A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations via the REST API that should not be accessible to their permission level, potentially resulting in a system compromise. | ||||
| CVE-2026-59535 | 2 Thrive Themes Coupon, Wordpress | 2 Thrive Product Manager, Wordpress | 2026-07-27 | 7.3 High |
| Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | ||||
| CVE-2026-10819 | 1 Mattermost | 1 Mattermost | 2026-07-27 | 6.5 Medium |
| Mattermost versions 11.6.x <= 11.6.5, 10.11.x <= 10.11.20, 11.8.x <= 11.8.1, 11.7.x <= 11.7.4 fail to limit the number of frames and enforce the file size cap on animated GIF uploads, which allows an authenticated attacker to cause a denial of service via a crafted animated GIF uploaded as a custom emoji.. Mattermost Advisory ID: MMSA-2026-00695 | ||||
| CVE-2026-50162 | 1 Oras-project | 1 Oras-go | 2026-07-27 | 5.3 Medium |
| oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, resolveWritePath() in content/file/file.go uses a lexical filepath.Rel check for workingDir and does not account for symlink traversal, so when AllowPathTraversalOnWrite=false an attacker-controlled blob title through ocispec.AnnotationTitle such as out/pwn.txt can follow a workingDir symlink out -> /some/outside/dir and cause pushFile() to create /some/outside/dir/pwn.txt outside workingDir. This issue is fixed in version 2.6.1. | ||||
| CVE-2026-17059 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-07-27 | 6.5 Medium |
| A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of a role. This allows a restricted administrator to see private information, such as names and email addresses, for users they should not be able to access. | ||||
| CVE-2026-59689 | 1 Progress | 4 Ecs Connection Manager, Loadmaster, Moveit Waf and 1 more | 2026-07-27 | 8 High |
| An Incorrect Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with low privileges to escalate privileges to root on the affected appliance, potentially resulting in full system compromise. | ||||
| CVE-2024-3884 | 1 Redhat | 19 Amq Streams, Apache Camel Hawtio, Build Keycloak and 16 more | 2026-07-27 | 7.5 High |
| A flaw was found in Undertow that can cause remote denial of service attacks. When the server uses the FormEncodedDataDefinition.doParse(StreamSourceChannel) method to parse large form data encoding with application/x-www-form-urlencoded, the method will cause an OutOfMemory issue. This flaw allows unauthorized users to cause a remote denial of service (DoS) attack. | ||||
| CVE-2026-57794 | 2 Uxper, Wordpress | 2 Golo Framework, Wordpress | 2026-07-27 | 7.5 High |
| Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo Framework golo-framework allows PHP Local File Inclusion.This issue affects Golo Framework: from n/a through <= 1.7.3. | ||||
| CVE-2026-61501 | 1 Rejetto | 1 Hfs | 2026-07-27 | 6.1 Medium |
| Rejetto HFS 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed, allowing the attacker to create accounts or execute code on the server with the administrator's privileges. | ||||
| CVE-2026-61502 | 1 Rejetto | 1 Hfs | 2026-07-27 | 4.3 Medium |
| Rejetto HFS 3.0.0 through 3.2.0 accepts state-changing API requests via the GET method and exempts GET requests from its anti-CSRF header check. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution - by causing a logged-in administrator's browser to navigate to a crafted URL, or without any credentials against default installations when the attack originates from the server's own machine. | ||||
| CVE-2026-61505 | 1 Rejetto | 1 Hfs | 2026-07-27 | 5.3 Medium |
| Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact. | ||||
| CVE-2026-44745 | 1 Sap Se | 1 Sap Approuter | 2026-07-27 | 8.1 High |
| SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application. | ||||
| CVE-2026-12482 | 1 Keras-team | 1 Keras | 2026-07-27 | 4.2 Medium |
| A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues. | ||||