Export limit exceeded: 370878 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (370878 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82750 | 2 Zenhive, Zenhive | 2 Mpp, Mpp | 2026-09-08 | N/A |
| Improper Validation of Specified Quantity in Input in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment by a large multiplier and to have the sponsor pay for EIP-7702 account delegations of the client's choosing. When the server sponsors Tempo payments, MPP.Methods.Tempo.FeePayerPolicy.measure/3 in lib/mpp/methods/tempo/fee_payer_policy.ex bounds the gas fields, the fee budget, the validity window and the access list of the client-signed 0x76 envelope, but never reads its aa_authorization_list field. Every signed delegation in that list is charged as intrinsic gas before the payment call runs, so a client attaching delegations from throwaway authority keys makes the sponsor pay for them within the default gas_limit ceiling. At the reporter's default of seven entries the sponsored cost rises from about 46,575 gas to about 1,884,087 gas. Because each entry is applied as a persistent set-code delegation, a client can also upgrade its own accounts to delegated code at the sponsor's expense. This issue affects mpp: from 0.2.0 before 0.16.1. | ||||
| CVE-2026-82309 | 1 Perl | 1 Robots::validate | 2026-09-08 | 4.3 Medium |
| Robots::Validate versions from 0.3.2 before 0.3.11 for Perl allow unbounded outbound DNS queries per validation via a forward-confirmation loop that does not bound the names it queries. _check_dns issues one PTR query for the client address, keeps the returned names matching the rule's domain, and issues a forward query for each until one resolves back to that address. Nothing bounds that list, and a client controls the reverse zone for its own address, so it chooses how many names the PTR answer holds. Net::DNS refetches a truncated answer over TCP by default, so the 512-byte UDP payload does not cap it either. Any client whose User-Agent matches a rule with a domain reaches _check_dns. Each forward name is distinct and client-chosen, so every query misses the local cache and is resolved against the authoritative servers for that domain. The queries are synchronous, so the caller is held until all of them answer or time out. | ||||
| CVE-2026-82209 | 1 Curl | 1 Curl | 2026-09-08 | 8.2 High |
| When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a `Set-Cookie` header where the `Domain` attribute explicitly matches an origin host that is itself a public suffix (e.g., `Domain=co.uk` set by `co.uk`). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (`.co.uk`). Consequently, the cookie is inappropriately included in subsequent outbound requests or HTTP redirects to arbitrary sibling subdomains under the same public suffix (e.g., `attacker.co.uk`). | ||||
| CVE-2026-82208 | 1 Curl | 1 Curl | 2026-09-08 | 7.5 High |
| With the wolfSSL backend, when CA caching is enabled and an `CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted. | ||||
| CVE-2026-82071 | 1 Mongodb | 1 Mongodb Server | 2026-09-08 | 8.1 High |
| Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution. | ||||
| CVE-2026-82060 | 1 Mongodb | 1 Mongodb Server | 2026-09-08 | 5.4 Medium |
| In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the updateLookup full document mode, the crafted values were embedded into internal post-image lookup queries without proper sanitization, causing them to be interpreted as query operators rather than literal equality values. This could result in change stream consumers receiving incorrect post-image documents or encountering non-resumable fatal errors. | ||||
| CVE-2026-81960 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81955 | 1 Microsoft | 22 365 Apps, Office 2016, Office 2019 and 19 more | 2026-09-08 | 8.8 High |
| Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-81950 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 7.8 High |
| Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81400 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81395 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81390 | 1 Microsoft | 9 365 Apps, Excel 2016, Office 2016 and 6 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-81385 | 1 Microsoft | 5 365 Apps, Office 2019, Office 2021 and 2 more | 2026-09-08 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office Publisher allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-81377 | 1 Microsoft | 1 Visual Studio Code | 2026-09-08 | 6.5 Medium |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-80255 | 1 Curl | 1 Curl | 2026-09-08 | 7.5 High |
| A `Set-Cookie:` header using tab (horizontal tab, ASCII code 9) instead of space (ascii code 32) immediately before the `Secure` attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host. | ||||
| CVE-2026-80231 | 1 Curl | 1 Curl | 2026-09-08 | 7.5 High |
| A flaw in libcurl makes it wrongly reuse an existing HTTPS connection setup for a given hostname even when using a different Native CA Store setting (`CURLSSLOPT_NATIVE_CA`) than when the connection was created. | ||||
| CVE-2026-80230 | 1 Curl | 1 Curl | 2026-09-08 | 7.5 High |
| When `CURLOPT_PINNEDPUBLICKEY` is configured alongside options that disable standard peer verification (`CURLOPT_SSL_VERIFYPEER = 0` and `CURLOPT_SSL_VERIFYHOST = 0`), libcurl fails to enforce public key pinning on connections established without a presented server certificate. Bypassing the pinning check under these disabled-verification conditions allows unauthenticated connections to succeed when they should be rejected. | ||||
| CVE-2026-80181 | 1 Apache | 1 Allura | 2026-09-08 | 9.1 Critical |
| Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. | ||||
| CVE-2026-80089 | 1 Microsoft | 8 365 Apps, Office 2016, Office 2019 and 5 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-80084 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Outlook allows an unauthorized attacker to disclose information over a network. | ||||