Export limit exceeded: 40308 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (40308 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16734 | 2026-08-06 | N/A | ||
| The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthenticated payment-form AJAX actions, allowing an unauthenticated visitor — using a nonce that is embedded in every public page containing a payment form — to change the amount of a payment intent that the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 then updates server-side through the Stripe API with the store's secret key. An ownership check added in 8.5.0 was applied to only one payment-intent handler, leaving the pricing-recalculation and payment-intent-update actions unprotected against amount manipulation. | ||||
| CVE-2026-24552 | 2 Mischiefmarmot, Wordpress | 2 Create By Mediavine, Wordpress | 2026-08-06 | 8.5 High |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create allows Blind SQL Injection. This issue affects Create: from n/a through 2.5.3. | ||||
| CVE-2026-64596 | 1 Linux | 1 Linux Kernel | 2026-08-06 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo() Since commit 1e7ab6f67824 ("anon_inode: rework assertions"), path_noexec() warns when an anonymous-inode file is mmap'd from a superblock that has not set SB_I_NOEXEC. dma-buf backs its files this way and never set the flag, so mmap of any exported buffer trips the warning on a CONFIG_DEBUG_VFS=y kernel: WARNING: CPU: 11 PID: 121813 at fs/exec.c:118 path_noexec+0x47/0x50 do_mmap+0x2b5/0x680 vm_mmap_pgoff+0x129/0x210 ksys_mmap_pgoff+0x177/0x240 __x64_sys_mmap+0x33/0x70 init_pseudo() sets up internal SB_NOUSER mounts that are never path-reachable. Set both flags here so every pseudo filesystem gets them by default instead of each caller setting them. SB_I_NODEV is inert for unreachable mounts. SB_I_NOEXEC has one visible effect: an executable mapping of a pseudo-fs fd, such as a dma-buf, now fails with -EPERM, which is the invariant the assertion enforces. No in-tree caller maps these executable. Reproduce on CONFIG_DEBUG_VFS=y: make -C tools/testing/selftests/dmabuf-heaps sudo ./tools/testing/selftests/dmabuf-heaps/dmabuf-heap -t system | ||||
| CVE-2026-64589 | 1 Linux | 1 Linux Kernel | 2026-08-06 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix NULL-deref on adapter registration failure If adapter registration ever fails the release callback would trigger a NULL-pointer dereference as the completion struct has not been initialised. Note that before the offending commit this would instead have resulted in a minor memory leak of the adapter name. | ||||
| CVE-2023-7355 | 2026-08-06 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-7354 | 2026-08-06 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-7353 | 2026-08-06 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2026-51400 | 2026-08-06 | 8.4 High | ||
| An issue in Vim Project v9.2.0389 and earlier allows a local attacker to execute arbitrary code via the vms_fixfilename() function within file vim/src/os_vms.c | ||||
| CVE-2026-8400 | 1 Ibm | 2 Websphere Application Server, Websphere Application Server Liberty | 2026-08-06 | 8.1 High |
| IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty Continuous delivery has a flaw in the ORB component in IBM SDK, Java Technology Edition, may allow a malicious IIOP server to induce loading and instantation of arbitrary classes. | ||||
| CVE-2026-44945 | 1 Suse | 1 Rancher | 2026-08-06 | 9.1 Critical |
| A privilege escalation vulnerability exists in Rancher's impersonation middleware (pkg/auth/requests/impersonate.go). An authenticated Rancher user with the default user global role can gain full administrative access to the Rancher control plane and transitively to all downstream clusters it manages. This issue affects Rancher: from 2.11.0 before 2.11.16, from 2.12.0 before 2.12.12, from 2.13.0 before 2.13.8, and from 2.14.0 before 2.14.2. | ||||
| CVE-2026-55997 | 1 Rancher | 1 Rancher | 2026-08-06 | 8.8 High |
| Rancher issues long-lived registration tokens to authenticate nodes and agents joining a downstream cluster. These tokens were stored and exposed in plaintext with no expiration, so a malicious user could obtain one either through the Rancher API, etcd, stored automation, or direct file access on a node, and could use it at any time to register a rogue node into the cluster. | ||||
| CVE-2026-24076 | 1 Qualcomm | 1 Snapdragon | 2026-08-06 | 6.7 Medium |
| Memory Corruption when processing registry values with incorrect types using a direct query method. | ||||
| CVE-2023-54389 | 2026-08-06 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54388 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54387 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54386 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54385 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54384 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54383 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; never assigned. | ||||
| CVE-2023-54382 | 2026-08-05 | N/A | ||
| Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | ||||