Export limit exceeded: 29196 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (29196 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66318 | 1 Microsoft | 1 Edge Chromium | 2026-08-04 | 8.1 High |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-66313 | 1 Microsoft | 1 Edge Chromium | 2026-08-04 | 6.8 Medium |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. | ||||
| CVE-2026-64802 | 1 Jetbrains | 1 Goland | 2026-08-04 | 7.8 High |
| In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust in the Go Modules integration | ||||
| CVE-2026-64803 | 1 Jetbrains | 1 Goland | 2026-08-04 | 7.8 High |
| In JetBrains GoLand before 2026.2 arbitrary code execution was possible before granting project trust via the configured Go SDK | ||||
| CVE-2026-64804 | 1 Jetbrains | 1 Webstorm | 2026-08-04 | 8.4 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local linter tooling | ||||
| CVE-2026-64808 | 1 Jetbrains | 1 Phpstorm | 2026-08-04 | 8.4 High |
| In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via project tooling | ||||
| CVE-2026-64810 | 1 Jetbrains | 1 Intellij Idea | 2026-08-04 | 4.3 Medium |
| In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking | ||||
| CVE-2026-64811 | 1 Jetbrains | 1 Intellij Idea | 2026-08-04 | 7.8 High |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration | ||||
| CVE-2026-64815 | 1 Jetbrains | 1 Intellij Idea | 2026-08-04 | 8.1 High |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | ||||
| CVE-2026-65907 | 1 Jetbrains | 1 Teamcity | 2026-08-04 | 9.1 Critical |
| In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible | ||||
| CVE-2026-65802 | 1 Microsoft | 1 Edge Chromium | 2026-08-04 | 7.4 High |
| External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-16801 | 1 Devolutions | 1 Powershell Universal | 2026-08-04 | N/A |
| Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file. | ||||
| CVE-2026-16802 | 1 Devolutions | 1 Powershell Universal | 2026-08-04 | N/A |
| Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected. | ||||
| CVE-2026-64221 | 1 Linux | 1 Linux Kernel | 2026-08-04 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to the released channel to the DMA engine (or trying to free the channel a second time on late probe errors or driver unbind). This issue was flagged by Sashiko when reviewing a devres allocation conversion patch. | ||||
| CVE-2026-48061 | 1 Litestar-org | 1 Litestar | 2026-08-04 | 5.9 Medium |
| Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that strips X-Forwarded-Host, or when accepting HTTP/1.0 connections. This issue has been fixed in version 2.22.0. | ||||
| CVE-2026-69248 | 1 Pyca | 1 Cryptography | 2026-08-04 | N/A |
| cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0. | ||||
| CVE-2026-66311 | 1 Microsoft | 1 Edge Chromium | 2026-08-04 | 6.2 Medium |
| Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. | ||||
| CVE-2026-66325 | 1 Microsoft | 1 Edge Chromium | 2026-08-04 | 6.1 Medium |
| Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-18686 | 1 Gl-inet | 2 Gl-mt3000, Gl-mt3000 Firmware | 2026-08-04 | 9.8 Critical |
| A vulnerability was detected in GL.iNet GL-MT3000 up to 4.4.5. The affected element is the function nas-web.add_user of the file /cgi-bin/glc of the component nas-web RPC Wrapper. Performing a manipulation results in command injection. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. | ||||
| CVE-2026-58041 | 2026-08-04 | N/A | ||
| A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSync#createTagStore() to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3_reset() directly, bypassing the iterator invalidation mechanism introduced for StatementSync in recent releases This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. | ||||