Export limit exceeded: 366264 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 366264 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (366264 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18904 | 1 Ibm | 1 Langflow Oss | 2026-08-28 | 8.2 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers. | ||||
| CVE-2026-18899 | 1 Ibm | 1 Langflow Oss | 2026-08-28 | 7.5 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to read arbitrary files due to path traversal. | ||||
| CVE-2026-18891 | 1 Ibm | 1 Langflow Oss | 2026-08-28 | 8.2 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary flows and access sensitive information due to improper authentication. | ||||
| CVE-2026-18729 | 1 Ibm | 1 Langflow Oss | 2026-08-28 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code. | ||||
| CVE-2026-18545 | 1 Ibm | 1 Langflow Oss | 2026-08-28 | 4.3 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.1 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. | ||||
| CVE-2026-18527 | 1 Ibm | 1 Administration Runtime Expert For I | 2026-08-28 | 9.9 Critical |
| IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system. | ||||
| CVE-2026-71110 | 1 Oracle | 1 Helidon | 2026-08-28 | 8.1 High |
| Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server). Supported versions that are affected are 1.0.0-1.4.18, 3.0.0-3.2.17 and 4.0.0-4.4.1. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 8.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). | ||||
| CVE-2026-21584 | 1 Atlassian | 1 Bamboo Data Center | 2026-08-28 | N/A |
| This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22 * Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10 See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). This vulnerability was reported via our Penetration Testing program. | ||||
| CVE-2026-50980 | 2026-08-28 | N/A | ||
| Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record | ||||
| CVE-2026-51376 | 2026-08-28 | N/A | ||
| An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache | ||||
| CVE-2026-51613 | 1 Totolink | 1 T6 | 2026-08-28 | N/A |
| Incorrect access control in the getDeviceInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain device identification details via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51616 | 2026-08-28 | N/A | ||
| Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51628 | 1 Totolink | 1 T6 | 2026-08-28 | N/A |
| Incorrect access control in the getGenerateWiFiWpsPin function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to generate and retrieve a new WPS PIN via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51629 | 1 Totolink | 1 T6 | 2026-08-28 | N/A |
| Incorrect access control in the getStaticDhcpRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain static DHCP reservation rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51630 | 1 Totolink | 1 T6 | 2026-08-28 | N/A |
| Incorrect access control in the getDdnsCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain DDNS configuration, including domain, username, and password, via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51634 | 1 Totolink | 1 T6 | 2026-08-28 | N/A |
| Incorrect access control in the getWiFiBasicCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain core wireless settings, including SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51635 | 1 Totolink | 1 T6 | 2026-08-28 | N/A |
| Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-76888 | 1 Wireshark | 1 Wireshark | 2026-08-28 | 3.1 Low |
| RDP protocol dissector crash in 4.6.0 to 4.6.7 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-17203 | 1 Ibm | 1 Administration Runtime Expert For I | 2026-08-28 | 7.5 High |
| IBM Administration Runtime Expert for i 1R1M0 could allow a remote authenticated attacker to obtain sensitive information due to improper authentication enforcement. | ||||
| CVE-2026-16821 | 1 Ibm | 2 Aix, Powervm Vios | 2026-08-28 | 7 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to a format string vulnerability. | ||||