Export limit exceeded: 388875 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (388875 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75162 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | N/A |
| An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentials in cleartext via the JSON API response. | ||||
| CVE-2026-79419 | 1 Emxtecnologia | 1 Gestao X Business Suite | 2026-09-07 | N/A |
| A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier. The vulnerability is caused by insufficient validation and sanitization of the mensagem parameter in the /Configuracao/Imagens.aspx endpoint, allowing an authenticated attacker to inject arbitrary JavaScript code that is reflected and executed in the context of a victim's browser. | ||||
| CVE-2026-31020 | 1 Arc53 | 1 Docsgpt | 2026-09-07 | 9.8 Critical |
| In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot interactions. This functionality renders user-supplied prompt data using Jinja templates without input sanitization or sandboxing. An unauthenticated attacker can inject malicious template expressions, leading to a server-side template injection (SSTI) vulnerability that can be exploited to achieve full remote code execution (RCE). | ||||
| CVE-2026-75430 | 1 Powerjob | 1 Powerjob | 2026-09-07 | 9.8 Critical |
| PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the default transport port. This allows a remote attacker to execute arbitrary code. | ||||
| CVE-2021-44320 | 1 Parrot | 1 Ar.drone | 2026-09-07 | 7.5 High |
| Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the device availability (i.e., video streaming and control) by using tool to perform an IPv4 flood attack. Verified attacks includes SYN flooding and UDP flooding. | ||||
| CVE-2026-75431 | 1 Powerjob | 1 Powerjob | 2026-09-07 | 9.1 Critical |
| PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote attacker to execute arbitrary code. | ||||
| CVE-2026-75163 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | 6.5 Medium |
| An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 returns detailed system version fields (operatingsystem, gatewayversion) to any authenticated user, including users with the low-privileged Standard role. | ||||
| CVE-2026-75168 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | 6.3 Medium |
| An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to write arbitrary content to files within /uxx/config/ and /ugw/config/. | ||||
| CVE-2026-75164 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | 6.5 Medium |
| An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to retrieve arbitrary files from the device filesystem via the file query string parameter. | ||||
| CVE-2026-75166 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | N/A |
| Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/bin/tcpdump as root without a password. By leveraging the tcpdump -z option, an authenticated attacker can achieve arbitrary command execution. | ||||
| CVE-2026-75167 | 1 Mbs-solutions | 1 X-serie Gateway | 2026-09-07 | N/A |
| A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated user with the low-privileged Standard role to change the password of arbitrary accounts. | ||||
| CVE-2026-75170 | 1 Hubcore | 1 Hubcore | 2026-09-07 | N/A |
| Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter. | ||||
| CVE-2026-75171 | 1 Hubcore | 1 Hubcore | 2026-09-07 | N/A |
| An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. | ||||
| CVE-2022-26961 | 1 Italtel | 1 Netmatch-s | 2026-09-07 | N/A |
| Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will then be triggered every time an authenticated user browses the page containing it. | ||||
| CVE-2026-50894 | 1 Zhongshaofa | 1 Easyadmin | 2026-09-07 | N/A |
| easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows authenticated remote attackers to execute arbitrary code and gain server privileges via a crafted file upload. | ||||
| CVE-2026-71625 | 1 Slimkit | 1 Thinksns+ | 2026-09-07 | N/A |
| An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component | ||||
| CVE-2026-19057 | 1 Gastromenum | 1 Gastromenum Ticket And Qr Menu System | 2026-09-07 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Stored XSS. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31. | ||||
| CVE-2026-19081 | 1 Gastromenum | 1 Gastromenum Ticket And Qr Menu System | 2026-09-07 | 4.3 Medium |
| Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Gastromenum Ticket and QR Menu System: before 2026.08.31. | ||||
| CVE-2026-19727 | 1 Yordam Information Technology Consulting, Training And Electronic Systems Industry And Trade Inc. | 1 Library Information And Document Automation Program | 2026-09-07 | 6.1 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issue affects Library Information and Document Automation Program: before v22.2. | ||||
| CVE-2026-19205 | 1 Gastromenum | 1 Gastromenum Web Panel | 2026-09-07 | 7.5 High |
| Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMenum Web Panel: before 31.08.2026. | ||||