Export limit exceeded: 389293 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 389293 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389293 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19203 | 1 Eclipse | 1 Jetty | 2026-09-08 | N/A |
| A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination. | ||||
| CVE-2026-16005 | 1 Asus | 1 Armoury Crate | 2026-09-08 | N/A |
| Release of Invalid Pointer or Reference in Armoury Crate driver allows a local user to free arbitrary memory via a crafted IOCTL request by bypassing the driver's verification, which can corrupt data structures and cause a system crash (BSOD).Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-16004 | 1 Asus | 1 Armoury Crate | 2026-09-08 | N/A |
| Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-23922 | 1 Zabbix | 1 Zabbix | 2026-09-08 | 4.9 Medium |
| The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint. | ||||
| CVE-2023-54354 | 1 Nokogiri | 1 Nokogiri | 2026-09-08 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2022-51000 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-09-08 | 8.8 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2022-50999 | 1 Nokogiri | 1 Nokogiri | 2026-09-08 | 8.6 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2022-50998 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-09-08 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2021-47996 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-09-08 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-86737 | 1 Snipeitapp | 1 Snipe-it | 2026-09-08 | 4.3 Medium |
| snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets. | ||||
| CVE-2026-86736 | 1 Snipeitapp | 1 Snipe-it | 2026-09-08 | 4.3 Medium |
| snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue. | ||||
| CVE-2026-86731 | 1 Craftcms | 1 Craft Cms | 2026-09-08 | 6.5 Medium |
| Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an administrator, unlike the mirror action actionDeactivateUser. As a result, an authenticated control panel user who is not an administrator but holds the administrateUsers permission can activate a pending or deliberately deactivated administrator account, which can lead to permission escalation when combined with resetting that account's password. The issue is fixed in Craft CMS 5.10.12. | ||||
| CVE-2026-86729 | 1 Wwbn | 1 Avideo | 2026-09-08 | 7.4 High |
| WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover. | ||||
| CVE-2026-86727 | 1 Wwbn | 1 Avideo | 2026-09-08 | 7.5 High |
| AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials. | ||||
| CVE-2026-86726 | 1 Wwbn | 1 Avideo | 2026-09-08 | 6.5 Medium |
| AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability. | ||||
| CVE-2026-86724 | 1 Wwbn | 1 Avideo | 2026-09-08 | 6.5 Medium |
| AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value. | ||||
| CVE-2026-86722 | 1 Wwbn | 1 Avideo | 2026-09-08 | 8.1 High |
| AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result. | ||||
| CVE-2026-86721 | 1 Wwbn | 1 Avideo | 2026-09-08 | 7.5 High |
| AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overrides the $_REQUEST['key'] parameter in saveLive.php and related endpoints. Attackers can publish to any user's RTMP stream without authentication by using the known constant stream key value to hijack live broadcasts. | ||||
| CVE-2026-86719 | 1 Wwbn | 1 Avideo | 2026-09-08 | 5.4 Medium |
| WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the CustomizeUser plugin endpoint plugin/CustomizeUser/swapUser.json.php. The endpoint takes users_id from $_REQUEST and invokes User::swapUser() without calling forbidIfNotPost() or forbidIfInvalidToken(), and the global autoCSRFGuard() check only runs for POST requests to *.json.php, so the action is reachable via GET. An attacker who causes an authenticated administrator's browser to issue a cross-origin GET (for example via an <img> tag or link) can replace that administrator's session with a non-admin user account, causing the administrator to lose administrative access until the swap is cancelled; swapping to another administrator account is rejected, so this is not privilege escalation. The JSON response also discloses the session_id. The CustomizeUser plugin is enabled by default, and no patch was available at the time of publication. | ||||
| CVE-2026-31431 | 10 Amazon, Arista, Canonical and 7 more | 60 Amazon Linux, Cloudvision Agni, Cloudvision Portal and 57 more | 2026-09-08 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly. | ||||