Export limit exceeded: 390917 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390917 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86234 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-09 | 6.3 Medium |
| A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/cust_transac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. | ||||
| CVE-2026-86227 | 1 Valkey-io | 1 Valkey | 2026-09-09 | 3.1 Low |
| A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.c. This manipulation of the argument didx causes out-of-bounds read. It is possible to initiate the attack remotely. The attack is considered to have high complexity. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 4691888e7fab3df128f0bde5750c9fde2ae552fa. To fix this issue, it is recommended to deploy a patch. Exploitation requires cluster mode plus attacker-controlled dump.rdb at startup (data-dir write access, replication feed, or a stored crafted RDB) - an attacker-position DoS at boot, not network pre-auth. The issue report was closed stating it "is worth fixing for the sake of memory safety… but I don't think it meets our bar for a security disclosure." | ||||
| CVE-2026-86222 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-09-09 | 7.3 High |
| A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /admin/modal_add_course2.php. Such manipulation of the argument course leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-86099 | 1 Chainlit | 1 Chainlit | 2026-09-09 | 8.2 High |
| Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse filesystem paths by injecting absolute or relative path sequences. Attackers can craft malicious sessionId values that escape the upload directory and recursively delete arbitrary directories accessible to the service process. | ||||
| CVE-2026-80125 | 1 Dell | 2 Secure Connect Gateway Appliance, Secure Connect Gateway Application | 2026-09-09 | 5.9 Medium |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. | ||||
| CVE-2026-80058 | 1 Dell | 2 Secure Connect Gateway Appliance, Secure Connect Gateway Application | 2026-09-09 | 5.5 Medium |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Cleartext Storage of Sensitive Information vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. | ||||
| CVE-2026-79642 | 1 Dell | 2 Secure Connect Gateway Appliance, Secure Connect Gateway Application | 2026-09-09 | 5.6 Medium |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. | ||||
| CVE-2026-6431 | 2 Cozmoslabs, Wordpress | 2 User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor, Wordpress | 2026-09-09 | 7.2 High |
| The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-18453 | 1 Redhat | 11 Directory Server, Directory Server E4s, Enterprise Linux and 8 more | 2026-09-09 | 7.5 High |
| A flaw was found in 389 Directory Server. A missing NULL pointer check in the paged results handling of op_shared_search allows an unauthenticated remote attacker to crash the LDAP server by sending a crafted sequence of search requests using the USE_ONE_BACKEND control, resulting in denial of service. | ||||
| CVE-2024-58382 | 1 Thephpleague | 1 Commonmark | 2026-09-09 | 7.5 High |
| league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause denial of service. Attackers can submit carefully crafted Markdown inputs designed to trigger worst-case performance, and sending multiple requests in parallel exhausts CPU resources and PHP-FPM processes. | ||||
| CVE-2022-51014 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-09 | 6.5 Medium |
| PocketMine-MP before 4.0.7 contains an unhandled exception vulnerability in the ModalFormResponsePacket handler when processing malformed JSON from clients. Attackers can send specially crafted form response packets with invalid JSON to trigger an uncaught InvalidArgumentException, causing server crashes. | ||||
| CVE-2026-81397 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81398 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-81948 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7.8 High |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-17622 | 5 Apple, Ibm, Langflow and 2 more | 5 Macos, Langflow Oss, Langflow and 2 more | 2026-09-09 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-81950 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7.8 High |
| Double free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-17627 | 5 Apple, Ibm, Langflow and 2 more | 5 Macos, Langflow Oss, Langflow and 2 more | 2026-09-09 | 4.9 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into workflow history due to improper authorization. | ||||
| CVE-2026-81953 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-09-09 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-17631 | 5 Apple, Ibm, Langflow and 2 more | 5 Macos, Langflow Oss, Langflow and 2 more | 2026-09-09 | 5 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery (SSRF) vulnerability. | ||||
| CVE-2026-19649 | 1 Ibm | 3 App Connect Enterprise, Integration Bus For Z\/os, Integration Bus For Zos | 2026-09-09 | 6.2 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 could allow a local attacker to obtain sensitive information due to improper logging of database credentials. | ||||