Export limit exceeded: 97726 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (97726 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-36940 | 1 Google | 1 Android | 2026-08-24 | 8.8 High |
| Use-After-Free vulnerability in a zircon kernel pager proxy (Fuchsia), which could lead to a Privilege Escalation from Userspace to Kernel (AP) | ||||
| CVE-2026-66584 | 2 Code4recovery, Wordpress | 2 12 Step Meeting List, Wordpress | 2026-08-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions. | ||||
| CVE-2026-78270 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluentcrm | 2026-08-24 | 7.6 High |
| Author SQL Injection in FluentCRM Pro <= 3.1.12 versions. | ||||
| CVE-2026-28151 | 2 Select-themes, Wordpress | 2 Tonda Core, Wordpress | 2026-08-24 | 8.1 High |
| Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | ||||
| CVE-2026-32477 | 2 Radiustheme, Wordpress | 2 Shopbuilder – Elementor Woocommerce Builder Addons, Wordpress | 2026-08-24 | 8.6 High |
| Unauthenticated Arbitrary File Deletion in ShopBuilder Pro – Elementor WooCommerce Builder Addons <= 2.2.0 versions. | ||||
| CVE-2026-32478 | 2 Wedevs, Wordpress | 2 Wp Project Manager, Wordpress | 2026-08-24 | 8.5 High |
| Subscriber SQL Injection in WP Project Manager Pro <= 4.0.1 versions. | ||||
| CVE-2026-71505 | 1 Dolibarr | 1 Dolibarr | 2026-08-24 | 7.1 High |
| Dolibarr before 24.0.0 contains a broken object-level authorization vulnerability in the REST API third-party site account write routes that allows authenticated attackers with third-party creation rights to overwrite the WebPortal password of any company by bypassing per-object access checks that are only enforced on read routes. Attackers can replace the victim company's WebPortal password through the write endpoint, authenticate as that company to access its invoice data, and also obtain the victim's previous password verifier from the API response. | ||||
| CVE-2026-16927 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-08-24 | 7.3 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain root privileges due to a time-of-check to time-of-use (TOCTOU) race condition. | ||||
| CVE-2026-16928 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-08-24 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. | ||||
| CVE-2026-16932 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-08-24 | 8.8 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper validation of the ODMDIR environment variable. | ||||
| CVE-2026-16930 | 1 Ibm | 39 Power System E1050 \(9043-mrx\), Power System E1050 \(9043-mrx\) Firmware, Power System E1080 \(9080-hex\) and 36 more | 2026-08-24 | 8.2 High |
| IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can execute arbitrary code on the host system, giving full control over the host system and all hosted partitions, resulting in a confidentiality, integrity, and availability impact. | ||||
| CVE-2026-16989 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-08-24 | 7.1 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper resolution of symbolic links. | ||||
| CVE-2026-70940 | 1 Oracle | 1 Hyperion Financial Management | 2026-08-24 | 8.8 High |
| Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-70950 | 1 Oracle | 1 Hyperion Financial Management | 2026-08-24 | 7.2 High |
| Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Financial Management. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-30864 | 1 Combodo | 1 Itop | 2026-08-24 | 8.9 High |
| Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3. | ||||
| CVE-2026-76836 | 1 Azuracast | 1 Azuracast | 2026-08-24 | 8.8 High |
| AzuraCast exposes the Liquidsoap custom configuration fields through an endpoint that does not require the permission guarding them. The backend_config property in backend/src/Entity/Station.php is annotated with GROUP_GENERAL, and PUT /api/station/{station_id}/profile/edit in backend/src/Controller/Api/Stations/ProfileEditController.php deserializes with that group while requiring only StationPermissions::Profile. AbstractArrayEntity::fromArray() then assigns every public property with no field-level permission check, so custom_config_top, custom_config, custom_config_pre_playlists, custom_config_pre_live, custom_config_pre_fade and custom_config_bottom are writable through it. ConfigWriter::writeCustomConfigurationSection() emits those values verbatim into the generated Liquidsoap .liq script, where the process.run() and process.exec() built-ins execute operating system commands when the backend restarts, which the built-in sync task triggers automatically once needs_restart is set. The dedicated endpoint for the same data, PUT /api/station/{id}/liquidsoap-config, requires StationPermissions::Broadcasting, so a station manager holding only the profile permission reaches configuration that the intended boundary reserves for broadcasting operators. | ||||
| CVE-2026-71939 | 1 Draytek | 14 Vigorswitch Fx2120 Firmware, Vigorswitch G1282 Firmware, Vigorswitch G2100 Firmware and 11 more | 2026-08-24 | 7.2 High |
| Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the acl_general_setup Add ACE function. The vulnerability is caused by copying the name field into a fixed-size buffer without length validation. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface. | ||||
| CVE-2026-71934 | 1 Draytek | 14 Vigorswitch Fx2120 Firmware, Vigorswitch G1282 Firmware, Vigorswitch G2100 Firmware and 11 more | 2026-08-24 | 7.2 High |
| Multiple DrayTek VigorSwitch models contain a buffer overflow vulnerability in the pingtrace function. The vulnerability is caused by missing length checks when the host, count, and interval fields are concatenated into a fixed-size buffer. A remote attacker can trigger this vulnerability via crafted input, causing a denial of service or potentially executing arbitrary commands. Exploitation requires valid administrative credentials for the device's web management interface. | ||||
| CVE-2026-71929 | 1 Draytek | 14 Vigorswitch Fx2120 Firmware, Vigorswitch G1282 Firmware, Vigorswitch G2100 Firmware and 11 more | 2026-08-24 | 7.2 High |
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the setDevProto function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface. | ||||
| CVE-2026-71924 | 1 Draytek | 14 Vigorswitch Fx2120 Firmware, Vigorswitch G1282 Firmware, Vigorswitch G2100 Firmware and 11 more | 2026-08-24 | 7.2 High |
| Multiple DrayTek VigorSwitch models contain a command injection vulnerability in the getVid function. The vulnerability is caused by insufficient filtering of the username and password fields before command execution. A remote attacker can trigger this vulnerability via crafted input to execute arbitrary commands with root privileges. Exploitation requires valid administrative credentials for the device's web management interface. | ||||