Export limit exceeded: 386950 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386950 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-70352 | 1 Microsoft | 1 Azure Ai Language Authoring | 2026-09-05 | 10 Critical |
| Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70178 | 1 Microsoft | 1 Microsoft Fabric | 2026-09-05 | 8.5 High |
| Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-65818 | 1 Microsoft | 1 Power Platform | 2026-09-05 | 8.5 High |
| Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62916 | 1 Microsoft | 2 Entra Id, Microsoft Entra Id | 2026-09-05 | 9.1 Critical |
| Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-71624 | 1 Esotalk | 1 Esotalk | 2026-09-05 | N/A |
| An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controllers/ETMemberController.class.php, and core/lib/ET.class.php components | ||||
| CVE-2026-75438 | 1 Open5gs | 1 Open5gs | 2026-09-05 | N/A |
| Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function | ||||
| CVE-2026-9736 | 1 Ibm | 1 Netezza Software | 2026-09-05 | 5.3 Medium |
| IBM Netezza Software 11.3.0.3 through Interim Fix 002 could allow an unauthorized user to inject data into log messages due to improper neutralization of special elements when written to log files. | ||||
| CVE-2026-85444 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.5 High |
| MOOS-IvP through 24.8.1 contains a buffer over-read vulnerability in isQuoted(), isBraced(), and isChevroned() functions that strip whitespace but index using the original string length. Attackers can send NODE_REPORT messages with leading or trailing whitespace to read past buffer bounds and access adjacent memory. | ||||
| CVE-2026-85439 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.8 High |
| MOOS-IvP through 24.8.1 contains a remote code execution vulnerability in alogsplit's SplitHandler::handlePreCheckSplitDir() function that fails to sanitize shell metacharacters in log file pathnames. Attackers can embed shell syntax in log file names or the --dir parameter to execute arbitrary commands with the privileges of the operator running alogsplit. | ||||
| CVE-2026-85434 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 9.1 Critical |
| MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses. | ||||
| CVE-2026-85429 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-05 | 7.5 High |
| MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection source. Attackers can craft NODE_MESSAGE packets with spoofed source identities to impersonate other nodes and post arbitrary variable notifications without validation. | ||||
| CVE-2026-85424 | 1 Themoos | 1 Core-moos | 2026-09-05 | 9.8 Critical |
| MOOS core-moos through 10.4.0 lacks authentication in the wire protocol, allowing unauthenticated clients to connect with full publish, subscribe, and database clear privileges. Attackers can bypass the compile-time protocol string check and connect with arbitrary client names to execute privileged operations including DB_CLEAR which resets all variables and clears client mail queues. | ||||
| CVE-2026-85395 | 1 Webkul | 1 Unopim | 2026-09-05 | 7.1 High |
| UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint client credentials, and escalate permissions by exploiting missing authorization validation in the Bouncer middleware. | ||||
| CVE-2026-85225 | 1 Code-projects | 1 Doctor Appointment System | 2026-09-05 | 7.3 High |
| A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-85207 | 1 Itsourcecode | 1 Online Medicine Delivery System | 2026-09-05 | 3.5 Low |
| A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-63376 | 1 Binarymuse | 1 Toml-node | 2026-09-05 | 8.2 High |
| toml-node is a TOML parser for Node.js and the browser. Prior to 4.1.2, toml.parse() in lib/compiler.js can be tricked by a table path such as a.b.y.__proto__.__proto__, allowing traversal from a scalar value into Number.prototype and Object.prototype. The currentPath tracking value uses both arrays and strings, so valueAssignments records a comma-joined path such as a,b.y while deepRef checks the dot-joined path a.b.y, allowing the duplicate-key guard to miss and attacker-controlled keys to be written to Object.prototype. A table-array prefix-clearing path in addTableArray can also erase guard state before the same __proto__ traversal. Injected properties become visible throughout the Node.js process and can cause denial of service, logic or authorization bypass, or code execution when an application contains a suitable gadget. This issue is fixed in version 4.1.2. | ||||
| CVE-2026-52771 | 1 Yeswiki | 1 Yeswiki | 2026-09-05 | 8.3 High |
| YesWiki is a wiki system written in PHP. From version 4.2.0 to before version 4.6.6, ApiController::deletePage() interpolates a page tag retrieved from the database into a DELETE FROM …_links WHERE to_tag = '$tag' query without escaping. The page tag is attacker-controlled — the POST /api/pages/{tag} API accepts arbitrary URL-encoded values, including single quotes, and stores them. A low-privilege authenticated user can therefore create a page whose tag is a SQL fragment, make the page non-orphaned via the standard {{include page="…"}} link mechanism, and then invoke the delete endpoint to execute arbitrary SQL inside the wiki database - including time-based blind data exfiltration from any table. This issue has been patched in version 4.6.6. | ||||
| CVE-2026-52775 | 1 Yeswiki | 1 Yeswiki | 2026-09-05 | 8.8 High |
| YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki through the latest development branch contains a SQL injection vulnerability in ReactionManager::deleteUserReaction() that allows any authenticated user to inject arbitrary SQL via the {idreaction} and {id} URL path parameters. The parameters are concatenated directly into a SQL LIKE clause without escaping or parameterization. This issue has been patched in version 4.6.6. | ||||
| CVE-2026-77393 | 1 Inductiveautomation | 1 Ignition | 2026-09-05 | 8.8 High |
| In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create projects (if they can execute gateway scripts). Ignition 8.1.54 restricts project creation to Designer sessions and no longer relies on this setting. The 8.3 series is not affected. | ||||
| CVE-2026-86100 | 2 Owen2345, Tuzitio | 2 Camaleon Cms, Camaleon Cms | 2026-09-05 | 6.4 Medium |
| Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature. Authenticated attackers can supply URLs that pass initial validation but redirect to internal network addresses, allowing server-side request forgery to internal services. | ||||