Export limit exceeded: 27805 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (27805 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56584 | 1 Hcltech | 1 Intelliops Event Management | 2026-07-27 | 3.7 Low |
| HCL IEM was affected with the Information disclosure nginx server. It may enable attackers to identify outdated software versions and target known vulnerabilities or publicly available exploits. | ||||
| CVE-2026-15432 | 1 Google | 2 Tink Android, Tink Java | 2026-07-27 | N/A |
| When verifying a mac with a ChunkedMacVerification object, Tink compares the resulting tag with non constant time comparison. This potentially allows an attacker to use timinig information as a side channel in order to get information how many bytes of a given tag match the correct tag. This in turn could allow to find a correct tag bytewise. | ||||
| CVE-2026-12547 | 2 Libsoup, Redhat | 2 Libsoup, Enterprise Linux | 2026-07-27 | 3.4 Low |
| SoupAuthManager caches proxy authentication credentials without scoping them to the proxy authority (host:port). When the proxy configuration changes (e.g., via system settings or WPAD), cached Proxy-Authorization headers from the previous proxy are sent to the new proxy, leaking credentials. | ||||
| CVE-2026-47247 | 1 Struktur | 1 Libheif | 2026-07-27 | 7.5 High |
| libheif is a HEIF and AVIF file format decoder and encoder. Prior to version 1.22.0, two bugs in libheif chain to leak process heap memory as visible pixel values in decoded grid images. An attacker who uploads a crafted AVIF/HEIC file to any server-side image processor (WordPress, Sharp/libvips, ImageMagick, etc.) can recover heap data - including library function pointers sufficient to defeat ASLR, or any other secret - from the publicly-downloadable transcoded JPEG/PNG/WebP output. Local attack vectors are also possible. Version 1.22.0 fixes the issue. | ||||
| CVE-2026-16551 | 1 Thinkst Applied Research | 1 Opencanary | 2026-07-27 | N/A |
| Denial-of-Service in Thinkst Applied Research OpenCanary (MongoDB module) allows Excessive Allocation. This issue affects OpenCanary 0.9.8 only. | ||||
| CVE-2025-59177 | 1 Ericsson | 1 Packet Core Controller | 2026-07-27 | N/A |
| Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages. | ||||
| CVE-2025-68686 | 1 Fortinet | 1 Fortios | 2026-07-27 | 5.3 Medium |
| An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level. | ||||
| CVE-2026-14820 | 2 Quizandsurveymaster, Wordpress | 2 Quiz And Survey Master, Wordpress | 2026-07-27 | 5.3 Medium |
| The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and returns distinct responses for valid and invalid accounts, allowing unauthenticated attackers to enumerate valid usernames and to brute-force passwords while bypassing brute-force protection Quiz and Survey Master (QSM) WordPress plugin before 11.1.3. | ||||
| CVE-2026-16373 | 1 Mozilla | 2 Firefox, Firefox Mobile | 2026-07-27 | 7.5 High |
| Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16398 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-27 | 7.5 High |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16400 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-27 | 7.5 High |
| Information disclosure in the DOM: Security component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-65434 | 2 Wordpress, Yoomoney | 2 Wordpress, Юkassa Для Woocommerce | 2026-07-27 | 6.5 Medium |
| Subscriber Sensitive Data Exposure in ЮKassa для WooCommerce <= 2.16.1 versions. | ||||
| CVE-2026-61503 | 1 Rejetto | 1 Hfs | 2026-07-27 | 5.3 Medium |
| Rejetto HFS 3.0.0 through 3.2.0 returns observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account, facilitating password-guessing and session-forgery attacks. | ||||
| CVE-2026-44753 | 1 Sap Se | 1 Sap Hana Extended Application Services Classic Model (user Self Service) | 2026-07-27 | 3.7 Low |
| SAP HANA Database (user self service tools) allows an unauthenticated user to send specially crafted requests that produce distinguishable responses, enabling enumeration of valid user accounts and email addresses. Successful exploitation could allow the attacker to enumerate valid user accounts, resulting in low impact on confidentiality, with no impact on integrity and availability of the application. | ||||
| CVE-2026-13699 | 1 Eclipse | 2 Kuksa, Kuksa - Databroker | 2026-07-27 | 4.3 Medium |
| In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server directly calls unwrap() on request.data_point, triggering a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token. Unauthenticated or invalid-token requests are rejected and do not reach the vulnerable path. The panic causes the individual gRPC call to be cancelled but does not terminate the Databroker process, which remains available for subsequent requests. | ||||
| CVE-2026-15747 | 1 Sri | 1 Mojolicious | 2026-07-27 | 9.1 Critical |
| Mojolicious versions from 4.59 before 9.48 for Perl expose a stable representation of the session CSRF token to a BREACH compression oracle. _csrf_token generates and caches one token per session and returns the same value on every call, and _csrf_field places that value in a hidden `csrf_token` input. When a response carrying the token also echoes attacker-controlled input and is gzip-compressed, the chosen values and the resulting compressed lengths form a BREACH oracle. An attacker able to query it can recover the token and pass csrf_protect validation. | ||||
| CVE-2026-65430 | 1 Regularlabs.com | 1 Geoip Extension For Joomla | 2026-07-27 | 7.5 High |
| Joomla Extension - regularlabs.com - MaxMind Credential leakage in GeoIP extension - MaxMind credentials where leaked in request URLs, causing a credential leakage vulnerability. | ||||
| CVE-2026-64874 | 1 Regularlabs.com | 1 Cache Cleaner Pro Extension For Joomla | 2026-07-27 | 9.8 Critical |
| Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs. | ||||
| CVE-2026-17457 | 1 Mf-yang | 1 Openclaw-cn | 2026-07-27 | 4.3 Medium |
| A vulnerability has been found in mf-yang openclaw-cn up to 0.2.1. Affected by this issue is the function assertBrowserNavigationAllowed of the file src/browser/navigation-guard.ts of the component Scheme Handler. Such manipulation of the argument url leads to information disclosure. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-48334 | 2 Adobe, Microsoft | 4 Illustrator, Illustrator Desktop 2025, Illustrator Desktop 2026 and 1 more | 2026-07-27 | 9.3 Critical |
| Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||