Export limit exceeded: 92759 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (92759 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-43672 | 1 Apple | 1 Macos | 2026-08-04 | 7.1 High |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious application may be able to bypass Privacy preferences. | ||||
| CVE-2026-43777 | 1 Apple | 1 Macos | 2026-08-04 | 7.5 High |
| This issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A remote attacker may be able to cause a denial of service. | ||||
| CVE-2026-64737 | 1 Apple | 1 Macos | 2026-08-04 | 8.2 High |
| An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox. | ||||
| CVE-2026-47483 | 1 Nvidia | 2 Dcgm, Dcgm Exporter | 2026-08-04 | 8.2 High |
| NVIDIA DCGM Exporter for all platforms contains a vulnerability in the /debug/pprof endpoints, where an attacker could cause uncontrolled resource consumption by submitting concurrent unauthenticated profiling requests. A successful exploit of this vulnerability might lead to denial of service and information disclosure. | ||||
| CVE-2025-67405 | 1 Sourcecodester | 1 Casap Automated Enrollment System | 2026-08-04 | 7.3 High |
| Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL Injection in update_password.php via the parameter new_password. | ||||
| CVE-2025-67406 | 1 Mayurik | 1 Advocate Office Management System | 2026-08-04 | 7.3 High |
| https://www.sourcecodester.com Advocate office management system 1.0 is affected by: SQL Injection. The impact is: execute arbitrary code (remote). The component is: control/activate_case.php,?id=1. The attack vector is: A SQL Injection vulnerability exists in the activate_case.php in parameter id endpoint of Advocate office management system. Unsanitized user input in the specified parameter is interpolated directly into an SQL query, allowing attackers to infer or extract data and, in some cases, execute stacked/time-based payloads. ¶¶ Affected Component & Parameter Affected Endpoint URL: http://localhost/advocate/kortex_lite/control/activate_case.php?id=1 HTTP Method: GET Vulnerable File: activate_case.php Parameter: id Vector Location: GET Injection Techniques (as identified by sqlmap) Type: error-based Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE) Payload: id=1 AND EXTRACTVALUE(6268,CONCAT(0x5c,0x71766b6a71,(SELECT (ELT(6268=6268,1))),0x716a7a6b71)) Type: time-based blind Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 4464 FROM (SELECT(SLEEP(5)))aHqo) Proof of Concept (Burp Repeater) | ||||
| CVE-2025-69949 | 1 Campcodes | 1 Hospital Management System | 2026-08-04 | 7.3 High |
| kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the parameters emailid and email. | ||||
| CVE-2023-6123 | 1 Opentext | 1 Alm Octane | 2026-08-04 | 7.5 High |
| Improper Neutralization vulnerability affects OpenText ALM Octane version 16.2.100 and above. The vulnerability could result in a remote code execution attack. | ||||
| CVE-2026-58043 | 2 Nodejs, Redhat | 2 Nodejs, Hummingbird | 2026-08-04 | 7.5 High |
| A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. | ||||
| CVE-2026-22620 | 1 Eaton | 1 Padm | 2026-08-04 | 8.6 High |
| Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote attacker to bypass authentication and gain a privileged user access to the device. | ||||
| CVE-2026-22621 | 1 Eaton | 1 Padm | 2026-08-04 | 8.3 High |
| Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated administrator to execute arbitrary commands within a restricted environment. | ||||
| CVE-2026-56428 | 1 Bosch | 1 Bsh Elp (electronic Platform) Modules | 2026-08-04 | 8.1 High |
| The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default configuration. An insecure, non-revocable SSH public key is included in the firmware's authorized_keys file for the root user. An attacker in possession of the corresponding private key could leverage it to bypass authentication and gain root-level access to the appliance. | ||||
| CVE-2026-15978 | 2 Lmsys, Sglang | 2 Sglang, Sglang | 2026-08-04 | 7.5 High |
| SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a remote attacker to trigger distributed weight broadcasting using NCCL and then triggering data transfer, attackers can exfiltrate all model weights. | ||||
| CVE-2026-13325 | 1 Redhat | 1 Openshift Virtualization | 2026-08-04 | 8.5 High |
| Red Hat Product Security has come to the conclusion that this CVE is not needed. | ||||
| CVE-2026-15258 | 2026-08-04 | 8.1 High | ||
| The Product Feed Manager For WooCommerce WordPress plugin before 7.6.1 does not properly sanitise and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks. | ||||
| CVE-2026-16843 | 1 Hikvision | 6 Ds-3wap521-si, Ds-3wap522-si, Ds-3wap621e-si and 3 more | 2026-08-04 | 7.2 High |
| Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can exploit this flaw by sending crafted packets containing malicious commands to affected devices, leading to arbitrary command execution. | ||||
| CVE-2026-67312 | 1 Axios | 1 Axios | 2026-08-04 | 7.5 High |
| axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json). When an application passes attacker-controlled FormData field names, a field name with thousands of nested bracket-delimited segments causes unbounded recursion in buildPath(), exhausting the JavaScript call stack (RangeError: Maximum call stack size exceeded) and causing denial of service for that request, or process termination in applications without appropriate error handling. | ||||
| CVE-2026-20465 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-08-04 | 8.1 High |
| In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00489200; Issue ID: MSV-7834. | ||||
| CVE-2026-20479 | 1 Mediatek, Inc. | 1 Mediatek Chipset | 2026-08-04 | 7.5 High |
| In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00741071; Issue ID: MSV-7620. | ||||
| CVE-2026-18605 | 1 Checkmal | 1 Appcheck Pro | 2026-08-04 | 7 High |
| A security flaw has been discovered in CheckMAL AppCheck Pro 3.1.43.10. Affected is an unknown function in the library AppCheckD.sys of the component Kernel Mini-Filter Driver. Performing a manipulation results in uncontrolled search path. The attack requires a local approach. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||