Export limit exceeded: 92759 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (92759 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12981 | 2 Cafehaus, Wordpress | 2 Cafehaus Api, Wordpress | 2026-08-02 | 7.5 High |
| The CAFEHAUS API WordPress plugin through 1.0.0 does not have any authentication or authorisation when updating user passwords, allowing unauthenticated attackers to set the password of any user, including administrators, and fully take over their accounts. | ||||
| CVE-2026-14603 | 2 Wordpress, Wowoptin | 2 Wordpress, Next-gen Popup Maker | 2026-08-02 | 7.5 High |
| The WowOptin: Next-Gen Popup Maker WordPress plugin before 1.4.38 does not have proper authorization on a REST endpoint, allowing unauthenticated users to disable all of the site's opt-in forms and insert new template-based opt-in rows into the database. | ||||
| CVE-2026-13690 | 2 Userswp, Wordpress | 2 Userswp, Wordpress | 2026-08-02 | 7.4 High |
| The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user. | ||||
| CVE-2026-14234 | 2 Wolf, Wordpress | 2 Wolf, Wordpress | 2026-08-02 | 7.1 High |
| The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting. | ||||
| CVE-2026-68500 | 1 Sylius | 1 Mollieplugin | 2026-08-02 | 7.5 High |
| Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /{_locale}/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the referenced Sylius order, allowing an unauthenticated attacker with any valid paid Mollie payment ID to mark a victim order as paid without transferring funds for that order. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1. | ||||
| CVE-2026-12562 | 1 Toptech Systems | 2 Multiload Ii+, Rcu Ii+ | 2026-08-02 | 8.8 High |
| The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework (TCF) service that does not require any authentication, allowing an attacker to directly interact with the Linux environment that powers the device. Once connected, an attacker can freely view and modify the filesystem, manipulate running processes, and control network interfaces, enabling deep alteration of system behavior. | ||||
| CVE-2026-18064 | 1 Nasa | 1 Core Flight System (cfs) Health & Safety (hs) Application | 2026-08-02 | 7.5 High |
| An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset. | ||||
| CVE-2026-63559 | 1 O6 Automation | 1 Open62541 | 2026-08-02 | 7.5 High |
| An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. | ||||
| CVE-2026-66420 | 1 Tugcantopaloglu | 1 Openclaw-dashboard | 2026-08-02 | 8.8 High |
| MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticated administrator sessions by exploiting an unconditional early return in the CheckWebServerOriginName() function within webserver.js when self-signed certificates are in use. Attackers can open cross-origin WebSocket connections to any of the twelve WebSocket endpoints, send crafted action commands to exfiltrate the server sessionKey used to sign session cookies, forge session tokens as arbitrary users, and gain full remote control of all managed devices governed by the MeshCentral instance. | ||||
| CVE-2026-63035 | 1 O6 Automation | 1 Open62541 | 2026-08-02 | 8.1 High |
| A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code. | ||||
| CVE-2026-65423 | 1 O6 Automation | 1 Open62541 | 2026-08-02 | 8.8 High |
| An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. | ||||
| CVE-2026-14538 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 7.7 High |
| An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections. | ||||
| CVE-2026-14539 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 7.5 High |
| An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error. | ||||
| CVE-2026-14541 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 7.5 High |
| An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token—even those minted for unrelated ecosystem applications—granting unauthorized clients access to protected tools and data backends. | ||||
| CVE-2026-65309 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 7.5 High |
| ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords. | ||||
| CVE-2026-65310 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 7.5 High |
| ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration. | ||||
| CVE-2026-65313 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 8.1 High |
| A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations. | ||||
| CVE-2026-15722 | 1 Redhat | 4 389 Directory Server, Directory Server, Enterprise Linux and 1 more | 2026-08-02 | 7.5 High |
| A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service. | ||||
| CVE-2026-11770 | 2 Port389, Redhat | 5 389-ds-base, 389 Directory Server, Directory Server and 2 more | 2026-08-02 | 7.5 High |
| A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information. | ||||
| CVE-2026-54737 | 1 Phun-ky | 1 Defaults-deep | 2026-08-02 | 7.3 High |
| @phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep() recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This issue is fixed in version 2.0.5. | ||||