Export limit exceeded: 424747 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (4533 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82531 | 2 Newmediacompany, Smarty-php | 2 Smarty, Smarty | 2026-10-07 | 8.1 High |
| Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can supply assigned data containing a forged SmartyNocache marker that is copied verbatim into the regenerated PHP cache file, executing arbitrary PHP on include for remote code execution. | ||||
| CVE-2026-106037 | 1 Kvcache-ai | 1 Mooncake | 2026-10-07 | 9.8 Critical |
| Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without authentication on any route. Unauthenticated attackers can call routes such as /api/get, /api/put, /api/remove_all and /api/mount to read cached KV data with user prompts, inject or delete objects, and mount attacker-described segments. | ||||
| CVE-2026-105207 | 1 Zitadel | 1 Zitadel | 2026-10-06 | 9.8 Critical |
| ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.17.3 creates links between user accounts and external identity providers without verifying a primary factor or the caller's permission, including on identify-only Login V2 sessions and via the User Service V2 AddIDPLink endpoint. An unauthenticated attacker knowing a victim's login name can bind their own external IdP identity to the victim's account and then sign in as the victim. | ||||
| CVE-2026-105135 | 1 Internlm | 1 Mindsearch | 2026-10-06 | 10 Critical |
| A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-105089 | 1 Wwbn | 1 Avideo | 2026-10-06 | 8.7 High |
| WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by setting a malicious video trailer1 URL. The value is rendered unescaped in YouPHPFlix2 templates and channel playlists, letting attackers break out of onclick strings or iframe src attributes to execute JavaScript in victims' browsers. | ||||
| CVE-2026-75937 | 1 Digi International | 12 Anywhereusb Plus Family, Connect Ez Family, Connect It Family and 9 more | 2026-10-06 | N/A |
| A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device. | ||||
| CVE-2026-105221 | 1 Defunkt | 1 Gist | 2026-10-06 | 7.4 High |
| The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS traffic because http_connection in lib/gist.rb sets VERIFY_NONE. Attackers can present any certificate to read or modify GitHub API traffic, stealing OAuth tokens and login credentials to read and modify the victim's gists. | ||||
| CVE-2026-105293 | 1 Legcord | 1 Legcord | 2026-10-06 | 8.1 High |
| Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory. | ||||
| CVE-2026-105294 | 1 Legcord | 1 Legcord | 2026-10-06 | 7.4 High |
| Legcord 1.1.0 through 1.3.0 contains a configuration injection vulnerability that allows script in the Discord page to write any config key via the window.legcord settings.setConfig bridge. Attackers exploiting a Discord XSS can set additionalArguments to persistently add --proxy-server and --ignore-certificate-errors switches, routing all client traffic through an interception proxy. | ||||
| CVE-2026-100103 | 1 Perforce | 1 Helix Core | 2026-10-06 | N/A |
| Perforce P4 Search container images prior to 2026.4.2 reset the service authentication token to a publicly documented default value. An unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to arbitrary code execution and compromise of the connected P4 Server. | ||||
| CVE-2026-94293 | 1 Murrelektronik | 2 Aas Edge Client, Software Aas Edge Client All Versions | 2026-10-06 | 9.8 Critical |
| An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints. | ||||
| CVE-2026-100102 | 1 Perforce | 1 Helix Core | 2026-10-06 | N/A |
| Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server. | ||||
| CVE-2026-103510 | 1 Perforce | 1 Helix Core | 2026-10-06 | N/A |
| P4 Search prior to 2026.4.2 does not fail securely when its service authentication token is blank. In affected configurations, an unauthenticated attacker with network access can obtain the highest application privilege, potentially leading to compromise of P4 Search and the connected P4 Server. | ||||
| CVE-2026-86131 | 1 Watchguard | 2 Fireware, Fireware Os | 2026-10-06 | 9.8 Critical |
| A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebox. | ||||
| CVE-2026-105778 | 1 Tenda | 2 Ac5, Ac5 Firmware | 2026-10-06 | 9.9 Critical |
| A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-76570 | 2 Joomcode, Joomcoder.com | 2 Jc Tables, Jctables Extension For Joomla | 2026-10-06 | 9.1 Critical |
| Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries. | ||||
| CVE-2026-105080 | 1 C4illin | 1 Convertx | 2026-10-06 | 9.9 Critical |
| In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file. | ||||
| CVE-2026-104849 | 1 Tinylibs | 1 Tinypool | 2026-10-06 | 8.1 High |
| Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.2, Tinypool reads filename from a caller-supplied options object in pool.run(task, options) without requiring an own property, so a polluted Object.prototype.filename can replace the intended worker module. Applications are affected only when they pass their own second-argument options object to pool.run(); calls without that argument use the trusted default options object. An attacker who can first pollute the prototype can cause the worker pool to load attacker-selected JavaScript and can read or modify task data with the host process's privileges. This issue is fixed in version 2.1.2. | ||||
| CVE-2026-102425 | 2 Balbooa, Balbooa.com | 2 Forms, Balbooa.com Balbooa Forms Extension For Joomla | 2026-10-06 | 10.0 Critical |
| Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature also supports form-field shortcodes inside that PHP. Before calling `eval()`, the component replaces each shortcode with the raw value submitted by the visitor, leading to an RCE vector. A public form must use the product's optional PHP-after-submission action and interpolate an attacker-controlled field shortcode inside a double-quoted PHP string to be vulnerable. | ||||
| CVE-2026-91107 | 1 Os4ed | 1 Opensis-classic | 2026-10-06 | N/A |
| openSIS Classic 9.3 allows an authenticated user with the built-in teacher role can select an arbitrary staff record through staff_id and cause the School Information update path to reset that selected account's password. | ||||