Export limit exceeded: 421567 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18135 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19058 | 1 Foundationagents | 1 Metagpt | 2026-08-07 | 5.3 Medium |
| A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2. The impacted element is the function DataInterpreter of the file metagpt/roles/di/data_interpreter.py. The manipulation results in code injection. The attack must be initiated from a local position. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-65880 | 1 Balbooa.com | 1 Balbooa Forms Component For Joomla | 2026-08-07 | N/A |
| Joomla Extension - balbooa.com - Unauthenticated remote code execution in Balbooa Forms < 2.4.3 - An insecure form processing logic allowed code execution for forms that include the signature field type. | ||||
| CVE-2026-9196 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-07 | 8.1 High |
| IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user approval, which may allow an attacker to trigger side effects such as outbound network access, file system interaction, or data exfiltration with the privileges of the Langflow backend process. | ||||
| CVE-2026-50629 | 1 Apache | 1 Cxf | 2026-08-07 | 5.3 Medium |
| The 'clientId' parameter from incoming HTTP requests is directly concatenated into OAuth2 server log warning messages without sanitizing control characters. This allows an attacker to inject arbitrary content, including fake log entries, into the server's log files. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fixes this issue. | ||||
| CVE-2026-55949 | 1 Microsoft | 18 365 Apps, Excel, Excel 2016 and 15 more | 2026-08-07 | 7.8 High |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-47303 | 4 Apple, Linux, Microsoft and 1 more | 9 Macos, Linux Kernel, .net and 6 more | 2026-08-07 | 8.8 High |
| Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-16881 | 1 Ly Corporation | 1 Line Client For Ios | 2026-08-07 | N/A |
| A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile. A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2. | ||||
| CVE-2026-55051 | 1 Microsoft | 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more | 2026-08-07 | 6.5 Medium |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-56190 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 9.8 Critical |
| Use of uninitialized resource in Windows RDP allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-46581 | 1 Eclipse | 2 Eclipse Mojarra, Mojarra | 2026-08-07 | 7.5 High |
| In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not properly sanitize and/or block remote URLs, allowing an attacker to specify a URL to a remote Facelet which will be included and processed as part of the normal request, with the privileges of the target server. This could allow access to restricted files such as `WEB-INF/web.xml` or `/etc/passwd`. | ||||
| CVE-2026-70615 | 1 Boringproxy | 1 Boringproxy | 2026-08-07 | 9.9 Critical |
| boringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a percent-encoded newline character in the domain parameter of the tunnel creation endpoint. Attackers can insert an unrestricted public key entry into authorized_keys to gain persistent shell access, and subsequently read cleartext credentials from the database file including all user tokens, tunnel private keys, and TLS certificates. | ||||
| CVE-2026-65553 | 2 Wbolt.com, Wordpress | 2 Spider Analyser – Wordpress搜索引擎蜘蛛分析插件, Wordpress | 2026-08-07 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in Spider Analyser – WordPress搜索引擎蜘蛛分析插件 <= 2.1.3 versions. | ||||
| CVE-2026-57982 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 6.5 Medium |
| Use of uninitialized resource in Windows RDP allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-58533 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 6.5 Medium |
| Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-58535 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 6.5 Medium |
| Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-58546 | 1 Microsoft | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-08-07 | 6.5 Medium |
| Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-70595 | 1 Ghost | 1 Ghost | 2026-08-07 | 4 Medium |
| Ghost is a Node.js content management system. From 6.26.0 until 6.54.1, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result in any response data being returned. This vulnerability is fixed in 6.54.1. | ||||
| CVE-2026-17617 | 1 Ibm | 2 Application Gateway, Application Gateway Operator | 2026-08-07 | 8.5 High |
| IBM Application Gateway Operator 22.2 through 26.06 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources. | ||||
| CVE-2026-65548 | 2 Muffingroup, Wordpress | 2 Betheme, Wordpress | 2026-08-06 | 9.9 Critical |
| Contributor Remote Code Execution (RCE) in Betheme <= 28.4.2 versions. | ||||
| CVE-2026-12605 | 1 Eclipse | 1 Glassfish | 2026-08-06 | 9.6 Critical |
| In Eclipse GlassFish versions 8.0.x before 8.0.4, CSRF + SSRF in DownloadServlet ContentSources leaks the admin `gfresttoken` to attacker-controlled host if the victim is authenticated into the Admin Console -\> full unauthenticated takeover of Eclipse GlassFish domain until the token expires. | ||||