Export limit exceeded: 412529 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 412529 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (106411 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78839 | 1 Appnitro | 1 Machform | 2026-09-27 | 8.1 High |
| An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar file. | ||||
| CVE-2026-85525 | 1 Snowflake | 4 Snowflake Connector For Python, Snowflake Go Driver, Snowflake Jdbc Driver and 1 more | 2026-09-27 | 7.4 High |
| Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), and Snowflake Node.js Driver v3.3.0. Users must manually upgrade. | ||||
| CVE-2026-101043 | 1 Pnpm | 1 Pnpm | 2026-09-27 | 7.4 High |
| pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository's pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic — and the corresponding DNS lookups — through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5. | ||||
| CVE-2026-69686 | 1 Microsoft | 18 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 15 more | 2026-09-27 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-79310 | 1 Webpy | 1 Webpy | 2026-09-27 | 8.5 High |
| webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to and later renders them through the precompiled template loader, the sandbox is bypassed and the attacker's code runs, resulting in arbitrary Python code execution and OS command execution on the server. | ||||
| CVE-2022-4997 | 1 Wordpress-extensions | 1 Jet Form Builder Stripe Gateway | 2026-09-27 | 8.6 High |
| The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes. | ||||
| CVE-2026-14321 | 1 Wordpress-extensions | 1 Divi Dash | 2026-09-27 | 8.2 High |
| The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service. | ||||
| CVE-2026-77422 | 1 Jline | 1 Jline | 2026-09-27 | 7.5 High |
| JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, the JLine built-in grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java accepts a user-controlled regular expression in grep(...) and, unless line-regexp mode is used, automatically adds a dot-star prefix and suffix before compiling it with Java's backtracking regular expression engine. The wrapping expands the backtracking search space, so a short nested-quantifier expression evaluated against non-matching input can consume excessive CPU and indefinitely block a command worker, including in remotely exposed shell sessions. This issue is fixed in versions 3.30.15 and 4.3.1. | ||||
| CVE-2026-93773 | 2 Wobbie, Wordpress-extensions | 2 Mollie Forms, Mollie Forms | 2026-09-27 | 8.5 High |
| Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. | ||||
| CVE-2026-95528 | 2 Magazine3, Wordpress-extensions | 2 Core Web Vitals & Pagespeed Booster, Core Web Vitals& Pagespeed Booster | 2026-09-27 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. | ||||
| CVE-2026-88362 | 1 Ghostscript | 1 Mujs | 2026-09-27 | 7.5 High |
| MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input containing an excessively large numeric array index can cause an out-of-range floating-point value to be converted to an integer without proper range validation. This results in undefined behavior and can cause process termination, leading to denial of service. | ||||
| CVE-2026-88368 | 1 Memononen | 1 Nanosvg | 2026-09-27 | 7.5 High |
| NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially crafted SVG document containing sufficiently large geometry coordinates can cause fixed-point-scaled edge coordinates to exceed the range representable by int. The rasterizer subsequently converts these values to int without range validation, resulting in undefined behavior and possible process termination, leading to denial of service. | ||||
| CVE-2026-88369 | 1 Zserge | 1 Jsmn | 2026-09-27 | 7.3 High |
| zserge jsmn commit 25647e6 is vulnerable to Buffer Overflow in example/jsondump.c dump(). | ||||
| CVE-2026-51995 | 1 Geelen | 1 Mcp-remote | 2026-09-27 | 7.5 High |
| An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-server-metadata.ts, src/lib/utils.ts components | ||||
| CVE-2026-51997 | 1 Geelen | 1 Mcp-remote | 2026-09-27 | 8.8 High |
| An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the open() functions | ||||
| CVE-2026-80513 | 1 Wordpress-extensions | 1 Wpforo Forum | 2026-09-27 | 7.5 High |
| The wpForo Forum WordPress plugin before 3.1.6 does not restrict which classes may be instantiated when it deserializes a user-supplied profile field value, allowing authenticated users with Subscriber-level access and above to inject a PHP Object. No POP chain is present in the wpForo Forum WordPress plugin before 3.1.6 itself; if one is present via another installed wpForo Forum WordPress plugin before 3.1.6 or , this could lead to remote code execution, arbitrary file operations, or SQL injection. This is an incomplete fix of CVE-2026-49769. | ||||
| CVE-2026-88843 | 1 Wordpress-extensions | 1 Masterstudy Lms | 2026-09-27 | 7.2 High |
| The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path was corrected in an earlier release and this one was not, so the issue persists in versions the earlier advisory reports as fixed. | ||||
| CVE-2026-93834 | 2 Qemu, Redhat | 8 Qemu, Enterprise Linux, Enterprise Linux For Nvidia 26 and 5 more | 2026-09-27 | 8.8 High |
| A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal restrictions and escaping the shared directory boundary. This can lead to arbitrary host file read/write and code execution (VM escape) as the QEMU process user. | ||||
| CVE-2026-91837 | 1 Gnome | 1 Networkmanager-iodine | 2026-09-27 | 7.8 High |
| A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability in how the 'nameserver' setting is processed when establishing an iodine VPN connection. By embedding shell metacharacters (special characters that can execute commands) in the 'nameserver' value, an attacker can inject and execute arbitrary commands. These commands run with root privileges before the application drops its elevated permissions, leading to local privilege escalation. | ||||
| CVE-2026-91838 | 1 Gnome | 1 Network Manager Sstp | 2026-09-27 | 7.8 High |
| A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by embedding special characters, known as shell metacharacters, into VPN connection profile fields such as CA certificate or proxy settings. These unescaped characters are then processed by the `pppd` daemon, which runs with root privileges, allowing the attacker to execute arbitrary commands with elevated permissions when a malicious VPN connection is activated. | ||||