Export limit exceeded: 400204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400204 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-101043 | 1 Pnpm | 1 Pnpm | 2026-09-27 | 7.4 High |
| pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository's pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic — and the corresponding DNS lookups — through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5. | ||||
| CVE-2026-100876 | 1 Mathurvishal | 1 Cloudclassroom-php-project | 2026-09-27 | 6.3 Medium |
| A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file loginlinkstudent.php. Performing a manipulation of the argument umail results in missing authentication. Remote exploitation of the attack is possible. The exploit has been made public and could be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-96276 | 2 Flatpak, Redhat | 2 Flatpak, Enterprise Linux | 2026-09-27 | 6.5 Medium |
| If a malicious SDK container declares an extension point with a crafted `directory` path, and a developer runs `flatpak build-init --writable-sdk --sdk-extension` with that SDK, attacker-chosen files could be written outside the working directory, since the target path is resolved via a function that allows `..` traversal. | ||||
| CVE-2026-67629 | 1 Microsoft | 8 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2022 (gdr) and 5 more | 2026-09-27 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-78506 | 1 Microsoft | 18 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 15 more | 2026-09-27 | 5.5 Medium |
| Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-101058 | 1 Universal-tool-calling-protocol | 1 Python-utcp | 2026-09-27 | 6.9 Medium |
| python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own loopback interface when that manual is discovered from a remote, non-loopback origin. Because ensure_secure_url intentionally permits loopback HTTP for local development and native manuals bypassed the loopback check performed by the OpenAPI converter, an attacker who can serve a UTCP manual that a victim registers can cause the client to issue requests to services bound only to 127.0.0.1 on the victim host and have the response bodies returned to the caller (server-side request forgery). The http, sse and streamable_http protocols are all affected. Reach is limited to loopback, and exploitation further requires a loopback service that answers unauthenticated requests with useful data. Fixed in utcp-http 1.1.12, which rejects manuals fetched from a non-loopback origin that declare loopback tool URLs, keyed off the final post-redirect discovery URL. | ||||
| CVE-2026-52486 | 1 Opendds | 1 Opendds | 2026-09-27 | 6.6 Medium |
| An issue in OpenDDS 3.33.x allows a local attacker to cause a denial of service via the verify function in the SIgnedDocument module | ||||
| CVE-2026-67631 | 1 Microsoft | 12 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 9 more | 2026-09-27 | 9.8 Critical |
| Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-100873 | 1 Mathurvishal | 1 Cloudclassroom-php-project | 2026-09-27 | 4.3 Medium |
| A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-67633 | 1 Microsoft | 12 Microsoft Sql Server 2017 (cu 31), Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2019 (cu 32) and 9 more | 2026-09-27 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-69686 | 1 Microsoft | 18 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 15 more | 2026-09-27 | 8.8 High |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-80078 | 1 Microsoft | 15 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 12 more | 2026-09-27 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-100870 | 1 Sylius | 1 Sylius | 2026-09-27 | 8.8 High |
| Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header without validation, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can request password resets for known administrator email addresses with forged Host headers to intercept valid reset tokens and take over administrator accounts. | ||||
| CVE-2025-63564 | 1 Moodle | 1 Socialwall Plugin | 2026-09-27 | 9.8 Critical |
| SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP requests | ||||
| CVE-2026-79310 | 1 Webpy | 1 Webpy | 2026-09-27 | 8.5 High |
| webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-controlled template code that built-in security checks are designed to reject. When an application precompiles templates from a directory the attacker can write to and later renders them through the precompiled template loader, the sandbox is bypassed and the attacker's code runs, resulting in arbitrary Python code execution and OS command execution on the server. | ||||
| CVE-2026-86785 | 1 Wordpress-extensions | 1 Social Commerce For Woocommerce | 2026-09-27 | 5.3 Medium |
| The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticated users to update Social Commerce for WooCommerce WordPress plugin through 2.5.4 configuration and product synchronisation state. | ||||
| CVE-2022-4997 | 1 Wordpress-extensions | 1 Jet Form Builder Stripe Gateway | 2026-09-27 | 8.6 High |
| The jet-form-builder-stripe-gateway WordPress plugin before 1.1.0 does not sanitise and escape a payment token before using it in a SQL statement, allowing unauthenticated users to extract arbitrary data from the database, including password hashes. | ||||
| CVE-2025-15696 | 1 Wordpress-extensions | 1 Real3d Flipbook Lite | 2026-09-27 | 6.8 Medium |
| The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators. | ||||
| CVE-2026-14321 | 1 Wordpress-extensions | 1 Divi Dash | 2026-09-27 | 8.2 High |
| The divi-dash WordPress plugin before 1.0.7 does not validate the source of the client IP address it uses for rate limiting and banning, allowing unauthenticated attackers to spoof arbitrary IP addresses in order to bypass rate limiting, ban chosen addresses from the feature, and grow a stored option without bound, resulting in denial of service. | ||||
| CVE-2026-16264 | 1 Wordpress-extensions | 1 Newsletters | 2026-09-27 | 6.5 Medium |
| The Newsletters WordPress plugin before 4.18.1 does not perform an ownership check on some of its subscriber management actions, and issues a management session to unauthenticated visitors on request, allowing attackers to read any subscriber's personal data and overwrite any subscriber's record including their email address. | ||||