Export limit exceeded: 396389 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396389 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87266 | 1 Oracle | 2 Agile Plm, Agile Product Lifecycle Management | 2026-09-22 | 8.2 High |
| Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Agile PLM. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L). | ||||
| CVE-2026-14504 | 1 Sonatype | 1 Nexus Repository Manager | 2026-09-22 | 6.5 Medium |
| An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted repository to upload arbitrary artifacts, bypassing the intended write-permission check. | ||||
| CVE-2026-77122 | 1 Sonatype | 2 Nexus Repository Manager, Nexus Repository Manager 3 | 2026-09-22 | 4.3 Medium |
| An authorization flaw in the REST API repository details endpoint (GET /service/rest/v1/repositories/{repositoryName}) in Sonatype Nexus Repository 3 allowed an account holding read or browse permission on a group repository to retrieve metadata for member repositories on which it held no direct permission, by requesting the endpoint directly for the member repository name. For proxy repositories, the disclosed metadata includes the configured remote URL, which may reveal internal upstream hostnames. This includes the anonymous user if it has been granted this permission; whether the anonymous user holds this permission depends on the role and permission configuration of the specific installation. | ||||
| CVE-2026-77123 | 1 Sonatype | 1 Nexus Repository Manager | 2026-09-22 | 6.5 Medium |
| Nexus Repository 3 contains a sensitive information disclosure vulnerability in the capability read API. An account holding the nexus:capabilities:read privilege can retrieve the plaintext shared secret configured on a webhook capability, which is intended to be masked from all API responses. This issue affects Nexus Repository 3 versions 3.2.0 through 3.95.x, and is fixed in version 3.96.0. | ||||
| CVE-2026-69684 | 1 Microsoft | 25 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 22 more | 2026-09-22 | 5.5 Medium |
| Generation of error message containing sensitive information in Windows Error Reporting allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-77124 | 1 Sonatype | 2 Nexus Repository Manager, Nexus Repository Manager 3 | 2026-09-22 | 7.2 High |
| In affected versions of Nexus Repository 3, the script execution endpoint (POST /service/rest/v1/script/{name}/run) did not verify whether script execution had been administratively disabled. An account holding script-execution permission could continue to run previously-created scripts even after an administrator set nexus.scripts.allowCreation=false, undermining the expectation that this setting fully blocks script execution. | ||||
| CVE-2026-69730 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-09-22 | 9.8 Critical |
| Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-77125 | 1 Sonatype | 1 Nexus Repository Manager | 2026-09-22 | 7.1 High |
| A vulnerability was identified in Sonatype Nexus Repository 3 in which two blobstore group management REST API endpoints did not correctly enforce the intended authorization check. A user granted only the nexus:blobstores:create permission could invoke these endpoints to convert an existing blobstore into a group blobstore, an action that should require the nexus:blobstores:update permission instead. This could result in unauthorized modification of blobstore configuration without administrator approval. The nexus:blobstores:create permission is a named permission that must be explicitly granted by an administrator; it is not held by default. | ||||
| CVE-2026-7494 | 1 Sonatype | 1 Nexus Repository Manager | 2026-09-22 | 5.0 Medium |
| Nexus Repository 3 is vulnerable to Server-Side Request Forgery (SSRF) via the SSL Certificate Retrieval endpoint. A user holding the nexus:ssl-truststore:read permission could cause the server to initiate outbound connections to internal or otherwise restricted network hosts. This issue affects Nexus Repository 3.0.0 through versions prior to 3.94.0. | ||||
| CVE-2026-94054 | 1 Exim | 1 Exim | 2026-09-22 | 7 High |
| Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, has an out-of-bounds write. | ||||
| CVE-2026-94001 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-09-22 | 6.5 Medium |
| A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in. | ||||
| CVE-2026-93967 | 1 Aiyiyi121 | 1 Sxdevops | 2026-09-22 | 5.5 Medium |
| A vulnerability was found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this issue is the function generate_host_task of the file backend/aiops/services.py of the component Command Handler. Performing a manipulation of the argument command results in command injection. Remote exploitation of the attack is possible. The patch is named 2b4bf8585c3e731e7a8af30801ea46680bc783f9. Applying a patch is the recommended action to fix this issue. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | ||||
| CVE-2026-93962 | 1 Kamailio | 1 Kamailio | 2026-09-22 | 8.3 High |
| A weakness has been identified in Kamailio up to 5.8.8/6.0.7/6.1.4/6.2.0-dev1. The impacted element is the function shm_malloc of the file src/modules/cdp/receiver.c of the component CDP Diameter Receiver. Executing a manipulation can lead to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 6.0.8 is sufficient to resolve this issue. This patch is called 38711a3e788de0130d48cb485578c482b57d9351/4f62235b6f477b649c5cc18b0c81b4e26c949b98/4f62235b6f477b649c5cc18b0c81b4e26c949b98. You should upgrade the affected component. | ||||
| CVE-2026-93957 | 1 Olivier-ls | 1 Php-fts | 2026-09-22 | 4.3 Medium |
| A vulnerability has been found in olivier-ls PHP-FTS up to 1.1.3. This affects the function SearchEngine::matchesSingleFilter of the file src/SearchEngine.php of the component Filter Matching. The manipulation leads to incorrect comparison. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 1.1.4 is able to mitigate this issue. The identifier of the patch is 0b2fae333d6b022da7ed4c43e2d41aa03f91dff3. It is suggested to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | ||||
| CVE-2026-93562 | 2 Io.netty, Redhat | 21 Netty-codec-http, Amq Broker, Amq Clients and 18 more | 2026-09-22 | 6.5 Medium |
| A flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources. | ||||
| CVE-2026-92768 | 1 Redhat | 1 Enterprise Linux | 2026-09-22 | 5.5 Medium |
| A flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access. | ||||
| CVE-2026-92385 | 1 Sourcecodester | 1 Online Food Ordering System | 2026-09-22 | 2.4 Low |
| A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/update_category.php of the component Category Update. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-92079 | 1 Mozilla | 1 Firefox | 2026-09-22 | 9.1 Critical |
| Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92076 | 1 Mozilla | 1 Firefox | 2026-09-22 | 8.8 High |
| Incorrect boundary conditions in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||
| CVE-2026-92075 | 1 Mozilla | 1 Firefox | 2026-09-22 | 9.1 Critical |
| Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 153.3. | ||||