Export limit exceeded: 397040 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (397040 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79317 | 1 Vaxilu | 1 X-ui | 2026-09-22 | 4.8 Medium |
| A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only checks that a user object can be retrieved from the cookie without re-validating against the database or any session version. When an administrator changes the username or password, previously issued session cookies are not revoked, so an attacker who holds a pre-change admin cookie can continue accessing and operating the management interface after the credentials have been rotated. | ||||
| CVE-2026-79315 | 1 Vaxilu | 1 X-ui | 2026-09-22 | 4.7 Medium |
| A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the entities before the client-side framework evaluates the content as a JavaScript expression. A logged-in panel user who visits a crafted URL allows arbitrary script execution in the same-origin context of the management page, enabling data theft and unauthorized actions through the victim's session. | ||||
| CVE-2026-88406 | 2026-09-22 | 7.5 High | ||
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_validations.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-79316 | 1 Vaxilu | 1 X-ui | 2026-09-22 | 7.6 High |
| An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template through the settings interface and trigger a panel restart, causing the xray management gRPC service, which is bound to loopback by default, to be regenerated and bound to non-loopback addresses. This expands the reachable surface of the management interface beyond its intended local-only boundary. | ||||
| CVE-2026-88593 | 2026-09-22 | 6.1 Medium | ||
| kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and the templates insert these values into raw JavaScript contexts. | ||||
| CVE-2026-88402 | 2026-09-22 | 9.8 Critical | ||
| A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via injecting crafted SQL statements. | ||||
| CVE-2026-79079 | 2026-09-22 | 7.8 High | ||
| An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c components | ||||
| CVE-2026-88409 | 2026-09-22 | 8.8 High | ||
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matrix.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-88408 | 2026-09-22 | 6.5 Medium | ||
| FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted input. | ||||
| CVE-2026-88746 | 2026-09-22 | 7.1 High | ||
| idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php. | ||||
| CVE-2026-88745 | 2026-09-22 | 6.1 Medium | ||
| EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. | ||||
| CVE-2026-88403 | 1 Nocobase | 1 Nocobase | 2026-09-22 | 6.5 Medium |
| A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resources via a crafted HTTP request. | ||||
| CVE-2026-79318 | 1 Web2py | 1 Web2py | 2026-09-22 | 6.5 Medium |
| web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py). | ||||
| CVE-2026-36470 | 2026-09-22 | 5.8 Medium | ||
| CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTML unmodified/unescaped during POST messages to index.php. | ||||
| CVE-2026-69768 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-22 | 9.8 Critical |
| Heap-based buffer overflow in Windows RNDIS allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2025-25040 | 1 Hpe | 14 Aruba Cx 9300 32d \(r8z96a\), Aruba Cx 9300 32d \(r9a29a\), Aruba Cx 9300 32d \(r9a30a\) and 11 more | 2026-09-22 | 3.3 Low |
| A vulnerability has been identified in the port ACL functionality of AOS-CX software running on the HPE Aruba Networking CX 9300 Switch Series only and affects: - AOS-CX 10.14.xxxx : All patches - AOS-CX 10.15.xxxx : 10.15.1000 and below The vulnerability is specific to traffic originated by the CX 9300 switch platform and could allow an attacker to bypass ACL rules applied to routed ports on egress. As a result, port ACLs are not correctly enforced, which could lead to unauthorized traffic flow and violations of security policies. Egress VLAN ACLs and Routed VLAN ACLs are not affected by this vulnerability. | ||||
| CVE-2026-93854 | 1 Openstack | 1 Blazar | 2026-09-22 | N/A |
| In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2/leases/{lease_id} and DELETE /v2/leases/{lease_id}). The policy authorize() wrapper attempts to load the target lease to build the authorization target from its owner, but it looks up the lease under the keyword "lease_id" whereas the controller methods name the parameter "id" (and the wsme_pecan.wsexpose wrapper delivers it positionally). The lookup returns None, and thus authorization falls back to the requesting user's own project_id/user_id instead of the target lease owner. Any authenticated user who knows a lease ID can therefore modify or delete leases belonging to other users and projects, bypassing the intended ownership check. | ||||
| CVE-2026-94055 | 1 Exim | 1 Exim | 2026-09-22 | 3.7 Low |
| Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. | ||||
| CVE-2026-94572 | 1 Openstack | 1 Octavia | 2026-09-22 | 7.4 High |
| In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control characters. The value is written verbatim into the HAProxy configuration generated on the amphora, and thus an authenticated project member who owns a TLS-enabled load balancer can embed a newline and inject arbitrary HAProxy configuration directives. Only deployments using the Amphora provider are affected. | ||||
| CVE-2026-95818 | 1 The Gnu C Library | 1 Glibc | 2026-09-22 | 3.6 Low |
| A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker to crash or corrupt the memory of setuid/setgid (AT_SECURE) programs. When such a program's DT_RPATH or DT_RUNPATH begins with $ORIGIN and is followed by NUL or '/' the loader both reads past the end of the path buffer and writes past the end of a stack-allocated internal buffer. The corrupted loader stack can lead to a loader crash (denial of service) and limited disclosure of process memory. | ||||