Export limit exceeded: 400526 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400526 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86101 | 1 Watchguard | 1 Fireware Os | 2026-09-30 | N/A |
| An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request. | ||||
| CVE-2026-13224 | 1 Watchguard | 1 Fireware Os | 2026-09-30 | N/A |
| A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request. | ||||
| CVE-2026-18105 | 1 Watchguard | 1 Fireware Os | 2026-09-30 | N/A |
| An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI. | ||||
| CVE-2026-82877 | 2 Ilias, Ilias-elearning E.v. | 2 Ilias, Ilias | 2026-09-30 | 6.5 Medium |
| ILIAS before versions 9.22, 10.10, and 11.3 contains an arbitrary file read vulnerability in the SOAP addFile method that allows authenticated users to read server files by supplying crafted XML with COPY-mode imports. Attackers can construct absolute file paths through an unsandboxed import directory and retrieve sensitive files including configuration files containing database credentials and setup passwords. | ||||
| CVE-2026-80428 | 1 Ilias | 1 Ilias | 2026-09-30 | 9.8 Critical |
| ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user. | ||||
| CVE-2026-95274 | 1 Google | 1 Chrome | 2026-09-30 | 8.3 High |
| Improper output encoding in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95276 | 1 Google | 1 Chrome | 2026-09-30 | 8.3 High |
| Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code inside the sandbox via crafted network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-95277 | 1 Google | 1 Chrome | 2026-09-30 | 9.6 Critical |
| Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102306 | 1 Google | 1 Chrome | 2026-09-30 | 9.6 Critical |
| Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95280 | 1 Google | 1 Chrome | 2026-09-30 | 7.5 High |
| Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95286 | 1 Google | 1 Chrome | 2026-09-30 | 8.8 High |
| Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-102455 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 9.8 Critical |
| EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content. | ||||
| CVE-2026-102456 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 6.5 Medium |
| EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents. | ||||
| CVE-2026-102458 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 9.8 Critical |
| EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API. | ||||
| CVE-2026-102454 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 7.2 High |
| EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. | ||||
| CVE-2026-102457 | 1 Digiwin | 1 Easyflow .net | 2026-09-30 | 6.5 Medium |
| EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files. | ||||
| CVE-2026-95288 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-09-30 | 5.4 Medium |
| UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-95289 | 1 Google | 1 Chrome | 2026-09-30 | 4.3 Medium |
| Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-95282 | 1 Google | 1 Chrome | 2026-09-30 | 8.8 High |
| Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-95291 | 2 Apple, Google | 2 Iphone Os, Chrome | 2026-09-30 | 5.4 Medium |
| UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High) | ||||