Export limit exceeded: 16808 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (28283 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86308 | 1 Light0011 | 1 Cms | 2026-09-09 | 5.3 Medium |
| A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue affects some unknown processing of the file App/Common/Conf/config.php of the component Debug Mode. The manipulation of the argument DB_DEBUG results in information disclosure. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-86302 | 1 Code-projects | 1 Hospital Information System | 2026-09-09 | 5.3 Medium |
| A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of the file /HIS/his.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. Remote exploitation of the attack is possible. The exploit has been made public and could be used. | ||||
| CVE-2021-48007 | 1 Pmmp | 1 Pocketmine-mp | 2026-09-09 | 6.5 Medium |
| PocketMine-MP versions before 3.18.1 fail to validate NaN or INF values in MovePlayerPacket position and rotation fields. Malicious clients can send crafted movement packets with invalid floating-point values to crash servers through unhandled mathematical operations or prevent clients from rendering other players. | ||||
| CVE-2026-86768 | 1 Snipeitapp | 1 Snipe-it | 2026-09-09 | 5.4 Medium |
| Snipe-IT before 8.7.0 fails to validate soft-deleted state in API checkout endpoints, allowing authenticated users with checkout permissions to bind live inventory to trashed targets. Attackers can submit POST requests to hardware, component, or consumable checkout endpoints with soft-deleted user, asset, or location IDs to create orphaned references that corrupt the asset ledger and audit trails. | ||||
| CVE-2026-42151 | 1 Prometheus | 1 Prometheus | 2026-09-09 | 7.5 High |
| Prometheus is an open-source monitoring system and time series database. Prior to versions 3.5.3 and 3.11.3, the client_secret field in the Azure AD remote write OAuth configuration (storage/remote/azuread) was typed as string instead of Secret. Prometheus redacts fields of type Secret when serving the configuration via the /-/config HTTP API endpoint. Because the field was a plain string, the Azure OAuth client secret was exposed in plaintext to any user or process with access to that endpoint. This issue has been patched in versions 3.5.3 and 3.11.3. | ||||
| CVE-2026-40895 | 2 Follow-redirects, Follow-redirects Project | 2 Follow Redirects, Follow-redirects | 2026-09-09 | 7.5 High |
| follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.0. | ||||
| CVE-2026-69805 | 1 Microsoft | 3 Diagnostics Runtime, Visual Studio 2022, Visual Studio 2026 | 2026-09-09 | 7.5 High |
| External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-11738 | 1 Netgear | 55 Be9300, Be9300 Firmware, Mr60 and 52 more | 2026-09-09 | 4.4 Medium |
| Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality. | ||||
| CVE-2026-9214 | 1 Netgear | 2 R7000, R7000 Firmware | 2026-09-09 | 4.5 Medium |
| Insufficient input validation vulnerability in the NETGEAR R7000 models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality. | ||||
| CVE-2026-11737 | 1 Netgear | 26 Rax20, Rax20 Firmware, Rax41 and 23 more | 2026-09-09 | 4.5 Medium |
| Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality. | ||||
| CVE-2026-11736 | 1 Netgear | 38 Rax20, Rax20 Firmware, Rax35v2 and 35 more | 2026-09-09 | 4.9 Medium |
| A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality. | ||||
| CVE-2026-19300 | 5 Apple, Ibm, Langflow and 2 more | 5 Macos, Langflow Oss, Langflow and 2 more | 2026-09-08 | 7.5 High |
| IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields. | ||||
| CVE-2026-18887 | 1 Ibm | 1 I | 2026-09-08 | 6.5 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated attacker to obtain sensitive information in PASE. An attacker could exploit this vulnerability to access information about process they shouldn't be permitted to access. | ||||
| CVE-2026-67383 | 1 Microsoft | 3 Microsoft Sql Server 2025 (cu8), Microsoft Sql Server 2025 For X64-based Systems (gdr), Sql Server 2025 | 2026-09-08 | 6.5 Medium |
| Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2025-52651 | 1 Hcltech | 1 Myxalytics | 2026-09-08 | 3.5 Low |
| HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system behaviour or security issues. | ||||
| CVE-2026-16037 | 1 Paytr | 1 Paytr Virtual Pos Iframe Api (v9x) Whmcs Module | 2026-09-08 | 7.5 High |
| Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API (v9x) WHMCS Module allows Black Box Reverse Engineering. This issue affects PayTR Virtual Pos iFrame API (v9x) WHMCS Module: from v9.0.0 before v9.0.3. | ||||
| CVE-2026-65812 | 1 Microsoft | 1 Teams | 2026-09-08 | 6.8 Medium |
| Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. | ||||
| CVE-2025-34115 | 1 Op5 | 1 Monitor | 2026-09-08 | N/A |
| An authenticated command injection vulnerability exists in OP5 Monitor through version 7.1.9 via the 'cmd_str' parameter in the command_test.php endpoint. A user with access to the web interface can exploit the 'Test this command' feature to execute arbitrary shell commands as the unprivileged web application user. The vulnerability resides in the configuration section of the application and requires valid login credentials with access to the command testing functionality. This issue is fixed in version 7.2.0. | ||||
| CVE-2025-23173 | 2 Versa, Versa-networks | 2 Director, Versa Director | 2026-09-08 | 7.5 High |
| The Versa Director SD-WAN orchestration platform provides direct web-based access to uCPE virtual machines through the Director GUI. By default, the websockify service is exposed on port 6080 and accessible from the internet. This exposure introduces significant risk, as websockify has known weaknesses that can be exploited, potentially leading to remote code execution. Versa Networks is not aware of any reported instance where this vulnerability was exploited. Proof of concept for this vulnerability has been disclosed by third party security researchers. Workarounds or Mitigation: Restrict access to TCP port 6080 if uCPE console access is not necessary. Versa recommends that Director be upgraded to one of the remediated software versions. | ||||
| CVE-2026-86190 | 1 Wwbn | 1 Avideo | 2026-09-08 | 9.1 Critical |
| WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. Attackers can use the disclosed session identifier to hijack viewer sessions, including administrator accounts, and obtain sensitive personal data for all video viewers. | ||||