Export limit exceeded: 395911 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (22880 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-0010 | 1 Google | 1 Android | 2026-09-08 | 8.4 High |
| In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2025-67038 | 1 Lantronix | 67 E213f102s, E213f102s Firmware, E214f002s and 64 more | 2026-09-08 | 9.8 Critical |
| An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. The username is directly concatenated with the command without any sanitization. This allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges. | ||||
| CVE-2026-86167 | 1 Tenda | 2 Hg10, Hg10 Firmware | 2026-09-08 | 9.9 Critical |
| A vulnerability was identified in Tenda HG10 300001138. Impacted is the function formgponConf of the file /boaform/admin/formgponConf of the component Boa. The manipulation of the argument fmgpon_loid leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. | ||||
| CVE-2026-86148 | 1 Tenda | 2 Cp3, Cp3 Firmware | 2026-09-08 | 9.1 Critical |
| A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to launch the attack remotely. | ||||
| CVE-2026-86095 | 1 Unidata | 1 Netcdf | 2026-09-08 | 7.8 High |
| Unidata netcdf-c through 4.10.1 contains an out-of-bounds write vulnerability in NC4_HDF5_inq_attname() that copies HDF5 attribute names into a fixed 256-byte buffer without length validation. Attackers can craft HDF5 files with oversized attribute names to overflow the destination buffer, causing memory corruption and crashes when applications enumerate attribute names. | ||||
| CVE-2026-80116 | 1 Passmark | 3 Burnintest, Osforensics, Performancetest | 2026-09-08 | 7.8 High |
| PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privilege escalation vulnerability in DirectIo64.sys that allows local users to modify hardware configuration by exploiting exposed IOCTLs with no validation on device selection, register offset, or value. Attackers can obtain a device handle and issue arbitrary PCI configuration space read/write operations to enable Bus Master DMA on any PCI device, halt storage controller I/O by clearing command registers, or remap Base Address Registers to redirect DMA to an attacker-chosen physical address. | ||||
| CVE-2026-86733 | 2 Grokability, Snipeitapp | 2 Snipe-it, Snipe-it | 2026-09-08 | 7.2 High |
| Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST /admin/backups/restore/{filename}) without the optional `clean` sanitizer parameter — which is not applied by default because DB_SANITIZE_BY_DEFAULT is false — can execute arbitrary OS commands as the web application's operating-system user, exposing application secrets (including database credentials and APP_KEY) and allowing modification of application-writable files and data. Version 8.7.0 adds the --binary-mode flag to the client invocation. | ||||
| CVE-2026-17207 | 1 Ibm | 1 I | 2026-09-08 | 6.5 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and compromise integrity due to a buffer overflow. | ||||
| CVE-2026-86510 | 1 D-link | 1 Dir-822a | 2026-09-08 | 9.9 Critical |
| A vulnerability has been found in D-Link DIR-822A A_101. Affected is the function tunnel_set_params of the component L2TP Control Message Parser. Such manipulation leads to out-of-bounds write. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-53932 | 1 Stefanzweifel | 1 Laravel-backup-restore | 2026-09-08 | 8 High |
| laravel-backup-restore restores database backups made with spatie/laravel-backup. Prior to version 1.9.4, a crafted backup archive can trigger OS command injection during database restore. This issue has been patched in version 1.9.4. | ||||
| CVE-2026-79423 | 1 Seacms | 1 Seacms | 2026-09-08 | 8.8 High |
| An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arbitrary code via a crafted POST request. | ||||
| CVE-2026-86313 | 1 Samsung Open Source | 1 Walrus | 2026-09-08 | 7.8 High |
| Out-of-bounds write vulnerability in Samsung Opensource Walrus allows Overflow Buffers. This issue affects Walrus: af80e665ea49d9003695a66502f841ed1d8397e7. | ||||
| CVE-2026-85050 | 1 Google | 2 Android, Chrome | 2026-09-08 | 9.6 Critical |
| Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-19204 | 1 Eclipse | 1 Jetty | 2026-09-08 | 7.5 High |
| A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated. | ||||
| CVE-2026-86315 | 1 Samsung Open Source | 1 Escargot | 2026-09-08 | 6.2 Medium |
| An out-of-bounds write caused by numeric truncation Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX. This issue affects Escargot: 5dc93606abd42b859045add05d704a038e197359. | ||||
| CVE-2026-84256 | 1 Openvpn | 1 Openvpn | 2026-09-08 | 8.8 High |
| An argument parsing issue in OpenVPN 2.1_rc10 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows remote authenticated users to execute arbitrary commands via a crafted certificate subject | ||||
| CVE-2026-81738 | 1 Openvpn | 1 Openvpn | 2026-09-08 | 4.2 Medium |
| OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-SEARCH entries | ||||
| CVE-2022-50999 | 1 Nokogiri | 1 Nokogiri | 2026-09-08 | 8.6 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-16233 | 1 Ni | 1 Labview | 2026-09-08 | 7.8 High |
| There is a memory corruption vulnerability recently discovered in NI LabVIEW that may result in information disclosure or arbitrary code execution. Successful exploitation requires an attacker to get a user to open a specially crafted VI. This vulnerability affects NI LabVIEW 2026 Q3 (26.3.0) and prior versions. | ||||
| CVE-2026-86540 | 1 Knowns-dev | 1 Knowns | 2026-09-08 | 7.8 High |
| knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to execute arbitrary binaries by crafting a malicious .knowns/config.json file. When a repository with a crafted configuration is opened, the unvalidated binary path is executed twice under the user's account without any verification. | ||||