Export limit exceeded: 396909 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (396909 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81995 | 1 Adobe | 2 Aem 6.5 Forms Jee, Aem 6.5 Lts Forms Jee | 2026-09-23 | 9.1 Critical |
| Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-76980 | 1 Zohocorp | 2 Manageengine Firewall Analyzer, Manageengine Opmanager | 2026-09-23 | 7.4 High |
| ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Data Exposure vulnerability in the Firewall Analyzer syslog collector. | ||||
| CVE-2026-76711 | 1 Hewlett Packard Enterprise (hpe) | 1 Ale | 2026-09-23 | 7.5 High |
| A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket connections. An unauthenticated remote attacker could exploit this vulnerability by providing specially crafted input during the connection process. Successful exploitation could result in unauthorized data injection. | ||||
| CVE-2026-76710 | 1 Hewlett Packard Enterprise (hpe) | 1 Ale | 2026-09-23 | 7.5 High |
| A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive information. An unauthenticated remote attacker could exploit this vulnerability by sending specially crafted requests to certain internal endpoints. Successful exploitation could result in the disclosure of sensitive site hierarchy, infrastructure details, and client device information. | ||||
| CVE-2026-76708 | 1 Hewlett Packard Enterprise (hpe) | 1 Ale | 2026-09-23 | 9.8 Critical |
| A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise. | ||||
| CVE-2026-75682 | 1 Adobe | 2 Adobe Connect, Adobe Connect Android Mobile App | 2026-09-23 | 9.9 Critical |
| Adobe Connect is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-75665 | 1 Adobe | 1 Adobe Bridge | 2026-09-23 | 7.8 High |
| Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-75658 | 1 Adobe | 1 Adobe Bridge | 2026-09-23 | 7.8 High |
| Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-75649 | 1 Adobe | 1 Bridge | 2026-09-23 | 7.8 High |
| Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-65829 | 1 Joniles | 1 Mpxj | 2026-09-23 | 5.3 Medium |
| MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 7.3.0 until 16.5.0, reading a suitably crafted Primavera P3 PRX or SureTrak STX file can cause MPXJ to write files to arbitrary locations in the filesystem. This issue is fixed in version 16.5.0. | ||||
| CVE-2026-58268 | 1 Emiago | 1 Sipgo | 2026-09-23 | 7.5 High |
| SIPGO is a library for writing SIP services in the GO language. Prior to 1.4.1, ParserStream.parseSingle in sip/parser_stream.go allocates a SIP body buffer from the client-controlled Content-Length header before ParseMaxMessageLength is enforced. An unauthenticated peer can send a stream-transport message over TCP, TLS, WS, or WSS with an oversized declared length, causing excessive memory allocation and denial of service before the body is read. This issue is fixed in version 1.4.1. | ||||
| CVE-2026-14913 | 1 Zohocorp | 2 Manageengine Firewall Analyzer, Manageengine Opmanager | 2026-09-23 | 8.8 High |
| ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule Management Search Reports. | ||||
| CVE-2026-12370 | 1 Zohocorp | 3 Manageengine Netflow Analyzer, Manageengine Network Configuration Manager, Manageengine Opmanager | 2026-09-23 | 7.6 High |
| ZohoCorp ManageEngine OpManager, NetFlow Analyzer, and Network Configuration Manager versions 12.8.667 and below were vulnerable to a Server-Side Template Injection vulnerability in Configlet processing, which could lead to Remote Code Execution. | ||||
| CVE-2026-73014 | 1 Microsoft | 21 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 18 more | 2026-09-23 | 7.8 High |
| Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-73018 | 1 Microsoft | 27 Graphics Component, Windows 10 1607, Windows 10 1809 and 24 more | 2026-09-23 | 8.8 High |
| Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-96446 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-09-23 | 4.2 Medium |
| A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that ensures a pushed request URI is used only once is not enforced. An attacker could potentially reuse a request URI to obtain multiple authorization codes for a user who is already signed in, violating security standards like FAPI-2. | ||||
| CVE-2026-77006 | 2026-09-23 | 9.6 Critical | ||
| The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user making the request, and discards the result of its own CSRF check, allowing any authenticated user, such as a subscriber, to delete arbitrary files on the server, which can lead to a site takeover. | ||||
| CVE-2026-93528 | 2026-09-23 | 3.7 Low | ||
| The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key. | ||||
| CVE-2026-93511 | 2026-09-23 | 5.3 Medium | ||
| The Premium Packages WordPress plugin before 7.2.1 does not verify PayPal's webhook signature before processing payment and subscription notifications, allowing unauthenticated attackers to forge payment confirmations and subscription-cancellation events against any order whose transaction id they know. | ||||
| CVE-2026-93510 | 2026-09-23 | 4.3 Medium | ||
| The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own account with an arbitrary and unlimited amount of loyalty points and, where a companion wallet Points and Rewards for WooCommerce WordPress plugin before 2.10.4 is active, wallet balance. | ||||