Export limit exceeded: 398945 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (398945 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-35616 | 1 Fortinet | 1 Forticlientems | 2026-09-26 | 9.1 Critical |
| A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | ||||
| CVE-2026-100523 | 1 Cotonti | 2 Cotonti Siena, Siena | 2026-09-26 | 6.1 Medium |
| Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain validation. Unauthenticated attackers can craft malicious links with encoded external URLs to redirect users to arbitrary sites via meta refresh tags for phishing attacks. | ||||
| CVE-2026-100312 | 1 Mathurvishal | 1 Cloudclassroom-php-project | 2026-09-26 | 6.3 Medium |
| A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file /updateguest.php. Performing a manipulation of the argument gname/editassid results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-17545 | 1 Php Group | 1 Php | 2026-09-26 | 5.9 Medium |
| On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes. | ||||
| CVE-2025-14181 | 1 Php Group | 1 Php | 2026-09-26 | 6.5 Medium |
| The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow. | ||||
| CVE-2026-100503 | 2 Nationalsecurityagency, Nsa | 2 Ghidra, Ghidra | 2026-09-26 | 3.3 Low |
| Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by stale INDIRECT effect-op references. Attackers can craft a malicious binary with a specific x86-64 sequence that triggers the vulnerability during decompilation, causing the decompile helper process to crash and denying service to analysts and automated analysis pipelines. | ||||
| CVE-2026-86930 | 1 Claris | 1 Filemaker Server | 2026-09-26 | 9.1 Critical |
| An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebDirect. This vulnerability is addressed in FileMaker Server version 26.0.3. | ||||
| CVE-2026-86934 | 1 Claris | 1 Filemaker Server | 2026-09-26 | 9.1 Critical |
| An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header to bypass the disabled Custom Web Publishing with XML setting and access the XML Web Publishing interface. This vulnerability is addressed in FileMaker Server version 26.0.3. | ||||
| CVE-2026-8051 | 1 Ivanti | 1 Virtual Traffic Manager | 2026-09-26 | 7.2 High |
| OS command injection in Ivanti Virtual Traffic Manager before version 22.9r4 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | ||||
| CVE-2026-79314 | 1 Vaxilu | 1 X-ui | 2026-09-26 | 8.8 High |
| A horizontal privilege escalation vulnerability exists in x-ui 0.3.2. An authenticated user can modify the inbound proxy configurations of other users, including remark, port, protocol, settings, enabled state, expiry time and traffic quota, by submitting a request referencing the target resource identifier. The update path fails to verify that the target resource belongs to the requesting session user, allowing unauthorized cross-user modification of data. | ||||
| CVE-2026-7411 | 1 Eclipse | 1 Basyx | 2026-09-26 | 10 Critical |
| In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. By supplying a maliciously crafted fileName parameter during a file upload operation, an attacker can bypass intended storage boundaries and write arbitrary files to any location on the host filesystem accessible by the Java process. This can lead to Remote Code Execution (RCE) and complete system compromise. | ||||
| CVE-2026-22314 | 1 Mesalvo | 2 Meona Client Launcher Component, Meona Server Component | 2026-09-26 | 7.9 High |
| Improper Control of Generation of Code ('Code Injection') vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables code execution on other users' systems. This issue affects Meona Client Launcher Component: through 19.06.2020 15:11:49; Meona Server Component: through 2025.04 5+323020. | ||||
| CVE-2026-0856 | 1 Mesalvo | 2 Meona Client Launcher Component, Meona Server Component | 2026-09-26 | 7.8 High |
| Improper Access Control vulnerability in Mesalvo MEONA (MEONA Client and MEONA Server) allows an authenticated MEONA user to access administrative functions of the MEONA Client (admin panel). The MEONA Server does not independently verify the role asserted by the MEONA Client. A user who holds a valid MEONA user account and is able to execute a modified copy of the MEONA Client on a device within the operating hospital's network can assert an administrator role and access administrative functions with regular user credentials. Exploitation requires: (1) a valid MEONA user account issued by the operating hospital; (2) network access to the MEONA Server, which is operated exclusively within closed hospital networks without exposure to the public Internet (where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control); (3) the ability to modify MEONA Client binaries and to execute the modified copy on a device in that network. On managed devices with application control, as recommended in Mesalvo's hardening guidance (MSA-2026-001), this requires local administrator privileges on the device. Mesalvo is not aware of any exploitation outside the reported security test. This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 and 2026.03. Mitigations are available with MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026); see Mesalvo Security Advisory MSA-2026-001. | ||||
| CVE-2026-0857 | 1 Mesalvo | 2 Meona Client Launcher Component, Meona Server Component | 2026-09-26 | 4.4 Medium |
| Use of a Password Hash With Insufficient Computational Effort in Mesalvo MEONA (MEONA Server and MEONA Client) for user accounts whose password was last set under a version before MEONA 2024.10. MEONA versions before 2024.10 protected stored passwords with SHA-1 (versions from October 2015) or stored them without protection (earlier versions). Since MEONA 2024.10 (June 2024) Argon2 is the default method and every password that is set or changed is stored with Argon2; passwords last set under an earlier version keep the earlier method until they are changed. An administrator could in addition select the storage method per account. A MEONA super administrator can read the stored value of such accounts in the user administration of the MEONA Client or export it through administrative database functions. Only accounts managed locally in MEONA are affected; accounts authenticated through the operating hospital's directory service (Active Directory / Entra ID) have no password stored in MEONA. In typical installations end users authenticate through the directory service and local accounts are limited to emergency and technical accounts. Exploitation requires super administrator permissions in MEONA (or direct access to the MEONA database) from within the operating hospital's network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. Installations in which every password has been set or changed under MEONA 2024.10 or later are not affected. Mesalvo is not aware of any exploitation outside the reported security test. This issue affects MEONA Server and MEONA Client in versions 2024.10, 2025.04 and 2026.03 (for accounts with passwords last set under earlier versions). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) remove the legacy storage methods, require every affected account to set a new Argon2-protected password at next logon, and no longer display stored credential values in the user administration. See Mesalvo Security Advisory MSA-2026-002. | ||||
| CVE-2026-25602 | 1 Mesalvo | 2 Meona Client Launcher Component, Meona Server Component | 2026-09-26 | 2.3 Low |
| Insufficient Verification of Data Authenticity in the feedback function of Mesalvo MEONA (MEONA Client and MEONA Server). The MEONA Client transmits the recipient address of a feedback report to the MEONA Server, and the server sends the report to the transmitted address instead of the address configured on the server. The feedback function is available only in the MEONA administration area, which requires one of the administrative roles ADMINISTRATOR, SUPERADMINISTRATOR or TYPIST (catalogue editing), or the PHARMACIST role holding the PHARMACY_ADMINISTRATOR right, assigned explicitly by the operating hospital's administrators. Such a user who modifies the client request can cause the MEONA Server to send a message with content of the user's choosing, from the sender address configured on the server, to a recipient of the user's choosing, within the limits permitted by the operator's mail relay. The message can be used for social engineering because it appears to originate from an internal hospital system. Exploitation requires a MEONA account with one of the administrative roles named above and access to the operating hospital's internal network; MEONA is operated exclusively within closed hospital networks without exposure to the public Internet, and where a hospital permits remote access to that network at all, it is only through the hospital's own remote-access infrastructure (e.g. VPN) under the hospital's control. The message contains only the recipient, subject and text entered by the user; no data of other users or patients is disclosed. Mesalvo is not aware of any exploitation outside the reported security test. This issue affects MEONA Client and MEONA Server in versions 2024.10, 2025.04 (before 2025.04.24) and 2026.03 (before 2026.03.02). MEONA 2025.04.24 and 2026.03.02 (planned Q4 2026) enforce the configured recipient address on the server. Operators can restrict at their mail relay which recipients the MEONA sender address may reach. | ||||
| CVE-2026-70125 | 1 Microsoft | 3 365 Apps, Office 2021, Office 2024 | 2026-09-26 | 8.8 High |
| Microsoft Office Outlook Remote Code Execution Vulnerability | ||||
| CVE-2026-7256 | 1 Zyxel | 2 Wre6505, Wre6505 Firmware | 2026-09-26 | 8.8 High |
| ** UNSUPPORTED WHEN ASSIGNED ** A command injection vulnerability in the CGI program of Zyxel WRE6505 v2 firmware version V1.00(ABDV.3)C0 could allow an adjacent attacker on the LAN to execute operating system (OS) commands on a vulnerable device by sending a crafted HTTP request. | ||||
| CVE-2026-78806 | 2026-09-26 | 5.5 Medium | ||
| An issue in Matter Standard Specification-Implementation gap v1.5.1 Matter Project Chip V1.5.1 allows a local attacker to obtain sensitive information via the PerformCommissioningStep function in the ChipDeviceController.cpp component | ||||
| CVE-2026-88418 | 1 Cmsimple | 1 Cmsimple | 2026-09-26 | 8.8 High |
| CMSimple 5.24 ships with CSRF protection disabled by default, which turns csrfProtection() into a no-op on every state-changing admin request, and it does not send the csrf_token hidden field in admin forms. Because administrator authentication is cookie-only and no CSRF token is enforced, an unauthenticated attacker can induce a logged-in administrator's browser to issue a forged content-save request with a text payload containing a scripting marker. The marker is stored verbatim into content/content.php; on every subsequent page view evaluate_cmsimple_scripting() (functions.php) executes the marker body with PHP eval() — for all visitors, including unauthenticated ones. This yields persistent remote code execution on the web server. | ||||
| CVE-2026-88414 | 1 Mcms | 1 Mcms | 2026-09-26 | 9.8 Critical |
| MCMS 6.1.1 through 6.2.1 contains a SQL injection vulnerability in the PageAction.verify endpoint (GET /ms/mdiy/page/verify.do). | ||||