Export limit exceeded: 425852 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47601 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85138 | 1 Seacms | 1 Seacms | 2026-09-03 | 7.3 High |
| A vulnerability was detected in SeaCMS up to 13.6. Affected is the function addslashes of the file weixin/index.php of the component WeChat Module. The manipulation of the argument Content results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-78595 | 1 Elastic | 1 Kibana | 2026-09-03 | 4.3 Medium |
| Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fleet agent privileges in one Kibana space could enumerate agent metadata and access diagnostic content belonging to agents enrolled in other Kibana spaces. | ||||
| CVE-2026-78596 | 1 Elastic | 1 Kibana | 2026-09-03 | 4.3 Medium |
| Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security read-level access in a single Kibana space could trigger Entity Analytics migration operations that perform privileged writes across all Kibana spaces, regardless of that user's actual access scope. | ||||
| CVE-2026-82302 | 1 Elastic | 1 Kibana | 2026-09-03 | 8.1 High |
| Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). | ||||
| CVE-2026-85388 | 1 Worklenz | 1 Worklenz | 2026-09-03 | 8.1 High |
| Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947. | ||||
| CVE-2026-64082 | 1 Linux | 2 Kernel, Linux Kernel | 2026-09-03 | 7.8 High |
| In the Linux kernel, the following vulnerability has been resolved: riscv: Fix register corruption from uninitialized cregs on error compat_riscv_gpr_set() calls cregs_to_regs() unconditionally, even when user_regset_copyin() fails. Since cregs is an uninitialized stack variable, a copyin failure causes uninitialized stack data to be written into the target task's pt_regs, corrupting its register state and potentially leaking kernel stack contents. compat_restore_sigcontext() has the same issue: it calls cregs_to_regs() even when __copy_from_user() fails, leading to the same corruption of the signal-returning task's register state on error. Only call cregs_to_regs() when the user copy succeeds. | ||||
| CVE-2026-82298 | 1 Elastic | 1 Kibana | 2026-09-03 | 4.3 Medium |
| Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). | ||||
| CVE-2026-82299 | 1 Elastic | 1 Kibana | 2026-09-03 | 6.5 Medium |
| Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). | ||||
| CVE-2026-15630 | 1 Casdoor | 1 Casdoor | 2026-09-03 | 9.9 Critical |
| A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body). | ||||
| CVE-2026-85304 | 2 Unlimited-elements, Wordpress | 2 Unlimited Elements For Elementor (free Widgets, Addons, Templates), Wordpress | 2026-09-03 | 5.3 Medium |
| Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.17. | ||||
| CVE-2026-78587 | 1 Elastic | 1 Fleet Server | 2026-09-03 | 3.1 Low |
| Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122). Fleet Server does not correctly verify session ownership during multi-part data upload operations, allowing any authenticated agent to interfere with the active upload sessions belonging to other enrolled agents. | ||||
| CVE-2026-19484 | 1 Fastify | 2 Busboy, Fastify\/busyboy | 2026-09-03 | 7.5 High |
| @fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1. | ||||
| CVE-2026-84641 | 1 Mozilla | 1 Thunderbird | 2026-09-03 | 7.5 High |
| A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately be persisted to prefs.js. This vulnerability was fixed in Thunderbird 155, Thunderbird 140.15, and Thunderbird 153.2. | ||||
| CVE-2026-72681 | 1 Elastic | 1 Kibana | 2026-09-03 | 6.5 Medium |
| Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of sensitive information that the user is not authorized to read. | ||||
| CVE-2026-72643 | 1 Elastic | 1 Kibana | 2026-09-03 | 7.1 High |
| Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that share a username in different realms are treated as the same owner. This discloses the configuration and instructions of an agent the caller does not own, and allows that agent to be altered or removed. | ||||
| CVE-2026-84757 | 2 Aresit, Wordpress | 2 Wp Compress, Wordpress | 2026-09-03 | 8.2 High |
| Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. | ||||
| CVE-2026-85212 | 1 Crmeb | 1 Crmeb | 2026-09-03 | 8.3 High |
| CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoints by exploiting the inert role check that always permits requests. | ||||
| CVE-2026-84768 | 2 E4jvikwp, Wordpress | 2 Vikappointments Services Booking Calendar, Wordpress | 2026-09-03 | 9.3 Critical |
| Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions. | ||||
| CVE-2026-84215 | 2 Arraytics, Wordpress | 2 Timetics, Wordpress | 2026-09-03 | 6.5 Medium |
| Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. | ||||
| CVE-2026-81892 | 1 Easycorp | 1 Easyadmin | 2026-09-03 | 8.1 High |
| EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions (Action::linkToRoute() and MenuItem::linkToRoute()), swaps the executed controller based on the routeName query parameter on the kernel.controller event. The swap happens after Symfony's security firewall has already evaluated access_control against the original dashboard URL, and the routeName value was not validated. As a result, a path-based access_control rule protecting the target route was never evaluated, so a low-privilege backend user who can reach a single EasyAdmin URL and knows a target route's name can execute that route's controller, bypassing the path-based rule. Only path-based protections are bypassed. Routes whose controller enforces its own authorization with #[IsGranted] or denyAccessUnlessGranted() remain protected because those checks are recomputed against the swapped-in controller. This issue is fixed in versions 4.29.16 and 5.5.1. | ||||