Export limit exceeded: 47602 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47602 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-45820 | 1 101arrowz | 1 Fflate | 2026-08-19 | 7.5 High |
| fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true. | ||||
| CVE-2017-20277 | 1 Joomboost | 1 Joomla Joomrecipe | 2026-08-19 | 8.2 High |
| Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on the search results page. Attackers can inject SQL code through POST requests to the search endpoint to extract database information using boolean-based blind SQL injection techniques. | ||||
| CVE-2017-20276 | 1 Simbunch | 1 Simgenealogy | 2026-08-19 | 8.2 High |
| Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the type parameter. Attackers can send GET requests to index.php with the option=com_simgenealogy, view=latest parameters and inject malicious SQL in the type parameter to extract sensitive database information. | ||||
| CVE-2017-20278 | 1 Joomboost | 1 Joomrecipe | 2026-08-19 | 8.2 High |
| Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the category parameter. Attackers can send GET requests to the all-recipes endpoint with malicious SQL payloads in the category path segment to extract sensitive database information. | ||||
| CVE-2026-64852 | 1 Getgrav | 1 Grav-plugin-api | 2026-08-19 | N/A |
| Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user can select another account from the route, create a persistent ApiKeyManager credential bound to that target, and inherit the target's API permissions, including api.super or administrative write access when present. This issue is fixed in version 1.0.8. | ||||
| CVE-2017-20280 | 1 Myportfolio | 1 Myportfolio | 2026-08-19 | 8.2 High |
| Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid endpoint to extract sensitive database information. | ||||
| CVE-2017-20282 | 1 Soft-php | 1 Jcart For Opencart | 2026-08-19 | 8.2 High |
| Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information. | ||||
| CVE-2026-76223 | 1 Arcadedata | 1 Arcadedb | 2026-08-19 | 7.1 High |
| ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions in an existing library and persist the change, enabling tampering with admin-defined function logic. The issue is fixed in 26.8.1. (JavaScript functions still trigger the UPDATE_SECURITY check and are not affected.) | ||||
| CVE-2019-25751 | 1 Cmsjunkie | 2 Classifiedsmanager, J-classifiedsmanager | 2026-08-19 | 8.2 High |
| Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the categorySearch, adType, and citySearch parameters to the displayads component to extract sensitive database information including usernames, databases, and version details. | ||||
| CVE-2026-74472 | 1 Linux | 1 Linux Kernel | 2026-08-19 | 7.0 High |
| In the Linux kernel, the following vulnerability has been resolved: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() ublk_ctrl_add_dev() memcpy()s the userspace ublksrv_ctrl_dev_info into ub->dev_info and then fixes up the fields the driver owns, but misses ->state and ->ublksrv_pid. A device added with ->state = UBLK_S_DEV_LIVE passes the "->state != UBLK_S_DEV_DEAD" test that ublk_stop_dev_unlocked() uses as its proxy for "a disk is attached", while ->ub_disk is still NULL, so DEL_DEV right after ADD_DEV oopses in del_gendisk(). UBLK_S_DEV_QUIESCED plus UBLK_F_USER_RECOVERY dies one step earlier, in ublk_force_abort_dev(). A poisoned ->state also gets START_USER_RECOVERY and the char device read/write path onto a device that was never started, and wedges START_DEV at -EEXIST. A poisoned ->ublksrv_pid just makes GET_DEV_INFO report an unrelated task as the ublk server. Reset both after the memcpy(), as ublk_detach_disk() does. Userspace only ever reads these back, so correcting them silently breaks nothing. ADD_DEV has copied ->state in unsanitized since ublk was merged, but back then it was harmless: the gendisk was allocated during ADD_DEV, and both teardown and the START_DEV -EEXIST check keyed off disk_live() rather than ->state. The oops became reachable once the disk allocation moved to START_DEV and those checks switched to ->state. | ||||
| CVE-2026-65675 | 1 Microsoft | 3 Github Copilot Chat, Visual Studio Code, Visual Studio Code Copilot Chat Extension | 2026-08-19 | 7.1 High |
| No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-18779 | 2 Truebooker, Wordpress | 2 Truebooker, Wordpress | 2026-08-19 | 5.3 Medium |
| The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records. | ||||
| CVE-2026-19629 | 1 Tenable | 1 Security Center | 2026-08-19 | 8.1 High |
| A privilege escalation vulnerability exists in Tenable Security Center that allows a user with "Security Manager" role and "manage user" permission on a single group to modify users belonging to other groups. This bypasses the intended access control restrictions and enables unauthorized cross-group user management. | ||||
| CVE-2026-21076 | 2 Samsung, Samsung Mobile | 2 Health, Samsung Health | 2026-08-19 | 5.5 Medium |
| Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | ||||
| CVE-2026-19631 | 1 Tenable | 1 Security Center | 2026-08-19 | 4.9 Medium |
| A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials. | ||||
| CVE-2026-74973 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 4.2 Medium |
| Race condition, use-after-free in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 115.39, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-20483 | 2 Mediatek, Mediatek, Inc. | 71 Mt6739, Mt6739 Firmware, Mt6761 and 68 more | 2026-08-19 | 7.7 High |
| In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11087526; Issue ID: MSV-8243. | ||||
| CVE-2026-19680 | 1 Tenable | 1 Security Center | 2026-08-19 | 7.1 High |
| A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database. | ||||
| CVE-2026-15423 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 8.5 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation. | ||||
| CVE-2026-4879 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 4.3 Medium |
| GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to view external status check configuration restricted to higher-privileged roles due to missing authorization on a merge request API endpoint. | ||||