Export limit exceeded: 389998 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389998 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71642 | 2026-09-11 | N/A | ||
| An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the EGOReplanFSM::checkCollisionCallback() | ||||
| CVE-2026-71647 | 2026-09-11 | N/A | ||
| An issue in EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a denial of service via the checkCollisionCallback, execFSMCallback, planFromGlobalTraj in ego_replan_fsm.cpp | ||||
| CVE-2026-79590 | 2026-09-11 | N/A | ||
| A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ruby source file that triggers the parser to pass a NULL pointer to nonnull string handling functions, resulting in undefined behavior and application crash. | ||||
| CVE-2026-36392 | 2026-09-11 | N/A | ||
| FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScript into an item's title, which is stored server-side and executed in the browser of any client user who visits the store page, enabling session hijacking, account takeover, and phishing. | ||||
| CVE-2026-84197 | 1 Eclipse | 1 Ditto | 2026-09-11 | N/A |
| In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are therefore disabled for every wss:// connection, and no builder option, constructor argument or environment variable lets an application turn validation back on. An attacker in a position to intercept the connection can present an arbitrary certificate, complete the TLS handshake, read the credentials that the configured authentication provider sends in the Authorization header of the WebSocket upgrade request, and read, alter or inject Ditto Protocol messages for the lifetime of the connection. The Java client, the browser/DOM JavaScript client and the HTTP transport of the Node.js client are not affected. | ||||
| CVE-2026-78635 | 1 Okta | 1 Okta Privileged Access Client | 2026-09-11 | 5 Medium |
| The Okta Privileged Access client URL handler does not insert an option terminator before appending the target value to the command-line arguments. When a scaleft:// protocol handler link contains a value beginning with a hyphen, the underlying CLI framework interprets it as a command-line flag, causing unintended modification of the SSH client's behavior. | ||||
| CVE-2026-86819 | 1 Waves Audio | 1 Waves Central | 2026-09-11 | 7.1 High |
| Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement (application identifier and Team ID). A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges. Fixed in 17.0. | ||||
| CVE-2026-68006 | 2026-09-11 | N/A | ||
| An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file | ||||
| CVE-2026-11813 | 1 Lenovo | 2 Filez Client, Filez Enterprise | 2026-09-11 | 7.8 High |
| A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated user to escalate privileges. | ||||
| CVE-2026-78131 | 1 Strongswan | 1 Strongswan | 2026-09-11 | 3.7 Low |
| strongSwan 4.2.0 through 6.0.7 has a missing release of memory after its effective lifetime in the x509 plugin's attribute certificate parser. | ||||
| CVE-2026-78132 | 1 Strongswan | 1 Strongswan | 2026-09-11 | 7.5 High |
| strongSwan 5.1.3 through 6.0.7 has an infinite loop in the x509 plugin's attribute certificate parser for ietfAttrSyntax. | ||||
| CVE-2026-78134 | 1 Strongswan | 1 Strongswan | 2026-09-11 | 7.1 High |
| strongSwan 4.5.0 through 6.0.7 has Incorrect Access Control in the eap-ttls and eap-peap plugins because there can be a missing or mismatched inner EAP identity. | ||||
| CVE-2026-89151 | 1 Forgejo | 1 Forgejo | 2026-09-11 | 3.5 Low |
| Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature. | ||||
| CVE-2026-81983 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-11 | 7.8 High |
| Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-81979 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-11 | 7.8 High |
| Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-89169 | 2026-09-11 | N/A | ||
| live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. | ||||
| CVE-2026-89060 | 1 Redhat | 1 Acm | 2026-09-11 | 7.7 High |
| A flaw was found in multicluster-observability-addon. This vulnerability allows a managed-cluster identity to reference configuration resources outside its designated namespace. This can lead to the disclosure of sensitive hub Secrets to an attacker-controlled managed cluster. | ||||
| CVE-2026-71645 | 2026-09-11 | N/A | ||
| An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the exploration state machine | ||||
| CVE-2026-78130 | 1 Strongswan | 1 Strongswan | 2026-09-11 | 7.5 High |
| strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. | ||||
| CVE-2026-81978 | 3 Adobe, Apple, Microsoft | 7 Acrobat, Acrobat 2024, Acrobat Dc and 4 more | 2026-09-11 | 5.5 Medium |
| Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||