Export limit exceeded: 388884 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (388884 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-86995 | 2026-09-08 | N/A | ||
| n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node validated the repository parameter for fetch or pull, but setUpstream wrote a branch..remote value into repository configuration without validating it. A later fetch or pull resolved the remote from that configuration instead of the checked parameter. An authenticated workflow editor could therefore point Git at any local repository readable by the n8n process and receive its contents through packages/nodes-base/nodes/Git/GenericFunctions.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2. | ||||
| CVE-2026-49932 | 2026-09-08 | 7.8 High | ||
| In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49927 | 2026-09-08 | 7.8 High | ||
| In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-49156 | 2026-09-08 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-49155 | 2026-09-08 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-49154 | 2026-09-08 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-49153 | 2026-09-08 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-86996 | 2026-09-08 | N/A | ||
| n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2. | ||||
| CVE-2026-69369 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-08 | 5.5 Medium |
| Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69403 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-08 | 5.5 Medium |
| Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69393 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-09-08 | 5.7 Medium |
| Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-67378 | 1 Microsoft | 6 Microsoft Sql Server 2019 (gdr), Microsoft Sql Server 2022 (gdr), Microsoft Sql Server 2025 For X64-based Systems (gdr) and 3 more | 2026-09-08 | 8.5 High |
| Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-75616 | 1 Tp-link | 3 Archer C20, Archer C20 Firmware, Archer C20 V6 | 2026-09-08 | 6.8 Medium |
| An OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it. | ||||
| CVE-2026-70465 | 1 Fortinet | 2 Forticlient, Forticlientwindows | 2026-09-08 | 7.3 High |
| A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.3, FortiClientWindows 7.2.0 through 7.2.11 may allow an unauthenticated attacker in a position to alter or craft DNS responses to the targeted host to execute arbitrary code via malicious packets. | ||||
| CVE-2026-26035 | 1 Fortinet | 1 Fortiweb | 2026-09-08 | 8.8 High |
| An Improper Authentication vulnerability [CWE-287] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow a remote unauthenticated attacker to login into the Fortiweb GUI/CLI with a random username and password | ||||
| CVE-2026-70466 | 1 Fortinet | 2 Fortios, Fortiweb | 2026-09-08 | 4.8 Medium |
| A incomplete list of disallowed inputs vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4 all versions, FortiWeb 7.2 all versions, FortiWeb 7.0 all versions may allow attacker to improper access control via <insert attack vector here> | ||||
| CVE-2026-70467 | 1 Fortinet | 1 Fortisiem | 2026-09-08 | 3.4 Low |
| A server-side request forgery (ssrf) vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here> | ||||
| CVE-2026-45220 | 2026-09-08 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-69395 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-08 | 6.5 Medium |
| Use of externally-controlled format string in Active Directory Certificate Services (AD CS) allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-69409 | 1 Microsoft | 1 Sharepoint Server | 2026-09-08 | 6.5 Medium |
| Execution with unnecessary privileges in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||