Export limit exceeded: 377116 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377116 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-68754 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 6.5 Medium |
| A repository publisher without delete permission may modify protected package content under specific conditions. | ||||
| CVE-2026-68756 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 6.6 Medium |
| A party with write access to stored session data may affect JFrog Artifactory under specific conditions. | ||||
| CVE-2026-59242 | 1 Apache | 1 Airflow | 2026-08-12 | 5.4 Medium |
| Apache Airflow's XCom `GET /api/v2/{...}/xcomEntries/{key}?deserialize=true` endpoint passed a string-literal payload through `BaseXCom.deserialize_value` without the `_check_forbidden_xcom_keys` guard, allowing an authenticated API user with XCom write-and-read access to instantiate arbitrary `airflow.*` classes on the API server (CWE-502). An authenticated user who can write an XCom value and then read it back with `deserialize=true` triggers the unsafe instantiation. Users are advised to upgrade to apache-airflow 3.3.1 or later, which rejects reserved XCom serialization keys submitted as JSON string literals. | ||||
| CVE-2024-25039 | 1 Ibm | 2 Engineering Requirements Management Doors And Doors Web Access, Engineering Requirements Management Doors Web Access | 2026-08-12 | 7.5 High |
| IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 do not limit the length of a connection which could allow for a Slowloris HTTP denial of service attack to take place. This can cause the web server to become unresponsive. | ||||
| CVE-2025-0152 | 1 Ibm | 2 Engineering Requirements Management Doors And Doors Web Access, Engineering Requirements Management Doors Web Access | 2026-08-12 | 6.1 Medium |
| IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2024-40683 | 1 Ibm | 2 Operations Analytics - Log Analysis, Operations Analytics Log Analysis | 2026-08-12 | 6.3 Medium |
| IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 does not invalidate session after a password chance which could allow an authenticated user to impersonate another user on the system. | ||||
| CVE-2026-23823 | 2 Arubanetworks, Hpe | 2 Arubaos, Arubaos | 2026-08-12 | 7.2 High |
| A vulnerability in the command line interface of Access Points running AOS-10 could allow an authenticated remote attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. NOTE: This vulnerability only impacts Access Points running AOS-10.7.x.x and above. AOS-10.4 AP and AOS-8 Instant software branches are not affected by this vulnerability. | ||||
| CVE-2026-23822 | 2 Arubanetworks, Hpe | 2 Arubaos, Arubaos | 2026-08-12 | 5.3 Medium |
| A vulnerability in the XML handling component of AOS-8 DHCP services could allow an unauthenticated remote attacker to trigger a denial-of-service condition. Successful exploitation could allow an attacker to cause excessive resource consumption upon user interaction, leading to service disruption or reduced availability of the affected system. NOTE: This vulnerability only impacts Access Points running AOS Instant 8.x.x.x | ||||
| CVE-2026-23821 | 2 Arubanetworks, Hpe | 2 Arubaos, Arubaos | 2026-08-12 | 7.2 High |
| A vulnerability in the configuration processing logic of Access Points running AOS-10 could allow an authenticated remote attacker to execute system commands under certain pre-existing conditions. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Note: Access Points running AOS-8 Instant software are not affected by this vulnerability. | ||||
| CVE-2026-23820 | 2 Arubanetworks, Hpe | 2 Arubaos, Arubaos | 2026-08-12 | 7.2 High |
| A vulnerability in the command line interface of Access Points running AOS-10 and AOS-8 Instant could allow an authenticated remote attacker to execute system commands in a restricted shell environment. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. | ||||
| CVE-2026-32992 | 2 Cpanel, Webpros | 5 Cpanel, Whm, Wp Squared and 2 more | 2026-08-12 | 8.2 High |
| SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials. | ||||
| CVE-2024-58362 | 1 Surrealdb | 1 Surrealdb | 2026-08-12 | 8.8 High |
| SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API without recursively validating it for non-computed values. When a record access method defines a SIGNIN or SIGNUP query and the RPC API is exposed to untrusted users, an unauthenticated attacker can encode a binary object containing a subquery using the bincode serialization format and supply it in place of credentials. The subquery is then executed within the database owner's SIGNIN/SIGNUP query under a system user session with the editor role, allowing the attacker to select, create, update, and delete non-IAM resources (though not view the query results directly, and not affect IAM resources, which require the owner role). | ||||
| CVE-2024-58363 | 1 Surrealdb | 1 Surrealdb | 2026-08-12 | 6.3 Medium |
| SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. Attackers with an authenticated session can impersonate an unrelated user in a different database if a user record with an identical identifier exists, allowing unauthorized actions if permissions rely solely on the $auth parameter. | ||||
| CVE-2026-50516 | 1 Microsoft | 1 Azure Kubernetes Service | 2026-08-12 | 9.4 Critical |
| Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-29205 | 3 Cpanel, Webpros, Wordpress | 6 Cpanel, Whm, Wp Squared and 3 more | 2026-08-12 | 8.6 High |
| Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints. | ||||
| CVE-2026-19311 | 2 Aws, Github | 2 Opensearch, Opensearch | 2026-08-12 | 8.1 High |
| Missing authorization in the Execute Monitor API in Amazon OpenSearch Alerting plugin might allow an authenticated remote user to read, modify, or delete arbitrary index data via a crafted inline monitor request with unintentional data source and input index parameters. | ||||
| CVE-2026-54113 | 1 Microsoft | 19 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 16 more | 2026-08-12 | 7.5 High |
| Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-68868 | 1 Apache | 1 Airflow Google Provider | 2026-08-12 | 6.5 Medium |
| The Google Cloud Secret Manager secrets backend in Apache Airflow's Google provider never applied the team scope when resolving Connections and Variables: the caller's `team_name` was accepted by the backend but dropped at the internal call boundary, so every lookup resolved against the team-agnostic secret name. In a deployment running multi-team mode with this backend, a task or Dag belonging to one team resolved another team's Connection or Variable, obtaining its credentials in full. No unusual configuration is required beyond enabling multi-team mode and using this backend. Users are advised to upgrade to apache-airflow-providers-google 22.3.0 or later, which builds and applies the team-scoped secret name. | ||||
| CVE-2026-73297 | 1 Microsoft | 1 Ufo | 2026-08-12 | N/A |
| Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did not block NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, the 6to4 prefix 2002::/16, or the Teredo prefix 2001::/32 and did not re-check embedded IPv4 destinations, allowing an unauthenticated remote attacker who can influence URLs processed by validate_url to bypass the SSRF guard and reach cloud metadata, internal services, or localhost. This issue is fixed in version 3.0.8. | ||||
| CVE-2026-59125 | 1 Microsoft | 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more | 2026-08-12 | 7 High |
| Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | ||||