Export limit exceeded: 371361 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 371361 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371361 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62422 | 1 Jetbrains | 1 Youtrack | 2026-07-29 | 10 Critical |
| In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass via direct database access leading to administrative access was possible | ||||
| CVE-2026-12588 | 1 Trellix | 1 Trellix Hx Console | 2026-07-29 | N/A |
| An attacker with access to an HX 10.0.0 and previous versions, may send specially-crafted data to the HX console. The malicious detection would then trigger decompression of a large file that consumes an excessive amount of system resources thus causing a Denial of Service. | ||||
| CVE-2026-14903 | 1 Ivanti | 1 Xtraction | 2026-07-29 | 7.7 High |
| Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root. | ||||
| CVE-2026-59835 | 1 Fortinet | 1 Fortisandbox | 2026-07-29 | 7.7 High |
| A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests. | ||||
| CVE-2025-53379 | 1 Fortinet | 1 Fortiauthenticator | 2026-07-29 | 7 High |
| A out-of-bounds read vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.2, FortiAuthenticator 6.5 all versions may allow a remote unauthenticated attacker to retrieve sensitive information via a specially crafted request. | ||||
| CVE-2026-59841 | 1 Fortinet | 1 Fortisiemwindowsagent | 2026-07-29 | 6.9 Medium |
| A improper restriction of communication channel to intended endpoints vulnerability in Fortinet FortiSIEMWindowsAgent 7.4.0 through 7.4.1 may allow attacker to escalation of privilege via <insert attack vector here> | ||||
| CVE-2026-59839 | 1 Fortinet | 3 Fortios, Fortipam, Fortiproxy | 2026-07-29 | 5 Medium |
| A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.8.0, FortiPAM 1.7.0 through 1.7.2, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.5, FortiProxy 7.4 through 7.4.13, FortiProxy 7.2 all versions, FortiProxy 7.0 all versions may allow attacker to execute unauthorized code or commands via <insert attack vector here> | ||||
| CVE-2026-23573 | 1 Fortinet | 3 Fortios, Fortipam, Fortiproxy | 2026-07-29 | 6.1 Medium |
| An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.8.0, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.4.0 through 7.4.3, FortiProxy 7.2.0 through 7.2.9 may allow an authenticated remote user to execute code or commands via crafted requests. | ||||
| CVE-2026-14300 | 2026-07-29 | N/A | ||
| The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured. | ||||
| CVE-2026-14234 | 2026-07-29 | N/A | ||
| The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting. | ||||
| CVE-2026-62642 | 1 Roundcube | 1 Webmail | 2026-07-29 | 4.3 Medium |
| In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment. | ||||
| CVE-2026-62643 | 1 Roundcube | 1 Webmail | 2026-07-29 | 7.2 High |
| In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. NOTE: this issue exists because of insufficient fixes for CVE-2026-35540 and CVE-2026-48843. | ||||
| CVE-2026-54432 | 1 Roundcube | 1 Webmail | 2026-07-29 | 4.7 Medium |
| Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page. | ||||
| CVE-2026-65755 | 1 Regularlabs.com | 2 Articles Anywhere Extension For Joomla, Users Anywhere Extension For Joomla | 2026-07-29 | 7.5 High |
| Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or expiry boundaries, potentially exposing content after it should become unavailable. | ||||
| CVE-2026-65879 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-07-29 | 9.8 Critical |
| Joomla Extension - joomshaper.com - Unauthenticated mail relay via a hardcoded, product-wide secret in SP Page Builder < 6.7.1 - A hardcoded secret allowed attackers to forge the mail from address of forms. | ||||
| CVE-2026-17501 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-07-29 | 5.3 Medium |
| A flaw has been found in ggml-org llama.cpp e15efe0. This vulnerability affects the function transform of the file common/json-schema-to-grammar.cpp of the component JSON-Schema-to-GBNF Conversion. This manipulation causes uncontrolled recursion. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-48394 | 1 Adobe | 1 Adobe Bridge | 2026-07-29 | 7.8 High |
| Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-15637 | 1 Devolutions | 1 Server | 2026-07-29 | 7.5 High |
| Improper authorization in the PAM SSH key and certificate retrieval endpoints in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated low-privileged user to disclose the private key of an SSH key or certificate PAM credential via a direct object reference to the credential identifier. | ||||
| CVE-2026-15642 | 1 Devolutions | 1 Server | 2026-07-29 | 3.3 Low |
| Insertion of sensitive information into a file in the Recovery Kit response file generation feature in Devolutions Server 2026.1.22.0, 2026.2.11.0 allows an attacker with access to the generated response file to obtain the Azure Key Vault client secret in cleartext, even when the option to exclude sensitive data is selected. | ||||
| CVE-2026-15058 | 1 Devolutions | 1 Server | 2026-07-29 | 3.1 Low |
| Improper authorization in the secure messages deletion endpoint in Devolutions Server 2026.2.11, 2026.1.22 allows an authenticated user to delete another user's messages via a direct object reference to the message identifier. | ||||