Export limit exceeded: 372838 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372838 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58059 | 1 Legion Of The Bouncy Castle Inc. | 3 Bc-fja, Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, Quadratic-time escaping when stringifying X.500 distinguished names. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | ||||
| CVE-2026-14682 | 1 Legion Of The Bouncy Castle Inc. | 3 Bc-fja, Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, Possible OOM from unbounded up-front allocation on a definite-length read. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series), and before bctls-fips 1.0.24. | ||||
| CVE-2026-12802 | 1 Legion Of The Bouncy Castle Inc. | 3 Bc-fja, Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, CMS AuthEnvelopedData fails to enforce tag-length on decryption. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpkix-fips 1.0.12 (1.0.X series), 2.0.12 (2.0.X series) and 2.1.12 (2.1.X series). | ||||
| CVE-2026-12803 | 1 Legion Of The Bouncy Castle Inc. | 2 Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, KCCMBlockCipher MAC does not bind nonce when AAD is absent (cross-nonce AEAD forgery). This issue also affects Bouncy Castle for Java LTS before 2.73.12. | ||||
| CVE-2026-12816 | 1 Legion Of The Bouncy Castle Inc. | 2 Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, IESEngine stream-mode MAC forgery via length-dependent KDF split. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | ||||
| CVE-2026-12817 | 1 Legion Of The Bouncy Castle Inc. | 3 Bc-fja, Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, OpenPGP AEAD decryption skips final tag on chunk-aligned data. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bcpg-fips 1.0.13 (1.0.X series), 2.0.13 (2.0.X series) and 2.1.13 (2.1.X series). | ||||
| CVE-2026-12852 | 1 Legion Of The Bouncy Castle Inc. | 1 Bc-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, MLS wire decoder allocates attacker-declared opaque length before bounds check. | ||||
| CVE-2026-12860 | 1 Legion Of The Bouncy Castle Inc. | 2 Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, RSA PKCS#1 verification skips last two hash bytes in NULL-omitted path. This issue also affects Bouncy Castle for Java LTS before 2.73.12. | ||||
| CVE-2026-13506 | 1 Legion Of The Bouncy Castle Inc. | 3 Bc-fja, Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, Lazy ASN.1 sequence forcing resets nesting-depth guard. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | ||||
| CVE-2026-13586 | 1 Legion Of The Bouncy Castle Inc. | 3 Bc-fja, Bc-java, Bc-lts-java | 2026-08-03 | N/A |
| In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series). | ||||
| CVE-2026-6694 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-08-03 | 5.5 Medium |
| A flaw was found in GIMP's file-png plugin. A remote attacker can exploit this by crafting a malicious Animated Portable Network Graphics (APNG) image containing an oversized tRNS chunk. This can lead to a stack-based buffer overflow (CWE-121), causing the file-png plugin to crash and resulting in a Denial of Service (DoS) for the user. | ||||
| CVE-2026-18584 | 2 Gl-inet, Gl.inet | 12 E5800, E750, X2000 and 9 more | 2026-08-03 | 5.4 Medium |
| A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local network. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. | ||||
| CVE-2026-18585 | 2 Gl-inet, Gl.inet | 22 Be3600, Be6500, Be9300 and 19 more | 2026-08-03 | 4.3 Medium |
| A vulnerability was detected in GL.iNet MT3000, MT6000, BE9300, BE3600, MT3600BE, E5800, BE6500, MT5000, X3000, XE3000 and MT2500 up to 20260707. The affected element is the function nas-web.get_file_list of the component APPS-NAS Module. Performing a manipulation results in heap-based buffer overflow. The attack may be initiated remotely. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. | ||||
| CVE-2026-9593 | 2 Endress+hauser, Endress Hauser | 2 Fdi Package Library, Fdi Package Library | 2026-08-03 | 6.7 Medium |
| A vulnerability in the iDTM FDI allows an attacker with elevated privileges and access to the host system to enable the debug interface by placing a crafted file in the application directory, potentially resulting in unauthorized access to connected devices and exposure, modification, or disruption of device data or operation. | ||||
| CVE-2026-33591 | 1 Tranquil It Systems | 1 Wapt Server | 2026-08-03 | N/A |
| A vulnerability in Wapt Server before version 2.6.1.17813 allows a remote unauthenticated attacker to bypass security restriction using a specially crafted packet and retrieve a valid session token for the targeted account. | ||||
| CVE-2026-0392 | 1 Latvijas Valsts Radio Un Televīzijas Centrs (lvrtc) | 1 Eparakstītājs 3.0 | 2026-08-03 | N/A |
| eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host. | ||||
| CVE-2026-56608 | 1 Hcltech | 1 Icontrol | 2026-08-03 | 3.7 Low |
| HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization. | ||||
| CVE-2026-56609 | 1 Hcltech | 1 Icontrol | 2026-08-03 | 4.8 Medium |
| HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission. | ||||
| CVE-2026-18574 | 1 Checkpoint | 2 Multi-domain Security Management Server, Security Management Server | 2026-08-03 | N/A |
| An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could allow an unauthenticated remote attacker with network access to Management services to execute arbitrary commands on the Security Management Server. Successful exploitation could result in full compromise of the Security Management system. Check Point discovered this issue internally and has no indication of active exploitation. | ||||
| CVE-2026-18572 | 1 Redhat | 8 Build Keycloak, Build Of Keycloak, Data Grid and 5 more | 2026-08-03 | 6.5 Medium |
| Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times. | ||||