Export limit exceeded: 371382 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371382 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15901 | 1 Google | 1 Chrome | 2026-07-29 | 9.6 Critical |
| Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-15904 | 1 Google | 1 Chrome | 2026-07-29 | 8.8 High |
| Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-30632 | 1 Knowns-dev | 1 Knowns | 2026-07-29 | 7.5 High |
| Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. | ||||
| CVE-2026-30633 | 1 Knowns-dev | 1 Knowns | 2026-07-29 | 7.5 High |
| Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools. | ||||
| CVE-2026-30631 | 1 Bytebot-ai | 1 Bytebot | 2026-07-29 | 9.8 Critical |
| An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`. | ||||
| CVE-2026-50755 | 1 Dayuanjiang | 1 Next-ai-draw-io | 2026-07-29 | 9.8 Critical |
| An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the X-Forwarded-For header value | ||||
| CVE-2026-50756 | 1 Dayuanjiang | 1 Next-ai-draw-io | 2026-07-29 | 7.5 High |
| An issue in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to obtain sensitive information via the x-ai-provider component | ||||
| CVE-2026-50757 | 1 Dayuanjiang | 1 Next-ai-draw-io | 2026-07-29 | 7.8 High |
| Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to execute arbitrary code via the nex-ai-draw-io/mcp-server | ||||
| CVE-2026-50758 | 1 Dayuanjiang | 1 Next-ai-draw-io | 2026-07-29 | 8.1 High |
| Cross Site Scripting vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allows a remote attacker to execute arbitrary code via the mcp parameter | ||||
| CVE-2026-50759 | 1 Exo-explore | 1 Exo | 2026-07-29 | 7.5 High |
| An issue in exo-explore exo 1.0.69 allows a remote attacker to escalate privileges via the GET /state and DELETE /instance/{instance_id} endpoints with no authentication. | ||||
| CVE-2026-52475 | 2026-07-29 | 6.1 Medium | ||
| Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file | ||||
| CVE-2026-52472 | 2026-07-29 | 9.8 Critical | ||
| SQL injection vulnerability in Wgcloud 3.6.4 allows a remote attacker to escalate privileges via the PortInfoMapper.xml file | ||||
| CVE-2026-52476 | 2026-07-29 | 7.5 High | ||
| SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file | ||||
| CVE-2025-68640 | 2026-07-29 | 5.3 Medium | ||
| The Apple Find My backend service through 2025-12-17 allows an attacker in possession of a valid PET (Private Endpoint Token) to enumerate devices and remove offline devices from an Apple ID account without triggering two-factor authentication or ownership verification. This may result in unauthorized removal of devices associated with the account. | ||||
| CVE-2026-59776 | 1 Sony | 1 Felica Ic Chips | 2026-07-29 | N/A |
| Missing Cryptographic Step (CWE-325) vulnerability exists in certain FeliCa IC chips shipped in or before 2017. If the vulnerability is exploited, information stored in the IC chip may be read or tampered with. | ||||
| CVE-2026-16266 | 2026-07-29 | 4 Medium | ||
| Versions of the package mongo-object before 3.0.3 are vulnerable to Prototype Pollution via the expandKey() function in util.js. An attacker can modify the JavaScript prototype chain by supplying a crafted property path containing special keys such as __proto__. | ||||
| CVE-2026-59846 | 2 Libssh, Redhat | 4 Libssh, Enterprise Linux, Hardened Images and 1 more | 2026-07-29 | 3.9 Low |
| A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. | ||||
| CVE-2026-59848 | 2 Libssh, Redhat | 4 Libssh, Enterprise Linux, Hardened Images and 1 more | 2026-07-29 | 5.3 Medium |
| A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. | ||||
| CVE-2026-44907 | 1 Facebook | 3 React-server-dom-parcel, React-server-dom-turbopack, React-server-dom-webpack | 2026-07-29 | 7.5 High |
| A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lead to excessive CPU usage; affecting the following packages: react-server-dom-webpack, react-server-dom-parcel, react-server-dom-turbopack (versions 19.0.0 through 19.0.7, 19.1.0 through 19.1.8, and 19.2.0 through 19.2.7). | ||||
| CVE-2026-24232 | 1 Nvidia | 1 Transformers4rec | 2026-07-29 | 4.3 Medium |
| NVIDIA Tranformers4Rec contains a vulnerability where an attacker could cause improper deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, and information disclosure. | ||||