Export limit exceeded: 372793 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372793 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64806 | 1 Jetbrains | 1 Webstorm | 2026-08-02 | 8.4 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter | ||||
| CVE-2026-64809 | 1 Jetbrains | 1 Phpstorm | 2026-08-02 | 8.4 High |
| In JetBrains PhpStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured interpreter | ||||
| CVE-2026-64810 | 1 Jetbrains | 1 Intellij Idea | 2026-08-02 | 4.3 Medium |
| In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking | ||||
| CVE-2026-64811 | 1 Jetbrains | 1 Intellij Idea | 2026-08-02 | 7.8 High |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code execution was possible before granting project trust via development container configuration | ||||
| CVE-2026-64812 | 1 Jetbrains | 1 Intellij Idea | 2026-08-02 | 10 Critical |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session | ||||
| CVE-2026-64814 | 1 Jetbrains | 1 Intellij Idea | 2026-08-02 | 8.6 High |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | ||||
| CVE-2026-64815 | 1 Jetbrains | 1 Intellij Idea | 2026-08-02 | 8.1 High |
| In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | ||||
| CVE-2026-65908 | 1 Jetbrains | 1 Pycharm | 2026-08-02 | 8.6 High |
| In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open | ||||
| CVE-2026-65907 | 1 Jetbrains | 1 Teamcity | 2026-08-02 | 9.1 Critical |
| In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible | ||||
| CVE-2026-43820 | 1 Apple | 1 Swiftnio Ssl | 2026-08-02 | 7.7 High |
| NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2. | ||||
| CVE-2026-15615 | 1 Logto-io | 1 Logto | 2026-08-02 | 7.5 High |
| Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely. | ||||
| CVE-2026-15611 | 1 Logto-io | 1 Logto | 2026-08-02 | 9.1 Critical |
| Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account. | ||||
| CVE-2026-44909 | 1 Facebook | 1 Proxygen | 2026-08-02 | 7.5 High |
| Proxygen lacked a generalized slow-consumer detection mechanism in its core HTTP session layer. A remote, unauthenticated attacker could exploit HTTP/2 flow-control by setting SETTINGS_INITIAL_WINDOW_SIZE to 0 or withholding WINDOW_UPDATE frames, causing the server to buffer complete response bodies in memory indefinitely for stalled streams. By opening many simultaneous streams requesting large resources while preventing the server from transmitting responses, an attacker could induce unbounded memory growth leading to service degradation, resource exhaustion, or denial of service. Versions v2017.01.16.00 through v2026.07.20.00 are affected. | ||||
| CVE-2026-15630 | 1 Casdoor | 1 Casdoor | 2026-08-02 | 9.9 Critical |
| A non-global organization admin in one tenant can bypass tenant boundaries to delete, create, or modify resources in any other tenant by exploiting a mismatch between authorization (based on ?id=) and action (based on request body). | ||||
| CVE-2026-12702 | 1 Octopus | 1 Octopus Server | 2026-08-02 | N/A |
| In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment. | ||||
| CVE-2026-16800 | 1 Devolutions | 1 Powershell Universal | 2026-08-02 | 8.8 High |
| Improper control of generation of code ('Code Injection') in the schedule feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to execute arbitrary PowerShell code via crafted schedule parameter names concatenated into a script invocation. | ||||
| CVE-2026-16801 | 1 Devolutions | 1 Powershell Universal | 2026-08-02 | N/A |
| Improper control of generation of code ('Code Injection') in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with variable write permission to execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the variables configuration file. | ||||
| CVE-2026-16802 | 1 Devolutions | 1 Powershell Universal | 2026-08-02 | N/A |
| Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected. | ||||
| CVE-2026-64211 | 1 Linux | 1 Linux Kernel | 2026-08-02 | N/A |
| In the Linux kernel, the following vulnerability has been resolved: srcu: Don't queue workqueue handlers to never-online CPUs While an srcu_struct structure is in the midst of switching from CPU-0 to all-CPUs state, it can attempt to invoke callbacks for CPUs that have never been online. Worse yet, it can attempt in invoke callbacks for CPUs that never will be online, even including imaginary CPUs not in cpu_possible_mask. This can cause hangs on s390, which is not set up to deal with workqueue handlers being scheduled on such CPUs. This commit therefore causes Tree SRCU to refrain from queueing workqueue handlers on CPUs that have not yet (and might never) come online. Because callbacks are not invoked on CPUs that have not been online, it is an error to invoke call_srcu(), synchronize_srcu(), or synchronize_srcu_expedited() on a CPU that is not yet fully online. However, it turns out to be less code to redirect the callbacks from too-early invocations of call_srcu() than to warn about such invocations. This commit therefore also redirects callbacks queued on not-yet-fully-online CPUs to the boot CPU. | ||||
| CVE-2026-64212 | 1 Linux | 1 Linux Kernel | 2026-08-02 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the function so we have it after we freed the link. But the link pointer can be NULL, and is not checked when the fw_id is stored. Fix it by simply freeing the link at the end of the function. fFixes: 0e66a39f4f0e ("wifi: iwlwifi: fix potential use after free in iwl_mld_remove_link()") | ||||