Export limit exceeded: 371163 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371163 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56624 | 1 Apache | 1 Mina Sshd | 2026-07-28 | 7.3 High |
| Improper certificate validation in Apache MINA SSHD (server-side). Apache MINA SSHD is a Java library for client-side and server-side SSH. Server-side OpenSSH user certificate validation during user authentication in an Apache MINA SSHD server did not check for the unsupported force-command or verify-required options that could be embedded in the certificate, nor did it validate these options. As a result it was possible that a user could authenticate with such a certificate that included a force-command option but still was able to execute other commands. What other command exactly would be available to the user depends on the implementation of the server. This issue is fixed in Apache MINA SSHD 2.19.0 and 3.0.0-M5. Applications are advised to upgrade to these versions. The fix rejects OpenSSH user certificates that include these options, since Apache MINA SSHD implements neither force-command nor sk-*-cert-v01@openssh.com user certificates (which are the only ones for which verify-required would make sense). | ||||
| CVE-2026-47255 | 1 Agenticmail | 2 Agenticmail, Api | 2026-07-28 | 8.2 High |
| AgenticMail gives AI agents real email addresses and phone numbers. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 had weakness related to validation and and binding of inactive-agent hour filtering; storage SQL identifier validation; metadata-backed ownership checks for raw storage SQL; blocking direct storage metadata access through raw SQL; fail-closed outbound worker secret handling; SMTP envelope/header control-character validation before command construction; and TLS certificate verification as the default for MailSender with an explicit opt-out for local development. @agenticmail/api prior to version 0.9.32 and @agenticmail/core prior to version 0.9.10 are patched. | ||||
| CVE-2026-57494 | 1 Agenticmail | 1 Api | 2026-07-28 | N/A |
| AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail agent can enumerate another agent's pending/claimed tasks by supplying the target agent name to `GET /api/agenticmail/tasks/pending?assignee=<name>`. The returned task objects include the task IDs and payloads. The same task IDs can then be used with the capability-style task mutation endpoints (`/tasks/:id/claim`, `/tasks/:id/result`, `/tasks/:id/complete`, `/tasks/:id/fail`) to claim, complete, or fail tasks assigned to a different agent. Because ordinary authenticated agents can discover agent names through `GET /api/agenticmail/accounts/directory`, the task ID effectively stops being a secret capability. This turns the intended capability model into a cross-agent authorization bypass. Version 0.9.64 contains a fix. | ||||
| CVE-2026-57495 | 1 Agenticmail | 4 Agenticmail, Claudecode, Codex and 1 more | 2026-07-28 | N/A |
| AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71, two inbound-mail handlers act on a privileged effect without verifying that the sender is the operator, while a sibling handler in the same repo does. The higher-impact one: any external email routed to the bridge inbox causes the dispatcher to resume the operator's Claude Code session with `permissionMode: 'bypassPermissions'`, embedding the attacker-controlled `from`/`subject`/`preview` verbatim into the prompt the resumed agent reads — an indirect prompt injection into a fully-privileged agent (Bash/Write/Edit/WebFetch + the agenticmail MCP toolbelt) running as the operator's OAuth identity. The sibling operator-query email-reply hook gates the same untrusted-From provenance with `isOperatorReplySender(replyFrom, config.operatorEmail)` (fail-closed); the bridge-wake path — a strictly higher-privilege effect — has no equivalent. @agenticmail/claudecode 0.2.39, @agenticmail/codex 0.1.33, @agenticmail/core 0.9.43, and @agenticmail/openclaw 0.5.71 contain a fix. | ||||
| CVE-2026-30631 | 1 Bytebot-ai | 1 Bytebot | 2026-07-28 | 9.8 Critical |
| An issue was discovered in bytebot-ai in commit 3d37894ce07ef8d8b40adc7fd309ad96c2a71313 (2025-09-11) allowing attackers to execute arbitrary code via crafted path to `computer_write_file`. | ||||
| CVE-2026-30633 | 1 Knowns-dev | 1 Knowns | 2026-07-28 | 7.5 High |
| Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted path value to the get_doc and update_doc tools. | ||||
| CVE-2026-30632 | 1 Knowns-dev | 1 Knowns | 2026-07-28 | 7.5 High |
| Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. | ||||
| CVE-2026-16615 | 2 Gnome, Redhat | 2 Librest, Enterprise Linux | 2026-07-28 | 6.8 Medium |
| A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow. | ||||
| CVE-2026-16287 | 1 Tubitak Bilgem Software Technologies Research Institute | 1 Pardus Update | 2026-07-28 | 7.8 High |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-update allows OS Command Injection. This issue affects pardus-update: from 0.6.6 before 0.7.0. | ||||
| CVE-2024-58330 | 1 Bosch | 1 Camera Firmware | 2026-07-28 | 7.5 High |
| A missing authentication check in Bosch IP cameras of families CPP13 and CPP14 allows an unauthenticated attacker to retrieve video analytics event data. | ||||
| CVE-2026-11804 | 1 Tridium | 2 Niagara Enterprise Security, Niagara Framework | 2026-07-28 | 5.2 Medium |
| Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Privilege Abuse. This issue affects Niagara Framework: before 4.14.6, before 4.15.5; Niagara Enterprise Security: before 4.14.6, before 4.15.5. | ||||
| CVE-2026-65760 | 1 Joomshaper.com | 1 Easy Store Extension For Joomla | 2026-07-28 | N/A |
| Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system. | ||||
| CVE-2026-65761 | 1 Joomshaper.com | 1 Easy Store Extension For Joomla | 2026-07-28 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1 - Improper validation of order parameters lead to an unauthenticated SQL injection in easystore, allowing full DB read access including credentials and sessions. | ||||
| CVE-2026-65759 | 1 Joomshaper.com | 1 Easy Store Extension For Joomla | 2026-07-28 | N/A |
| Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 - Critical order and payment information, including states, are processed from client side input, enabling unauthenticated attackers to manipulate payment and order states of arbritrary orders. | ||||
| CVE-2026-65763 | 1 Phoca | 1 Phoca Maps Extension For Joomla | 2026-07-28 | N/A |
| Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Maps 5.0.0-6.0.4 - Improper validation of user inputs lead to a reflective XSS vulnerability. | ||||
| CVE-2026-65762 | 1 Phoca | 1 Phoca Guestbook Extension For Joomla | 2026-07-28 | N/A |
| Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Guestbook 5.0.0-6.1.0 - Improper validation of user inputs lead to a reflective XSS vulnerability. | ||||
| CVE-2026-21655 | 2 Johnson Control, Johnsoncontrols | 2 Victor, Victor | 2026-07-28 | N/A |
| Deserialization of untrusted data vulnerability in Johnson Control victor on Windows allows capec-586. This issue affects victor: from 2.9 before 3.0. | ||||
| CVE-2026-66139 | 1 Openstack | 1 Zaqar | 2026-07-28 | 4.8 Medium |
| OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. | ||||
| CVE-2026-12982 | 2 Dan Rossiter, Wordpress | 2 Document Gallery, Wordpress | 2026-07-28 | 6.1 Medium |
| The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users. | ||||
| CVE-2026-13400 | 2 Nsquared, Wordpress | 2 Simply Schedule Appointments, Wordpress | 2026-07-28 | 6.1 Medium |
| Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply Schedule Appointments WordPress plugin before 1.6.12.4's wp_kses_post() filter, so a double-encoded payload survives intake and is reintroduced as an executable element at render time. | ||||