Export limit exceeded: 379220 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (379220 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13075 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 6.5 Medium |
| An authenticated user can cause the mongod process to be terminated by the operating system under memory pressure via the $rankFusion and $scoreFusion aggregation stages. The issue originates in the server's error-handling path and requires the ability to run aggregation queries. | ||||
| CVE-2026-13076 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 6.5 Medium |
| An authenticated user can cause a {{mongod}} process to be terminated by the operating system under memory pressure by performing a specific data type conversion operation within MongoDB's aggregation framework. The behavior stems from disproportionate memory consumption during this operation, and requires both write access to the database and the ability to run aggregation queries. | ||||
| CVE-2026-13077 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 7.1 High |
| A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents. | ||||
| CVE-2026-71573 | 2026-08-18 | N/A | ||
| Joomla! Core - [20260802] - Improper CORS origin validation in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper implementation prevented configured CORS origins from being properly validated in CORS requests. | ||||
| CVE-2026-72531 | 2026-08-18 | N/A | ||
| Joomla! Core - [20260804] - Improper ACL checks for custom fields webservice endpoints in Joomla 4.0.0-5.4.7, 6.0.0-6.1.2 - An improper access check allows unauthorized users to create fields for inaccessible components. | ||||
| CVE-2026-13078 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-08-18 | 7.7 High |
| A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod process's privileges. An authenticated user could exploit this through crafted aggregation pipeline commands to read sensitive files accessible to the MongoDB server process. | ||||
| CVE-2026-50185 | 1 Rustcrypto | 2 Cmov, Utils | 2026-08-18 | 3.3 Low |
| RustCrypto CMOV provides conditional move CPU intrinsics which are guaranteed on major platforms to execute in constant-time and not be rewritten as branches by the compiler. From 0.1.1 until 0.5.4, the aarch64 implementations of Cmov and CmovEq in cmov/src/backends/aarch64.rs assume high bits are zero-extended when loading values smaller than a register, so set high bits such as [8..] in a Cmov selector or [16..] of self or other in the u16 and i16 CmovEq implementations can cause left.cmovz(&right, condition) to produce incorrect output. This issue is fixed in version 0.5.4. | ||||
| CVE-2026-35616 | 1 Fortinet | 1 Forticlientems | 2026-08-18 | 9.1 Critical |
| A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized code or commands via crafted requests. | ||||
| CVE-2026-28984 | 1 Apple | 1 Ios And Ipados | 2026-08-18 | 4.3 Medium |
| The issue was addressed with improved memory handling. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10. Processing maliciously crafted web content may lead to an unexpected Safari crash. | ||||
| CVE-2026-32465 | 2 G5theme, Wordpress | 2 Essential Real Estate, Wordpress | 2026-08-18 | 8.8 High |
| Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions. | ||||
| CVE-2026-66627 | 2026-08-18 | 9.9 Critical | ||
| Contributor Arbitrary File Upload in GP Premium <= 2.5.5 versions. | ||||
| CVE-2026-32481 | 2 Ezoic, Wordpress | 2 Ezoic, Wordpress | 2026-08-18 | 7.5 High |
| Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions. | ||||
| CVE-2026-32549 | 2 Codexpert, Wordpress | 2 Thumbpress, Wordpress | 2026-08-18 | 7.5 High |
| Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. | ||||
| CVE-2026-73343 | 2 Aresit, Wordpress | 2 Wp Compress, Wordpress | 2026-08-18 | 10 Critical |
| Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | ||||
| CVE-2026-73350 | 2 Psm Plugins, Wordpress | 2 Supportcandy, Wordpress | 2026-08-18 | 8.2 High |
| Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions. | ||||
| CVE-2026-66046 | 1 Libexpat Project | 1 Libexpat | 2026-08-18 | 7.5 High |
| Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with non-normalized values triggers an O(N^2) linear scan of elementType->defaultAtts to determine CDATA status. A remote unauthenticated attacker can supply a single well-formed XML document of a few megabytes to an application parsing untrusted XML to cause excessive CPU consumption, resulting in denial of service without requiring authentication, external entity resolution, or non-default parser options. | ||||
| CVE-2026-47632 | 1 Microsoft | 2 Azure Connected Machine Agent, Azure Monitor Agent Metrics Extension | 2026-08-18 | 8.8 High |
| Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-20757 | 1 Gallagher | 1 Command Centre | 2026-08-18 | 2.5 Low |
| Improper Locking vulnerability (CWE-667) in Gallagher Morpho integration allows a privileged operator to cause a limited denial-of-service in the Command Centre Server. This issue affects Command Centre Server: 9.40 prior to vEL9.40.1976(MR1), 9.30 prior to vEL9.30.3382 (MR4), 9.20 prior to vEL9.20.3783 (MR6), 9.10 prior to vEL9.10.4647 (MR9), all versions of 9.00 and prior. | ||||
| CVE-2026-26053 | 1 Gallagher | 1 Command Centre | 2026-08-18 | 5.3 Medium |
| An Incorrect Privilege Assignment (CWE-266) vulnerability in the Command Centre Server allows an authenticated operator with limited privileges to perform some operations that they would not normally be authorized to perform. Version of Command Centre affected: 9.50 prior to vEL9.50.1587(MR1), 9.40 prior to vEL9.40.3130(MR3), 9.30 prior to vEL9.30.3983(MR5), 9.20 prior to vEL9.20.4349(MR7), all versions of 9.10. | ||||
| CVE-2026-46420 | 1 Shivammathur | 2 Setup-php, Setup Php | 2026-08-18 | 5.6 Medium |
| setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1, shivammathur/setup-php resolves the PHP version from repository-controlled files such as .php-version, composer.lock through platform-overrides.php, and composer.json through config.platform.php, and insufficiently constrains those values before incorporating them into generated shell or PowerShell setup scripts, allowing command injection on a GitHub Actions runner when workflows such as pull_request_target check out attacker-controlled contents before invoking setup-php. This issue is fixed in version 2.37.1. | ||||