Export limit exceeded: 372088 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 372088 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372088 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-69937 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. | ||||
| CVE-2025-69933 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. | ||||
| CVE-2025-69936 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. | ||||
| CVE-2025-69935 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter. | ||||
| CVE-2026-48815 | 1 Sigstore | 1 Sigstore | 2026-07-30 | 7.5 High |
| sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 4.1.1, the documented certificateOIDs option in sigstore.verify() is accepted by the public API but discarded before verification, so required certificate extension OIDs are never checked and applications relying on certificateOIDs to restrict which certificates may sign artifacts can accept unauthorized certificates. This issue is fixed in version 4.1.1. | ||||
| CVE-2026-48758 | 1 Sigstore | 1 Sigstore | 2026-07-30 | 5.4 Medium |
| sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1. | ||||
| CVE-2026-48816 | 1 Sigstore | 1 Sigstore | 2026-07-30 | 6.5 Medium |
| sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.1.1, @sigstore/verify derives a transparency-log timestamp from tlogEntries[].integratedTime for bundle v0.2 inclusionProof-only entries even though the inclusion proof path does not cryptographically bind integratedTime, allowing an attacker who can supply an untrusted bundle to influence certificate validity and timestampThreshold verification decisions. This issue is fixed in version 3.1.1. | ||||
| CVE-2026-36590 | 1 Emqx | 1 Nanomq | 2026-07-30 | 7.5 High |
| An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c component | ||||
| CVE-2025-69934 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1. | ||||
| CVE-2026-15583 | 1 Grafana | 1 Grafana Mcp Server | 2026-07-30 | 8.6 High |
| A confused-deputy flaw in Grafana MCP Server allows an unauthenticated remote attacker to exfiltrate the server's environment-configured Grafana service-account token by supplying a crafted X-Grafana-URL request header. This also enables SSRF against arbitrary internal services, including cloud metadata endpoints. | ||||
| CVE-2026-45793 | 1 Getcomposer | 1 Composer | 2026-07-30 | 7.5 High |
| Composer is a dependency Manager for the PHP language. Prior to 1.10.28, 2.2.28, and 2.9.8, Composer\IO\BaseIO::loadConfiguration() validates GitHub OAuth tokens with the regex ^[.A-Za-z0-9_]+$ and interpolates rejected tokens into an UnexpectedValueException; GitHub Actions GITHUB_TOKEN values using the ghs_<id>_<base64url-JWT> format can contain -, fail validation, and be disclosed to stderr or CI logs. This issue is fixed in versions 1.10.28, 2.2.28, and 2.9.8. | ||||
| CVE-2026-40952 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location. | ||||
| CVE-2026-40953 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control. | ||||
| CVE-2026-40954 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client | ||||
| CVE-2026-40955 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client. | ||||
| CVE-2026-40956 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak. | ||||
| CVE-2026-40957 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator. | ||||
| CVE-2026-40958 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client. | ||||
| CVE-2026-50144 | 1 Tencent | 1 Ncnn | 2026-07-30 | 7.1 High |
| ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020. | ||||
| CVE-2026-33443 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server. | ||||