Export limit exceeded: 400204 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400204 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-53988 | 1 Finsys | 1 Dockhand | 2026-09-30 | 10 Critical |
| Dockhand before 1.0.40 contains an authentication bypass vulnerability in its git webhook endpoints that allows unauthenticated remote attackers to trigger arbitrary stack redeployments by exploiting a null webhook secret guard condition. Attackers can enumerate sequential stack IDs and send unsigned webhook requests to force git clone and docker compose operations, enabling denial of service or, when combined with write access to the tracked git branch, container escape and full host compromise via attacker-controlled docker-compose.yml with privileged bind mounts. | ||||
| CVE-2026-102877 | 1 Getfider | 1 Fider | 2026-09-30 | 4.4 Medium |
| Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints. | ||||
| CVE-2026-102878 | 1 Hangwin | 1 Mcp-chrome-bridge | 2026-09-30 | 8.1 High |
| mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture. | ||||
| CVE-2026-102879 | 1 Claraverse-space | 1 Claraverse | 2026-09-30 | 5 Medium |
| ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata endpoints. | ||||
| CVE-2026-94204 | 1 Viidure | 1 Dashcam Android Application | 2026-09-30 | 7.5 High |
| The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet. | ||||
| CVE-2026-96587 | 1 Viidure | 1 Dashcam Android Application | 2026-09-30 | 10 Critical |
| The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries. | ||||
| CVE-2026-102925 | 2 Pypa, Python | 2 Virtualenv, Virtualenv | 2026-09-30 | 7.8 High |
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate.fish scripts place values already escaped by shlex.quote inside an additional quoted context. In the bash and zsh script, a crafted virtual environment path reaches __VIRTUAL_ENV__ when a relocated environment's recorded directory is absent; in the fish script, crafted Tcl or Tk library paths reach __TCL_LIBRARY__ or __TK_LIBRARY__. The surplus quotes can terminate the data-only quoted run and leave shell metacharacters parsed as commands when a user sources the activation script, allowing code execution with that user's privileges. This issue is fixed in version 21.7.13. | ||||
| CVE-2026-102930 | 2 Pypa, Python | 2 Virtualenv, Virtualenv | 2026-09-30 | 7.5 High |
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12. | ||||
| CVE-2026-93853 | 1 Enterprisedb | 1 Barman | 2026-09-30 | N/A |
| Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the backup.info file and passes them to the cloud provider's delete API using Barman's own credentials, without verifying that the snapshots belong to that backup. An attacker who can overwrite backup.info but lacks snapshot delete permissions can substitute the identifiers of other snapshots, causing Barman to delete any snapshot its cloud identity can reach on AWS, Microsoft Azure, or Google Cloud. Exploitation requires a deployment where the principal that writes the backup catalog is separate from the identity Barman uses to delete snapshots. Barman versions from 3.4.0 (Google Cloud), 3.6.0 (Azure), and 3.7.0 (AWS) up to and including 3.20.0 are affected. The issue is fixed in Barman 3.20.1. | ||||
| CVE-2026-102937 | 2 Pypa, Python | 2 Virtualenv, Virtualenv | 2026-09-30 | N/A |
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, BatchActivator.quote() returns prompt text unchanged before activate.bat inserts it into a cmd.exe set "VAR=value" statement. An attacker who influences --prompt, VIRTUALENV_PROMPT, or the corresponding configuration value can include a double quote that closes the assignment and leaves following cmd.exe operators as executable syntax. When a user activates the generated Windows environment, the injected commands run with that user's privileges. This issue is fixed in version 21.7.12. | ||||
| CVE-2026-102938 | 2 Pypa, Python | 2 Virtualenv, Virtualenv | 2026-09-30 | N/A |
| virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11. | ||||
| CVE-2026-84409 | 1 Lantronix | 1 G520 Series | 2026-09-30 | 7.5 High |
| The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that value directly into the page as HTML. This behavior allows attacker‑controlled metadata to be interpreted as script content. In addition, the same authenticated origin provides an interface capable of executing system‑level commands with root privileges. An attacker able to influence update metadata could exploit these conditions to execute arbitrary code within the administrative context of the device. | ||||
| CVE-2026-91191 | 1 Lantronix | 1 G520 Series | 2026-09-30 | 7.5 High |
| The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system. Even if signature enforcement is restored, the exposed production key enables an attacker to generate signatures that the device will continue to trust. An attacker who can supply a malicious package may be able to execute arbitrary code with root privileges during installation. | ||||
| CVE-2026-71379 | 1 Toptech Systems | 2 Tms7, Tophat | 2026-09-30 | 10 Critical |
| The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request. | ||||
| CVE-2026-70356 | 1 Toptech Systems | 2 Tms7, Tophat | 2026-09-30 | 9.1 Critical |
| The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server. | ||||
| CVE-2026-72510 | 1 Toptech Systems | 2 Tms7, Tophat | 2026-09-30 | 9 Critical |
| The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injection. | ||||
| CVE-2026-63713 | 1 Toptech Systems | 2 Tms7, Tophat | 2026-09-30 | 9 Critical |
| The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind SQL injection vulnerability. | ||||
| CVE-2026-68954 | 1 Toptech Systems | 2 Tms7, Tophat | 2026-09-30 | 9 Critical |
| The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blind SQL injection vulnerability. | ||||
| CVE-2026-68068 | 1 Toptech Systems | 2 Tms7, Tophat | 2026-09-30 | 9 Critical |
| The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is susceptible to a time-based blind SQL injection vulnerability. | ||||
| CVE-2026-72507 | 1 Toptech Systems | 2 Tms7, Tophat | 2026-09-30 | 9 Critical |
| The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to a time-based blind SQL injection vulnerability. | ||||