Export limit exceeded: 373001 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (373001 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48323 | 2026-08-03 | 10 Critical | ||
| Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48330 | 2026-08-03 | 10 Critical | ||
| Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary SQL commands, potentially gaining elevated access or control over the application. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48399 | 2026-08-03 | 7.5 High | ||
| Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48326 | 2026-08-03 | 9.9 Critical | ||
| Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-52521 | 1 Zblogcn | 1 Zblogphp | 2026-08-03 | N/A |
| A SQL injection vulnerability in Z-BlogPHP 1.7.5 allows authenticated attackers to execute arbitrary SQL commands via the id parameter in the CommentBat feature. | ||||
| CVE-2026-48061 | 1 Litestar-org | 1 Litestar | 2026-08-03 | 5.9 Medium |
| Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. In versions prior to 2.22.0, an attacker can bypass the allowed hosts validation by omitting the Host header and supplying an X-Forwarded-Host header set to a whitelisted domain. The AllowedHostsMiddleware trusts the X-Forwarded-Host header as a fallback when the Host header is absent. Since X-Forwarded-Host is a client-controllable header, this enables host header injection attacks such as password reset poisoning, cache poisoning, and server-side request routing manipulation. Any application using AllowedHostsConfig is affected when deployed without a reverse proxy that strips X-Forwarded-Host, or when accepting HTTP/1.0 connections. This issue has been fixed in version 2.22.0. | ||||
| CVE-2026-48113 | 1 Jpillora | 1 Chisel | 2026-08-03 | N/A |
| Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.11.5, authenticated clients can bypass --authfile ACL restrictions and tunnel traffic to arbitrary destinations reachable from the server. The ACL is enforced only during the initial handshake against declared remotes, but never on subsequent SSH channels that carry actual traffic. A malicious client can authenticate with a permitted remote, then open channels to any host:port it wants. This issue has been fixed in version 1.11.5. | ||||
| CVE-2026-69248 | 1 Pyca | 1 Cryptography | 2026-08-03 | N/A |
| cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 49.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0. | ||||
| CVE-2026-18667 | 2026-08-03 | 9.6 Critical | ||
| A vulnerability in Tenable Sensor Proxy allows a remote attacker to execute code with elevated privileges by inducing an operator to connect the sensor to an attacker-controlled host. | ||||
| CVE-2026-48864 | 2 Opensuse, Redhat | 17 Libsolv, Discovery, Enterprise Linux and 14 more | 2026-08-03 | 7.8 High |
| A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service. | ||||
| CVE-2026-13757 | 2 P11-kit Project, Redhat | 6 P11-kit, Enterprise Linux, Hardened Images and 3 more | 2026-08-03 | 6.2 Medium |
| A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. | ||||
| CVE-2026-46714 | 2026-08-03 | N/A | ||
| Misskey is an open source, federated social media platform. IVersions 8.63.0 and later, but prior to 2026.5.4, contain a vulnerability that can cause the Misskey web client to slow down or crash when it applies a malformed theme. This issue has been fixed in version 2026.5.4. | ||||
| CVE-2026-64800 | 1 Jetbrains | 1 Goland | 2026-08-03 | 3.5 Low |
| In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default | ||||
| CVE-2026-64805 | 1 Jetbrains | 1 Webstorm | 2026-08-03 | 8.4 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via project-local package-manager tooling | ||||
| CVE-2026-64806 | 1 Jetbrains | 1 Webstorm | 2026-08-03 | 8.4 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible before granting project trust via the configured Node.js interpreter | ||||
| CVE-2026-64807 | 1 Jetbrains | 1 Webstorm | 2026-08-03 | 7.8 High |
| In JetBrains WebStorm before 2026.2 arbitrary code execution was possible via a project-supplied linter configuration | ||||
| CVE-2026-64812 | 1 Jetbrains | 1 Intellij Idea | 2026-08-03 | 10 Critical |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized input injection was possible in a Remote Development session | ||||
| CVE-2026-64813 | 1 Jetbrains | 1 Intellij Idea | 2026-08-03 | 10 Critical |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized settings modification was possible in a Remote Development session | ||||
| CVE-2026-64814 | 1 Jetbrains | 1 Intellij Idea | 2026-08-03 | 8.6 High |
| In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session | ||||
| CVE-2026-65906 | 1 Jetbrains | 1 Teamcity | 2026-08-03 | 8.8 High |
| In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | ||||