Export limit exceeded: 376587 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376587 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-68416 | 1 Linux | 1 Linux Kernel | 2026-08-12 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: mtd: fix double free and WARN_ON in add_mtd_device() error paths When device_register() or mtd_nvmem_add() fails inside add_mtd_device() for a partition, the error handling triggers mtd_release() via put_device() or device_unregister(). mtd_release() calls release_mtd_partition() which frees the mtd_info structure. However, callers such as mtd_add_partition() and add_mtd_partitions() also call free_partition() in their error paths, resulting in a double free. Additionally, release_mtd_partition() hits WARN_ON(!list_empty( &mtd->part.node)) because the partition node is still linked in the parent's partitions list when the release callback fires from the add_mtd_device() error path. Fix this by overriding dev->type and dev->release before put_device() in the error paths, so that device_release() invokes a no-op function instead of mtd_release(). For the mtd_nvmem_add() failure case, device_unregister() is replaced with device_del() to separate the device removal from the final kobject reference drop, allowing the override to take effect before put_device() is called. The callers' error paths (list_del + free_partition) remain the sole owners of mtd_info lifetime on add_mtd_device() failure, which is the expected contract. The normal partition teardown path is not affected: del_mtd_device() goes through kref_put() -> mtd_device_release() -> device_unregister() with dev->type still set to &mtd_devtype, so mtd_release() -> release_mtd_partition() continues to work correctly for the regular removal case. | ||||
| CVE-2026-68423 | 1 Linux | 1 Linux Kernel | 2026-08-12 | 5.7 Medium |
| In the Linux kernel, the following vulnerability has been resolved: mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy() mtd_concat_destroy() frees item->concat so calling mtd_virt_concat_put_mtd_devices(item->concat) after that leads to a use-after-free. Fix it by moving mtd_virt_concat_put_mtd_devices() before mtd_concat_destroy(). | ||||
| CVE-2026-68427 | 1 Linux | 1 Linux Kernel | 2026-08-12 | 7.0 High |
| In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix use-after-free in host1x_bo_clear_cached_mappings __host1x_bo_unpin() drops the last reference to the mapping and frees it, so we can't dereference mapping afterwards. The cache itself outlives the mapping, so use the cache local variable instead. | ||||
| CVE-2026-73285 | 1 Rustfs | 1 Rustfs | 2026-08-12 | 7.5 High |
| RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.64 until 1.0.0-rc.1, RustFS external OPA authorization enabled by RUSTFS_POLICY_PLUGIN_URL in crates/iam/src/sys.rs sets PreparedIamAuth.needs_existing_object_tag incorrectly for PreparedIamMode::Opa, causing maybe_merge_object_tag_conditions to omit s3:ExistingObjectTag/* values and allowing authenticated users to bypass tag-based policy restrictions. This issue is fixed in version 1.0.0-rc.1. | ||||
| CVE-2026-66376 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 4.2 Medium |
| Credentials for a deleted user may remain valid for a short period under specific conditions. | ||||
| CVE-2026-73299 | 1 Microsoft | 1 Prompty | 2026-08-12 | 10 Critical |
| Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could traverse constructor and prototype properties to execute JavaScript in the host Node.js process. This issue is fixed in versions 0.1.5 and 2.0.0-beta.5. | ||||
| CVE-2026-42018 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 7.5 High |
| JFrog Artifactory could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources. | ||||
| CVE-2026-69106 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 8.8 High |
| A low-privileged user may poison cached artifact metadata under specific conditions, potentially causing consumers to retrieve untrusted content. | ||||
| CVE-2026-10545 | 1 Ibm | 1 Planning Analytics Local | 2026-08-12 | 7.5 High |
| IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions. | ||||
| CVE-2026-13361 | 1 Ibm | 1 Informix Dynamic Server | 2026-08-12 | 8.8 High |
| IBM Informix oninit sq_sgkprepare RCE via unchecked SQL Interface length field. | ||||
| CVE-2026-12005 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-08-12 | 7.2 High |
| IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a input validation vulnerability in the management interface that allows already privileged attackers to execute additional operations by crafting a malicious HTTP request. | ||||
| CVE-2025-13394 | 1 Wso2 | 56 Api Control Plane, Api Manager, Enterprise Integrator and 53 more | 2026-08-12 | 5.4 Medium |
| The Ajax processor within the Carbon console fails to adequately protect state-changing operations from Cross-Site Request Forgery (CSRF) attacks. Specifically, it utilizes the HTTP GET method for these operations, and while the SameSite=Lax cookie attribute is employed for mitigation, this mechanism is bypassed as it permits cookies to be sent with cross-origin top-level navigation requests, including GET requests. This allows an attacker to trick an authenticated user's browser into unknowingly executing unintended actions. An attacker can exploit this vulnerability to perform unauthorized state-altering requests on behalf of authenticated users. This could lead to consequences such as data modification, account changes, or other actions that could result in data compromise or loss of user control over their account. However, this attack is only feasible if the Carbon console and related services are exposed to the public internet, which is not recommended according to WSO2's security guidelines. | ||||
| CVE-2026-19643 | 1 Aws | 1 Aws-sdk-cpp | 2026-08-12 | 5.3 Medium |
| An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticated user to crash an application that processes crafted Base64-encoded input. To remediate this issue, users should upgrade to version 1.11.862. | ||||
| CVE-2026-66380 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 4.3 Medium |
| An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions. | ||||
| CVE-2026-68755 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 4.3 Medium |
| A bundle writer may create misleading release promotion information under specific conditions. | ||||
| CVE-2026-66382 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 4.3 Medium |
| An authenticated user may write files outside the intended Artifactory work directory under specific conditions. | ||||
| CVE-2026-70547 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 4.3 Medium |
| An authenticated user without repository read permission may access package metadata under specific conditions. | ||||
| CVE-2026-65938 | 1 Progress Software | 1 Whatsup Gold | 2026-08-12 | 4.3 Medium |
| In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions. | ||||
| CVE-2026-49467 | 1 Smp46 | 1 Pingvin-share-x | 2026-08-12 | 8.8 High |
| Pingvin Share X is a secure and easy self-hosted file sharing platform. A vulnerability in versions 1.5.0 through 1.18.0 allow an attacker to bypass password verification when managing Time-based One-Time Password (TOTP) settings. The root cause is a missing `await` keyword on calls to the asynchronous `verifyPassword` method in `authTotp.service.ts` and the `authenticateUser` method in `auth.service.ts`. In JavaScript, an unawaited `Promise` is always truthy. So the logic intended to throw a `ForbiddenException` when a password is incorrect. It never executes because the expression evaluates the existence of the `Promise` object rather than its resolved boolean result. The vulnerability is fixed in version 1.18.1 by ensuring all asynchronous authentication calls are properly awaited. There are no official workarounds. If a user is locked out, an administrator must manually reset the user's TOTP status in the database. | ||||
| CVE-2026-44741 | 1 Pimcore | 1 Pimcore | 2026-08-12 | 8.8 High |
| Pimcore's Admin Classic Bundle provides a Backend UI for Pimcore. Versions prior to 2.3.6 and 1.7.18 have a SQL injection vulnerability in Pimcore's translation grid date filter — the user-supplied `property` field from the filter JSON is interpolated directly into a `UNIX_TIMESTAMP(DATE(FROM_UNIXTIME(...)))` SQL expression without parameterization or allowlist validation. Versiosn 2.3.6 and 1.7.18 fix the issue. | ||||