Export limit exceeded: 378623 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (378623 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75059 | 2026-08-17 | 4.4 Medium | ||
| In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible | ||||
| CVE-2026-75056 | 2026-08-17 | 7.8 High | ||
| In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible | ||||
| CVE-2026-75055 | 2026-08-17 | 5.5 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE | ||||
| CVE-2026-75053 | 2026-08-17 | 5.4 Medium | ||
| In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint | ||||
| CVE-2026-75050 | 2026-08-17 | 7.1 High | ||
| In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters | ||||
| CVE-2026-75049 | 2026-08-17 | 6.5 Medium | ||
| In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint | ||||
| CVE-2026-75048 | 2026-08-17 | 8.2 High | ||
| In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible | ||||
| CVE-2026-75046 | 2026-08-17 | 4.3 Medium | ||
| In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint | ||||
| CVE-2026-75044 | 2026-08-17 | 8.1 High | ||
| In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint | ||||
| CVE-2026-74794 | 1 Scriban | 1 Scriban | 2026-08-17 | 7.5 High |
| Scriban before 6.6.0 contains an infinite recursion vulnerability in object rendering when the ObjectRecursionLimit property defaults to unlimited. Attackers can supply circular reference objects to the template context, exhausting stack space and triggering an uncatchable StackOverflowException that terminates the hosting process. | ||||
| CVE-2026-74788 | 1 Scriban | 1 Scriban | 2026-08-17 | 7.5 High |
| Scriban before 7.0.0 (affected versions <= 6.6.0) contains an uncontrolled memory allocation vulnerability in the string.pad_left and string.pad_right template functions, which perform no validation on the width parameter before delegating to .NET's String.PadLeft/PadRight. When an application exposes Scriban to untrusted template input, an attacker can supply an arbitrarily large width value (e.g., 500,000,000) to trigger ~1GB memory allocations in a single call, resulting in OutOfMemoryException and denial of service. The TemplateContext.LimitToString limit does not prevent this because it is only enforced after the string has been fully allocated. | ||||
| CVE-2026-74783 | 1 Scriban | 1 Scriban | 2026-08-17 | 7.5 High |
| Scriban versions 6.6.0 through 7.2.0 contain a non-enforcing ExpressionDepthLimit guard that fails to stop recursive descent parsing of deeply nested expressions. Attackers can supply templates with deeply nested parentheses, array initializers, object initializers, or unary operators to trigger an uncatchable StackOverflowException that immediately terminates the host process. | ||||
| CVE-2026-73646 | 1 Postcss | 1 Postcss | 2026-08-17 | 7.5 High |
| PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.18. | ||||
| CVE-2026-73058 | 1 Stoatchat | 1 Stoatchat | 2026-08-17 | 5.8 Medium |
| stoatchat versions before 0.15.0 fail to block the IPv6 unspecified address (::) in the SSRF blocklist, allowing unauthenticated attackers to bypass protections via the /proxy and /embed endpoints. Attackers can craft requests using IPv6 literal syntax to access services on the loopback interface and retrieve sensitive internal content. | ||||
| CVE-2026-72888 | 1 Vurtdev | 1 Net-oauth | 2026-08-17 | 6.5 Medium |
| Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require. smart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked. A remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body. | ||||
| CVE-2026-72887 | 1 Vurtdev | 1 Net-oauth | 2026-08-17 | 9.8 Critical |
| Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token. Passing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one. oauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim's provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough. | ||||
| CVE-2026-71947 | 2 D-link, Dlink | 2 Dwr-m961, Dwr-m961 | 2026-08-17 | 9.8 Critical |
| D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in command execution with root privileges. | ||||
| CVE-2026-71491 | 2026-08-17 | N/A | ||
| sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, group_comments in sqlparse/engine/grouping.py repeatedly rescans comment-only statements before the MAX_GROUPING_TOKENS guard, causing quadratic CPU consumption through sqlparse.parse() and sqlparse.format(sql, strip_comments=True). This issue is fixed in version 0.6.0. | ||||
| CVE-2026-2497 | 2 Bestwebsoft, Wordpress | 2 Gallery By Bestwebsoft – Customizable Image And Photo Galleries For Wordpress, Wordpress | 2026-08-17 | 7.2 High |
| The Gallery by BestWebSoft plugin for WordPress is vulnerable to SQL Injection via the '_gallery_order_{post_id}' parameter array keys in all versions up to, and including, 4.7.9. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. The `gllr_save_postdata()` function stores unsanitized array keys from `$_POST` directly into post meta, which are later used in SQL queries without prepared statements. This makes it possible for authenticated attackers, with Editor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. | ||||
| CVE-2026-19956 | 1 Gomarble-ai | 1 Facebook-ads-mcp-server | 2026-08-17 | 6.3 Medium |
| A vulnerability has been found in gomarble-ai facebook-ads-mcp-server 0.1.0. The impacted element is the function fetch_pagination_url of the file server.py. Such manipulation leads to server-side request forgery. The attack can be launched remotely. The name of the patch is 4e53875aa22e8991c2fa4a7660d86e1caba66659. Applying a patch is advised to resolve this issue. | ||||