Export limit exceeded: 23280 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (23280 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91931 | 1 Flowiseai | 1 Flowise | 2026-09-17 | 8.5 High |
| Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute arbitrary code by supplying npx package names in the mcpServerConfig parameter. Attackers can invoke npx with attacker-controlled npm packages to execute code on the Flowise server. | ||||
| CVE-2025-10898 | 1 Autodesk | 16 3ds Max, Advance Steel, Autocad and 13 more | 2026-09-17 | 7.8 High |
| AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | ||||
| CVE-2026-8325 | 1 Autodesk | 1 Revit | 2026-09-17 | 7.8 High |
| A maliciously crafted PDF file, when parsed through certain Autodesk products, can force a Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the current process. | ||||
| CVE-2026-75809 | 1 Asus | 1 Armoury Crate | 2026-09-17 | N/A |
| Exposed IOCTL with insufficient access control in ASUS Armoury Crate allows a local user to disclosure information and disabling device functionality by bypassing driver authentication and using IOCTLs to read from and write to PCIe configuration space.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-16004 | 1 Asus | 1 Armoury Crate | 2026-09-17 | N/A |
| Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-16003 | 1 Asus | 1 Armoury Crate | 2026-09-17 | N/A |
| Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to add an arbitrary process identifier to the driver's whitelist via a crafted IOCTL request by bypassing the driver's verification.Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-6737 | 1 Asus | 1 Asusptpfilter | 2026-09-17 | N/A |
| An Exposed IOCTL with Insufficient Access Control vulnerability in AsusPTPFilter allows a local user to bypass driver security mechanisms and obtain restricted touchpad information or render the touchpad unusable via crafted IOCTL requests.Refer to the ' Security Update for ASUS Precision Touchpad ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-92179 | 1 Pdfforge | 1 Pdf Architect | 2026-09-17 | N/A |
| pdfforge PDF Architect PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of pdfforge PDF Architect. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of PDF files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29219. | ||||
| CVE-2026-85168 | 1 N8n | 1 N8n | 2026-09-16 | 8.8 High |
| n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain a remote code execution vulnerability in the Git node. The node reset a fixed list of command-bearing configuration keys before each operation, but that list did not cover the content-filter and merge-driver key families. A repository with local configuration setting one of those keys together with a matching attribute pattern causes git to execute the configured command during an ordinary Add, Commit, Checkout, or Pull operation. The command runs as the n8n process user. | ||||
| CVE-2026-81467 | 1 Dell | 40 Latitude 3330, Latitude 3420, Latitude 3440 and 37 more | 2026-09-16 | 9.8 Critical |
| Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | ||||
| CVE-2026-81468 | 1 Dell | 40 Latitude 3330, Latitude 3420, Latitude 3440 and 37 more | 2026-09-16 | 9.1 Critical |
| Dell ThinOS 10, versions prior to 2605_10. 2616, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution. | ||||
| CVE-2026-82071 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-09-16 | 8.1 High |
| Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supply crafted parameters during collection creation that override internal storage metadata. This results in an out-of-bounds memory write in the server process, causing a denial of service via server crash, with potential for further impact including arbitrary code execution. | ||||
| CVE-2026-92397 | 1 Ruijie | 1 Rg-ew3000gx | 2026-09-16 | 9.1 Critical |
| A vulnerability has been found in Ruijie RG-EW3000GX EW_3.0(1)B11P380. Affected by this vulnerability is the function cc_set of the file unifyframe-sgi.elf of the component configChange. Such manipulation of the argument data.url leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2024-20260 | 1 Cisco | 2 Adaptive Security Appliance Software, Firepower Threat Defense Software | 2026-09-16 | 8.6 High |
| Update for September 16, 2026: The original 1.0 version of this advisory was specific to the Cisco Adaptive Security Virtual Appliance (ASAv) and Cisco Secure Firewall Threat Defense Virtual (FTDv) models. However, it was later found that this vulnerability affects all Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software platforms. A vulnerability in the VPN and management web servers of the Cisco Secure Firewall ASA Software and Cisco Secure FTD Software platforms could allow an unauthenticated, remote attacker to cause an affected device to run out of system memory or buffer blocks, which in turn could cause SSL VPN connection processing to slow down and eventually cease altogether. This vulnerability is due to a lack of proper memory management for new incoming SSL/TLS connections. An attacker could exploit this vulnerability by sending a large number of new incoming SSL/TLS connections to the targeted device. A successful exploit could allow the attacker to deplete system memory or buffers, resulting in a denial of service (DoS) condition. The memory or buffers could be reclaimed slowly if the attack traffic is stopped, but a manual reload may be required to restore operations quickly. | ||||
| CVE-2026-89157 | 1 Pcre | 1 Pcre2 | 2026-09-16 | 5.7 Medium |
| PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. | ||||
| CVE-2026-89158 | 1 Pcre | 1 Pcre2 | 2026-09-16 | 6.5 Medium |
| PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write. | ||||
| CVE-2026-27565 | 3 Carlo Gavazzi, Pepperl Fuchs, Phoenix Contact | 8 Yl212cei8m1io Firmware, Yl212cpn8m1io Firmware, Yn115cei8rpio Firmware and 5 more | 2026-09-16 | 9.8 Critical |
| An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot. | ||||
| CVE-2026-27564 | 3 Carlo Gavazzi, Pepperl Fuchs, Phoenix Contact | 8 Yl212cei8m1io Firmware, Yl212cpn8m1io Firmware, Yn115cei8rpio Firmware and 5 more | 2026-09-16 | 7.2 High |
| A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device. | ||||
| CVE-2026-27561 | 3 Carlo Gavazzi, Pepperl Fuchs, Phoenix Contact | 8 Yl212cei8m1io Firmware, Yl212cpn8m1io Firmware, Yn115cei8rpio Firmware and 5 more | 2026-09-16 | 7.2 High |
| A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device. | ||||
| CVE-2026-27560 | 3 Carlo Gavazzi, Pepperl Fuchs, Phoenix Contact | 8 Yl212cei8m1io Firmware, Yl212cpn8m1io Firmware, Yn115cei8rpio Firmware and 5 more | 2026-09-16 | 7.2 High |
| A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device. | ||||