Export limit exceeded: 371382 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (371382 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56416 | 1 Nlnetlabs | 1 Unbound | 2026-07-28 | 4.8 Medium |
| In NLnet Labs Unbound up to and including version 1.25.1, when the validator builds the canonical RDATA form for an RRSIG-covered PX/RP/MINFO/SOA RRset, it computes the address of the second embedded domain name as 'datstart + dname_valid(datstart, ...)' and passes it straight to 'query_dname_tolower()' without checking that a second name is actually present in the RDATA. The wire-format parser accepts multi-dname RRs whose RDATA ends after the first name, so an attacker who runs a DNSSEC-signed authoritative server can deliver a record with an absent second domain name (e.g. SOA record) and cause 'query_dname_tolower()' to walk label-by-label through stale bytes in the per-worker 'env->scratch_buffer', past the end of that heap allocation if 'msg-buffer-size' has been lowered from the default. This leads to heap buffer overflow and on a release build the outcome relies heavily on the contents of the buffer tail and the adjacent heap chunk. | ||||
| CVE-2026-56444 | 1 Nlnetlabs | 1 Unbound | 2026-07-28 | 5.9 Medium |
| In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. Shipped defaults for 'serve-expired-client-timeout: 1800' and 'discard-timeout: 1900' make the branch unreachable. | ||||
| CVE-2026-13181 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 8.1 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, forged upload metadata can influence AsyncUploadTypeName processing and trigger unsafe attacker-controlled type resolution, enabling remote code execution in affected deployments. | ||||
| CVE-2026-13182 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 7.5 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers. | ||||
| CVE-2026-13183 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 7.5 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload upload metadata processing may leak cryptographic validity through measurable timing differences, enabling remote attackers to recover protected metadata values. | ||||
| CVE-2026-13184 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 7.5 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains. | ||||
| CVE-2026-13185 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 8.1 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution. | ||||
| CVE-2026-13186 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 8.1 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution. | ||||
| CVE-2026-13187 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 8.1 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation. | ||||
| CVE-2026-13188 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 5.9 Medium |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation. | ||||
| CVE-2026-13189 | 1 Progress | 1 Telerik Ui For Asp.net Ajax | 2026-07-28 | 7.5 High |
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests. | ||||
| CVE-2024-58023 | 1 Bosch | 1 Configuration Manager | 2026-07-28 | 8.4 High |
| Information disclosure in Bosch Configuration Manager in Version 7.72.0106 allows an attacker to access sensitive information. | ||||
| CVE-2026-65533 | 2 Wbolt, Wordpress | 2 Smart Seo Tool, Wordpress | 2026-07-28 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. | ||||
| CVE-2026-43820 | 1 Apple | 1 Swiftnio Ssl | 2026-07-28 | 7.7 High |
| NIOSSLCertificate._subjectAlternativeNames provides access to the raw bytes for a cert's SANs. NIOSSL provides access to a buffer assumed to be backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, so accessing the buffer for such a type can lead to out-of-bounds memory access. This vulnerability is addressed in swift-nio-ssl version 2.37.2. | ||||
| CVE-2026-15617 | 1 Logto-io | 1 Logto | 2026-07-28 | 9.1 Critical |
| Logto performs principal lookup without normalizing email and identifier strings, enabling principal collision and unauthorized account access via case- or Unicode-different identities. | ||||
| CVE-2026-15616 | 1 Logto-io | 1 Logto | 2026-07-28 | 9.1 Critical |
| Logto does not enforce locally configured MFA during SSO authentication, allowing users to bypass second-factor requirements and grants unauthorized access. | ||||
| CVE-2026-15615 | 1 Logto-io | 1 Logto | 2026-07-28 | 7.5 High |
| Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely. | ||||
| CVE-2026-15614 | 1 Logto-io | 1 Logto | 2026-07-28 | 7.5 High |
| Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window. | ||||
| CVE-2026-15612 | 1 Logto-io | 1 Logto | 2026-07-28 | 9.1 Critical |
| Logto bypasses OIDC nonce validation when the nonce claim is absent from the id_token, enabling replay of authentication tokens and weakening session-binding. | ||||
| CVE-2026-15611 | 1 Logto-io | 1 Logto | 2026-07-28 | 9.1 Critical |
| Logto allows unverified email-based SSO account linking, enabling an attacker to register an identity at a permissive IdP using a victim’s email and gain unauthorized access to the victim’s account. | ||||