Export limit exceeded: 372128 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372128 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-58598 | 1 Microsoft | 10 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 7 more | 2026-07-30 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-51080 | 1 Proxmox | 2 Libpve-storage-perl, Libpvestorage-perl | 2026-07-30 | 9.8 Critical |
| libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7 were discovered to contain an XML External Entity (XXE) vulnerability. | ||||
| CVE-2026-51082 | 2 Proxmox, Qemu | 3 Pve-container, Pve-manager, Qemu | 2026-07-30 | 7.2 High |
| A race condition between the vncproxy and vncwebsocket API calls in Proxmox Virtual Environment (PVE) 9.x pve-manager before 9.1.9 and 8.x before 8.4.19; qemu-server 9.x before 9.1.7 and 8.x before 8.4.7; and pve-container before 6.1.3 (PVE 9.x) and before 5.3.4 (PVE 8.x) allows an attacker with privileges to call "vncproxy" to hijack a VNC session that is established in parallel by a different user for a different VM. | ||||
| CVE-2026-51083 | 1 Proxmox | 1 Proxmox | 2026-07-30 | 6.5 Medium |
| Incorrect access control in Proxmox Virtual Environment (PVE) 9.x qemu-server before 9.1.8 and 8.x before 8.4.8 allows users within limited privileges to obtain hashed passwords via the cloudinit/dump API. | ||||
| CVE-2025-51678 | 1 Yosyshq | 1 Picorv32 | 2026-07-30 | 7.5 High |
| An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior. | ||||
| CVE-2026-68501 | 2026-07-30 | 6.5 Medium | ||
| Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's GET /{_locale}/thank-you PageRedirectController::thankYouAction and GET /{_locale}/get-code QrCodeAction::fetchQrCodeFromOrder endpoints look up sequential orderId values without ownership or session checks, exposing order tokenValue values that can be used with GET /{_locale}/register-after-checkout/{tokenValue} to view customer first name, last name, and email. This issue is fixed in 2.2.8, 3.2.4, and 3.3.1. | ||||
| CVE-2026-42168 | 1 Abhishek-ram | 1 Django-pyas2 | 2026-07-30 | 9.1 Critical |
| django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmd_receive and cmd_send fields on the Partner model. These fields are passed directly to os.system() in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when an AS2 message is received or sent. | ||||
| CVE-2026-52348 | 1 Cool-team-official | 1 Cool-admin-java | 2026-07-30 | 9.8 Critical |
| cool-admin-java 8.0.0 has a SQL injection vulnerability in the order() method of CrudOption.java. | ||||
| CVE-2026-63071 | 1 Apache | 1 Syncope | 2026-07-30 | 9.8 Critical |
| Improper Isolation or Compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class containing untrusted code bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.6, from 4.1.0-M0 through 4.1.1. Users are recommended to upgrade to version 4.0.7 / 4.1.2, which fix this issue by tightening the Groovy security sandbox. | ||||
| CVE-2025-66390 | 1 Microsoft | 1 Azure Api Management | 2026-07-30 | 9.8 Critical |
| In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier states that they evaluated the report and determined it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). NOTE: The supplier evaluated this report and determined that it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). | ||||
| CVE-2025-63913 | 1 Luojia65 | 1 Opensbi | 2026-07-30 | 7.5 High |
| An issue was discovered in OpenSBI 1.3 allowing attackers to cause a denial of service via crafted request to the SBI function #2 or the 'Find and configure a matching counter' function of SBI PMU extension. | ||||
| CVE-2026-51564 | 1 Giuliopanda | 1 Milk Admin | 2026-07-30 | 4.9 Medium |
| An issue in the redirect parameter in Milk admin <=0.9.8 allows remote attackers to redirect users to arbitrary external URLs via a crafted request. | ||||
| CVE-2026-51565 | 1 Giuliopanda | 1 Milk Admin | 2026-07-30 | N/A |
| Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request | ||||
| CVE-2026-51244 | 1 Schreibfaul1 | 1 Esp32-audioi2s | 2026-07-30 | 7.5 High |
| schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in UnpackFrameHeader(). Multiple attacker-controlled index parameters are used to access static and heap table arrays without range limitation. Invalid index values lead to out-of-bounds memory writing and heap buffer overflow. | ||||
| CVE-2026-51251 | 1 Schreibfaul1 | 1 Esp32-audioi2s | 2026-07-30 | 7.5 High |
| Schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::decode() function of the MP3 decoder due to missing size validation on untrusted mainDataBegin and nSlots values. | ||||
| CVE-2026-51252 | 1 Schreibfaul1 | 1 Esp32-audioi2s | 2026-07-30 | 9.8 Critical |
| schreibfaul1 ESP32-audioI2S 3.4.5 has a buffer overflow vulnerability in the MP3Decoder::UnpackSFMPEG1 function due to missing input validation on attacker-controlled MP3 metadata. | ||||
| CVE-2026-51261 | 1 Schreibfaul1 | 1 Esp32-audioi2s | 2026-07-30 | 9.8 Critical |
| Missing mutex synchronization in AudioBuffer::freeSpace() in schreibfaul1 ESP32-audioI2S 3.4.5 creates a race condition between concurrent tasks. The function calculates available buffer space without protecting shared read/write pointers, returning an incorrectly large value. Trusting this value leads to heap out-of-bounds write, memory corruption, device crash, and arbitrary code execution. | ||||
| CVE-2026-51266 | 1 Schreibfaul1 | 1 Esp32-audioi2s | 2026-07-30 | 9.8 Critical |
| schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the HTTP request header construction logic. The application dynamically splices attacker-controlled host name, path, query string, and multiple HTTP header fields into a fixed ps_ptr heap buffer without proper size limitation and boundary validation. Remote attackers can use an oversized crafted network request parameter to trigger out-of-bounds heap write, leading to arbitrary code execution. | ||||
| CVE-2026-51268 | 1 Schreibfaul1 | 1 Esp32-audioi2s | 2026-07-30 | 9.8 Critical |
| schreibfaul1 ESP32-audioI2S 3.4.5 has a heap-based buffer overflow vulnerability in the host parsing logic. The dismantle_host() function parses untrusted host and URL input, and subsequent code uses clone_from() to copy parsed host, request host, extension and query_string segments into fixed heap buffers without boundary checking. | ||||
| CVE-2026-51271 | 1 Schreibfaul1 | 1 Esp32-audioi2s | 2026-07-30 | 9.6 Critical |
| In schreibfaul1 ESP32-audioI2S 3.4.5, a heap-based buffer overflow vulnerability exists in the WAV header parsing function read_WAV_Header(). The function reads untrusted chunk size and bytes-to-skip value directly from malicious WAV files without reasonable range restriction. Abnormally large bts and headerSize values lead to out-of-bounds heap memory read/write during header parsing, which can be exploited to execute arbitrary code, disclose sensitive information, cause denial of service or escalate privileges. | ||||