Export limit exceeded: 372510 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 372510 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372510 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17736 | 1 Google | 1 Chrome | 2026-07-30 | 5.8 Medium |
| Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-12943 | 1 Ibm | 2 Hmc V10310500, Hmc V11111100 | 2026-07-30 | 9.8 Critical |
| IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. | ||||
| CVE-2026-17986 | 1 Google | 1 Chrome | 2026-07-30 | 6.5 Medium |
| Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-10545 | 1 Ibm | 1 Planning Analytics Local | 2026-07-30 | 7.5 High |
| IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions. | ||||
| CVE-2026-15054 | 2 Bit Form, Wordpress | 2 Bit Form, Wordpress | 2026-07-30 | 3.7 Low |
| The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished. | ||||
| CVE-2026-15899 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-15900 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-15901 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-15903 | 1 Google | 1 Chrome | 2026-07-30 | 8.8 High |
| Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-15904 | 1 Google | 1 Chrome | 2026-07-30 | 8.8 High |
| Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-30632 | 1 Knowns-dev | 1 Knowns | 2026-07-30 | 7.5 High |
| Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. | ||||
| CVE-2026-11771 | 1 Openvpn | 1 Openvpn | 2026-07-30 | 5.3 Medium |
| OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server | ||||
| CVE-2026-12996 | 1 Openvpn | 1 Openvpn | 2026-07-30 | 5.9 Medium |
| A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry | ||||
| CVE-2026-66415 | 1 Leantime | 1 Leantime | 2026-07-30 | 8.5 High |
| Leantime 3.6.2 contains a server-side request forgery and local file inclusion vulnerability that allows authenticated attackers to read internal resources by passing unsanitized user-supplied filenames to file_get_contents() in the Blueprints::import() method without path validation. Attackers can submit crafted filenames containing URL wrappers or path traversal sequences through the JSON-RPC API endpoint to access cloud metadata services or read arbitrary files from the server filesystem. | ||||
| CVE-2026-48499 | 1 Activepieces | 1 Activepieces | 2026-07-30 | N/A |
| Activepieces is an open source AI workflow automation platform. Prior to 0.84.0, an unsanitized path segment in the Code piece sandbox can let an authenticated flow author reach read-write cached flow and code files belonging to other tenants on the same worker, exposing embedded data and allowing modified code to execute on a victim tenant's next flow run. This issue is fixed in version 0.84.0. | ||||
| CVE-2026-15153 | 2 Wordpress, Wp Hotel Booking | 2 Wordpress, Wp Hotel Booking | 2026-07-30 | 6.8 Medium |
| The WP Hotel Booking WordPress plugin before 2.3.2 does not sanitise and escape a search parameter on an administrative listing before using it in a SQL query, allowing users holding the WP Hotel Booking WordPress plugin before 2.3.2's booking-management roles to perform SQL injection attacks. | ||||
| CVE-2026-12086 | 1 Ibm | 4 Ucd Ibm Devops Deploy, Ucd Ibm Urbancode Deploy, Ucd Ibm Devops Deploy and 1 more | 2026-07-30 | 6.2 Medium |
| IBM UCD - IBM UrbanCode Deploy 7.2 through 7.2.3.23, and 7.3 through 7.3.2.18 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.13, 8.1 through 8.1.2.6, and 8.2 through 8.2.1.0 IBM DevOps Deploy stores potentially sensitive information in log files that could be read by a local user. | ||||
| CVE-2026-17878 | 1 Google | 1 Chrome | 2026-07-30 | 6.1 Medium |
| Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-15235 | 2 Motopress Hotel Booking, Wordpress | 2 Motopress Hotel Booking, Wordpress | 2026-07-30 | 4.3 Medium |
| The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer. | ||||
| CVE-2026-17906 | 1 Google | 1 Chrome | 2026-07-30 | 5.8 Medium |
| Insufficient validation of untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) | ||||