Export limit exceeded: 385063 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3304 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-75954 | 1 Cmsjunkie.com | 1 J-businessdirectory Extension For Joomla | 2026-08-21 | N/A |
| Joomla Extension - cmsjunkie.com - SQL injection in trips search in J-BusinessDirectory < 6.2.3 - Search keywords and ORDER BY were concatenated into SQL. 6.2.3 quotes keywords and allow-lists the sort clause. | ||||
| CVE-2026-75949 | 1 Cmsjunkie.com | 1 J-businessdirectory Extension For Joomla | 2026-08-21 | N/A |
| Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion (path traversal) in J-BusinessDirectory < 6.2.3 - Upload/remove accepted a client-controlled root (_path_type could point at the component site/admin trees), did not enforce path containment, and used a weak extension check. CSRF token was also missing on upload/remove. | ||||
| CVE-2026-76590 | 1 Trendnet | 2 Tew-755ap, Tew-755ap Firmware | 2026-08-21 | 9.9 Critical |
| A vulnerability was identified in TRENDnet TEW-755AP up to 20260702. Affected by this issue is some unknown functionality of the file /cgi-bin/wan.cgi of the component ssi. Such manipulation of the argument cameo.wan.wan_pppoe_password_00 leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-77645 | 1 Ptc | 2 Flexplm, Windchill Pdmlink | 2026-08-21 | N/A |
| A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. | ||||
| CVE-2026-77683 | 1 Comfast | 1 Cf-n1-s | 2026-08-21 | 9.9 Critical |
| A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone. The manipulation of the argument timestr results in command injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-76156 | 1 Datiphy | 1 Data Management Center | 2026-08-21 | N/A |
| OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root. | ||||
| CVE-2026-76155 | 1 Datiphy | 1 Data Management Center | 2026-08-21 | N/A |
| Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials. | ||||
| CVE-2026-76158 | 1 Datiphy | 1 Data Management Center | 2026-08-21 | N/A |
| External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences. | ||||
| CVE-2026-63382 | 1 Libevent Project | 1 Libevent | 2026-08-21 | N/A |
| Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha. | ||||
| CVE-2026-63385 | 1 Libevent Project | 1 Libevent | 2026-08-21 | N/A |
| Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition. | ||||
| CVE-2026-72843 | 1 Evershop | 1 Evershop | 2026-08-21 | 9.8 Critical |
| The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller, and no customer-session middleware guards the route; the only middleware in the chain parses the JSON body. The handler in updateCustomer.js then loads the customer by the uuid taken from the URL path and writes the supplied fields back to that record, hashing a password if one is provided, without verifying that the caller owns the record. An unauthenticated request carrying a known customer uuid can therefore overwrite that customer's email address and password and read back the updated record from the 200 response, taking over the account and locking out its owner. Customer uuids are exposed through order confirmation email links and administrative URLs. Version 2.2.1 changes the route to "access": "private". | ||||
| CVE-2026-77086 | 1 Siyuan | 1 Siyuan | 2026-08-21 | 9.1 Critical |
| SiYuan before v3.7.4 fails to validate the packageName parameter in Bazaar install and uninstall endpoints, allowing authenticated administrators to perform path traversal via directory traversal sequences. Attackers with admin access can write arbitrary files to any location via install operations or recursively delete directories via uninstall operations by supplying crafted packageName values. | ||||
| CVE-2026-74875 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 silently skip JSON schema validation when the jsonschema library is not installed, allowing malformed metadata to be accepted. Attackers can remove the jsonschema package or supply unknown metadata format versions to bypass all schema checks and process malicious data. | ||||
| CVE-2026-74876 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 contain a vulnerability in PublicKeyBundle.from_dict() that creates key bundles from untrusted data without verifying signatures. Attackers can call from_dict() followed by to_identity() without signature verification to encrypt data using attacker-controlled public keys, leaking secrets. | ||||
| CVE-2026-74878 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate limiting protections. | ||||
| CVE-2026-74880 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 accept refresh tokens as URL query parameters in keyserver and telemetry server routes. Attackers can extract tokens from server logs, proxy logs, browser history, and HTTP Referer headers to gain unauthorized access. | ||||
| CVE-2026-74885 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 3.6 Low |
| openssl_encrypt versions before 1.4.0 contain a logging bug in restore_hidden_modules() that logs module counts after clearing, always showing zero restored modules and corrupting audit trails. Additionally, a race condition exists between module hiding and import hook installation where another thread could re-import blocked modules in multi-threaded environments. | ||||
| CVE-2026-74886 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 contain a plugin sandbox bypass vulnerability where the PluginImportGuard blocks a different set of modules than the AST analyzer's DANGEROUS_MODULES set. Attackers can bypass AST analysis through string obfuscation or encoding to import unblocked dangerous modules like sys, shutil, multiprocessing, importlib, and pickle for arbitrary code execution. | ||||
| CVE-2026-74889 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 9.8 Critical |
| openssl_encrypt versions before 1.4.0 use HKDF with no salt and static info parameter in key normalization functions, reducing entropy extraction and determinism. Attackers can exploit predictable key derivation with identical inputs to weaken cryptographic security against multi-target attacks. | ||||
| CVE-2026-74890 | 1 Jahlives | 1 Openssl Encrypt | 2026-08-21 | 5.5 Medium |
| openssl_encrypt versions before 1.4.0 contain an authentication bypass vulnerability in CamelliaCipher that disables HMAC tag generation and verification when the PYTEST_CURRENT_TEST environment variable is set. Attackers with code execution can set this environment variable to produce unauthenticated ciphertext and bypass integrity protection on encrypted data. | ||||