Export limit exceeded: 386826 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 386826 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (386826 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-82525 | 1 Exterro | 1 Ftk Imager | 2026-09-04 | 5.5 Medium |
| Exterro FTK Imager before 8.3 contains an XML external entity (XXE) injection vulnerability that allows attackers to read arbitrary files from the host filesystem by embedding malicious external entity references and attacker-controlled XSLT stylesheets within a Report.xml file inside a UFDR ZIP evidence item. Attackers can craft a malicious UFDR archive that, when previewed by an examiner, causes the XML parser to resolve file:// external entity references and execute msxsl:script within the external stylesheet to exfiltrate the resolved file contents to an attacker-controlled endpoint via a generated image URL. | ||||
| CVE-2026-55658 | 1 1hive | 1 Gardens-v2 | 2026-09-04 | 7.7 High |
| Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster of streaming contracts moves real pool funds into the proposal's StreamingEscrow to back the Superfluid constant flow agreement (the CFA deposit, plus a 0.5 percent margin). cancelProposal then zeroes the escrow's GDA member units but never reclaims that parked balance, and the permissionless claim() forwards the escrow's entire balance, including the pool funded buffer, to the beneficiary. The beneficiary is chosen by the proposal submitter and defaults to the submitter. The only path that returns escrow funds to the pool is drainToStrategy, which is onlyStrategy and is reached solely from the dispute reject ruling, never from cancel or natural completion. At time of publication, there are no publicly known patches. | ||||
| CVE-2026-57445 | 1 1hive | 1 Gardens-v2 | 2026-09-04 | N/A |
| Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In dfba919e218e20d52db9f7b2e8d292d45a46c91b and prior, normal beneficiary payout paths in StreamingEscrow preserve depositAmount() while an active stream needs an escrow reserve. However, the approve-side dispute resolution path drains the whole available escrow balance to the proposal beneficiary. At time of publication, there are no publicly known patches. | ||||
| CVE-2026-53720 | 1 Jetperch | 1 Pymonocypher | 2026-09-04 | N/A |
| pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, then argon2i_32 will write past the end of the buffer and possibly corrupt the heap. This issue has been patched in version 4.0.2.8. | ||||
| CVE-2026-81281 | 2 Silverks, Wordpress | 2 Graphene, Wordpress | 2026-09-04 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. | ||||
| CVE-2026-81282 | 2 Villatheme, Wordpress | 2 Product Variations Swatches For Woocommerce, Wordpress | 2026-09-04 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. | ||||
| CVE-2026-81292 | 2 Ido Kobelkowsky, Wordpress | 2 Simple Payment, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Simple Payment <= 2.5.1 versions. | ||||
| CVE-2026-81300 | 2 Silverplugins217, Wordpress | 2 Calculation For Contact Form 7, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 <= 1.0 versions. | ||||
| CVE-2026-81776 | 2 Advanpix, Wordpress | 2 Wp Quicklatex, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | ||||
| CVE-2026-84238 | 2 Wordpress, Yith | 2 Wordpress, Yith Request A Quote For Woocommerce Premium | 2026-09-04 | 9.8 Critical |
| Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. | ||||
| CVE-2026-84765 | 2 John Havlik, Wordpress | 2 Breadcrumb Navxt, Wordpress | 2026-09-04 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. | ||||
| CVE-2026-84767 | 2 Nexcess, Wordpress | 2 Bookit, Wordpress | 2026-09-04 | 5.3 Medium |
| Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. | ||||
| CVE-2026-84773 | 2 Wordpress, 作者 | 2 Wordpress, Shane Bishop:ewww Image Optimizer | 2026-09-04 | 7.2 High |
| Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions. | ||||
| CVE-2026-84776 | 2 Malcare, Wordpress | 2 Malcare Security, Wordpress | 2026-09-04 | 7.5 High |
| Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. | ||||
| CVE-2026-84778 | 2 Migrateguru, Wordpress | 2 Migrate Guru – Site Migration & Cloning, Wordpress | 2026-09-04 | 7.5 High |
| Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning <= 6.65 versions. | ||||
| CVE-2026-84779 | 2 Sheikh Heera, Wordpress | 2 Agentimus – Ai Seo, Llms.txt & Mcp For Ai Agents, Wordpress | 2026-09-04 | 8.1 High |
| Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. | ||||
| CVE-2026-64425 | 1 Linux | 1 Linux Kernel | 2026-09-04 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item commit 10dc95939817 ("io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop") fixed the obvious case where io_worker_handle_work() took one exit-bit snapshot before draining pending work, but the fix stops one level too early. io_worker_handle_work() now re-checks IO_WQ_BIT_EXIT in its outer work run loop, yet it still snapshots that bit once before processing a whole dependent linked-work chain. If io_wq_exit_start() sets IO_WQ_BIT_EXIT after the first linked item has started, the remaining linked items can still reuse stale do_kill = false, skip IO_WQ_WORK_CANCEL, and continue running after exit has begun. Move the check further inside, so it covers linked items too. Note: this is a syzbot special as it loves setting up tons of slow linked work on weird devices like msr that take forever to read, and immediately close the ring. Exit then takes a long time. | ||||
| CVE-2026-82911 | 1 Roskus | 1 Prospero Flow Crm | 2026-09-04 | N/A |
| Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken middleware enforces CSRF tokens only on POST, PUT, PATCH, and DELETE requests; the Route::get declaration leaves this state-changing action unprotected. Session cookies configured with SameSite=Lax are automatically included in top-level cross-site navigation, so a single link click triggers OrderConfirmController::confirm() and transitions the target order from pending to confirmed without user authorization. Because order numbers are sequential integers, an attacker can enumerate and confirm all existing orders in a single automated sweep. | ||||
| CVE-2026-64394 | 1 Linux | 1 Linux Kernel | 2026-09-04 | 8.8 High |
| In the Linux kernel, the following vulnerability has been resolved: ksmbd: add a WRITE_DAC/WRITE_OWNER check to SMB2 SET_INFO SECURITY commit cc57232cae23 ("ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE") added a fp->daccess gate to fsctl_set_sparse and noted that "similar handle-level checks exist in other functions but are missing here." The SMB2 SET_INFO SECURITY arm is one of the missing ones, and the most security-relevant: smb2_set_info_sec() calls set_info_sec() with no per-handle access check. set_info_sec() (fs/smb/server/smbacl.c) re-permissions the file: it rewrites owner/group/mode via notify_change(), rewrites the POSIX ACL via set_posix_acl(), and on KSMBD_SHARE_FLAG_ACL_XATTR shares removes and rewrites the Windows security descriptor via ksmbd_vfs_set_sd_xattr(). Every other persistent-mutation arm of the sibling handler smb2_set_info_file() checks fp->daccess first (FILE_WRITE_DATA / FILE_DELETE / FILE_WRITE_EA / FILE_WRITE_ATTRIBUTES); the SECURITY arm — which mutates the access control itself — is the only one with no gate. A client can therefore open a handle with FILE_WRITE_ATTRIBUTES only (no FILE_WRITE_DAC / FILE_WRITE_OWNER) and use SMB2_SET_INFO with InfoType SMB2_O_INFO_SECURITY to rewrite the file's DACL and owner, granting itself access the handle's daccess never carried. Unlike the FSCTL data arms this is a metadata/xattr operation, so there is no FMODE_WRITE VFS backstop — the missing fp->daccess check is the entire gate. Setting a security descriptor is the WRITE_DAC / WRITE_OWNER operation, so require at least one of those on the handle before re-permissioning the file. -EACCES is mapped to STATUS_ACCESS_DENIED by smb2_set_info(). | ||||
| CVE-2026-19304 | 1 Ibm | 1 Langflow Oss | 2026-09-04 | 7.7 High |
| IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due to a URL parser discrepancy. | ||||