Export limit exceeded: 385152 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385152 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385152 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385152 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385152 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81778 | 2 The4, Wordpress | 2 Kalles Addons, Wordpress | 2026-08-31 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Kalles Addons <= 1.0.6 versions. | ||||
| CVE-2026-18904 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 8.2 High |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to obtain sensitive information and inject unauthorized messages due to a namespace collision between user identifiers. | ||||
| CVE-2026-19286 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint. | ||||
| CVE-2026-19294 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 6.4 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote authenticated attacker to execute and read any user's private flow due to improper authorization. | ||||
| CVE-2026-19295 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-08-31 | 9.9 Critical |
| IBM Langflow OSS 1.0.0 through 1.11.1 allows an authenticated attacker to execute arbitrary operating system commands in the server process by saving a flow with a crafted type field value and triggering a build of a wrapper flow that references it. This allowed privilege escalation from "authenticated flow user" to arbitrary OS-level command execution under the server process identity, bypassing the LANGFLOW_ALLOW_CUSTOM_COMPONENTS=false policy control. | ||||
| CVE-2026-82922 | 1 Shopex | 1 Ecshop | 2026-08-31 | 7.3 High |
| A security vulnerability has been detected in ShopEx ECShop up to 2.5.1. This vulnerability affects the function flow_update_cart of the file /flow.php?step=update_cart. The manipulation of the argument rec_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-59314 | 2 Spring, Vmware | 2 Spring Framework, Spring Framework | 2026-08-31 | 3.7 Low |
| Applications that build a Content-Disposition header value from untrusted input may be vulnerable to HTTP response splitting when the input is a malicious file name. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier | ||||
| CVE-2026-51681 | 1 Totolink | 1 T6 | 2026-08-31 | 9.1 Critical |
| Incorrect access control in the setRemoteCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to expose WAN-side administration via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2025-63607 | 2026-08-31 | N/A | ||
| TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser. | ||||
| CVE-2026-79407 | 2026-08-31 | N/A | ||
| A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILE_NAME value used by set_file_name() and load_meta_data() in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILE_NAME value with the settings directory and opens the resulting path without validating that the resolved path remains within the intended directory. | ||||
| CVE-2026-79408 | 2026-08-31 | N/A | ||
| An OS command injection vulnerability in MetaGPT 0.8.1 allows an attacker to execute arbitrary commands via the path argument of RepoParser.rebuild_class_views() in metagpt/repo_parser.py. | ||||
| CVE-2026-54599 | 1 Ellite | 1 Wallos | 2026-08-31 | N/A |
| Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, login.php generates an OIDC state nonce stored in $_SESSION['oidc_state'], but checksession.php dispatches the OIDC callback without comparing the incoming state against the session value. An attacker can trick a victim into visiting a crafted URL, causing Wallos to exchange the attacker's authorization code and log the victim into the attacker's account. This issue has been patched in version 4.9.4. | ||||
| CVE-2026-54600 | 1 Ellite | 1 Wallos | 2026-08-31 | N/A |
| Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.9.4, endpoints/db/import.php has no authentication. The only guard is a user-table row count — if zero (fresh/unconfigured install), an unauthenticated attacker can replace the entire database. This issue has been patched in version 4.9.4. | ||||
| CVE-2026-82233 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-31 | 5.7 Medium |
| SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without workspace boundary validation. Attackers can induce the AI Agent to upload sensitive files such as SSH keys or credentials from outside the workspace into the asset directory through prompt injection. | ||||
| CVE-2026-82234 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-08-31 | 8.2 High |
| SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform DNS resolution only at guard time without validating the connect-time resolution. Attackers can use DNS rebinding to answer the guard resolution with a public IP and the connect resolution with a private or metadata IP, bypassing the SSRF defense to access cloud instance metadata and internal services. | ||||
| CVE-2026-54788 | 1 Datadog | 1 Dd-trace-rs | 2026-08-31 | 7.5 High |
| dd-trace-rs provides Datadog application performance monitoring for Rust. From 0.1.0 until 0.3.3, datadog-opentelemetry/src/propagation/tracecontext.rs parses the W3C tracestate header and collects every semicolon-separated key and value pair in the Datadog dd=... vendor entry into a HashMap without enforcing a pair count or entry size limit. Because tracecontext extraction is enabled by default, a remote unauthenticated attacker can send an arbitrarily large dd=... entry and force excessive CPU and memory consumption for each request, causing denial of service in an instrumented network service. This vulnerability is fixed in 0.3.3. | ||||
| CVE-2026-70331 | 1 Microsoft | 4 Edge, Edge Chromium, Edge For Ios and 1 more | 2026-08-31 | 5.4 Medium |
| Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-75118 | 1 Tp-link | 1 Tl-mr100 V3.20 | 2026-08-31 | N/A |
| A pre-authentication stack-based buffer overflow vulnerability exists in the http_gdpr_decrypt function of TL-MR100 V3.20 due to insufficient bounds checking of encrypted requests to the /cgi/login endpoint. An adjacent unauthenticated attacker with access to the router's web management interface can trigger memory corruption and potentially achieve arbitrary code execution. Successful exploitation can overwrite saved control-flow data on the httpd process stack prior to authentication, resulting in a service crash or potential arbitrary code execution in the context of the affected process. | ||||
| CVE-2026-82017 | 1 Igel | 1 Igel Os | 2026-08-31 | 7.6 High |
| IGEL OS 12 before 12.7.6 and IGEL OS 11 before 11.11.150 contain a boot registry parameter injection vulnerability that allows attackers with physical access to execute arbitrary Linux loader parameters by writing to an unencrypted and unsigned configuration area read by the signed bootloader. Attackers can inject malicious kernel command line parameters that execute with boot environment privileges without triggering TPM PCR measurement failures, as the attack does not modify the measured boot code. | ||||
| CVE-2026-55854 | 1 Mariadb | 1 Connector-nodejs | 2026-08-31 | 5.9 Medium |
| MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.4, 3.3.3, 3.4.6, and 3.5.3, MariaDB Connector/Node.js can disclose an account password when PAM dialog authentication is negotiated over an insecure transport. In lib/cmd/handshake/auth/pam-password-auth.js and lib/cmd/handshake/authentication.js, the SendPamAuthPacketFactory behavior for the server-side plugin dialog lacked the secure-transport gate applied to mysql_clear_password. With the default sslMode=DISABLE and restrictedAuth=null settings, a hostile or on-path server can send an Authentication Switch Request for dialog over plain TCP, causing the connector to return the account password in cleartext. Properly verified TLS and a local Unix socket prevent this path, while fingerprint-only server identity validation is not sufficient. This issue is fixed in versions 3.2.4, 3.3.3, 3.4.6, and 3.5.3. | ||||