Export limit exceeded: 389668 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389668 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87063 | 2026-09-08 | 2.6 Low | ||
| A flaw was found in konflux-operator-tasks. The Continuous Integration (CI) process installs the `tkn` command-line interface (CLI) from a network download without verifying its integrity through checksums or digital signatures. This vulnerability could allow a compromised distribution channel to substitute a malicious binary, potentially leading to the execution of unauthorized code within the CI environment. | ||||
| CVE-2026-87064 | 2026-09-08 | 2.6 Low | ||
| A flaw was found in konflux-operator-tasks. The GitHub workflows used by this component do not explicitly define their required permissions. This oversight means the workflows may inherit default access tokens that grant broader privileges than intended. Such excessive permissions could potentially allow an attacker to gain unauthorized access or perform actions beyond the intended scope, leading to information disclosure or unauthorized modifications. | ||||
| CVE-2026-87065 | 2026-09-08 | 2.6 Low | ||
| A flaw was found in konflux-operator-tasks. Tekton task steps within this component run with root privileges without sufficient security hardening. This lack of defense-in-depth controls, such as restricted capabilities or disabled privilege escalation, could potentially allow an attacker to escalate privileges or perform unauthorized actions if another vulnerability is exploited within the root-run process. | ||||
| CVE-2026-87050 | 2026-09-08 | 4.2 Medium | ||
| A flaw was found in operator-foundry. GitHub Actions and reusable workflows within the component are referenced using mutable tags (e.g., `@v0`, `@v4`) instead of fixed commit SHAs. This allows an attacker to potentially alter the code executed in the Continuous Integration (CI) pipeline through an upstream compromise or by re-pointing a tag, leading to unauthorized code execution or manipulation. | ||||
| CVE-2026-87051 | 2026-09-08 | 2.6 Low | ||
| A flaw was found in operator-foundry. The path-containment check, designed to restrict file access within a build context, only performs string-based validation. It fails to resolve symbolic links (symlinks), allowing an attacker to create a symlink within the build context that points to files or directories outside of it. This could enable unauthorized access to files beyond the intended confinement. | ||||
| CVE-2026-87056 | 2026-09-08 | 2.6 Low | ||
| A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead to the inclusion of known vulnerable components in the build process, increasing the risk of security exposures. | ||||
| CVE-2023-52251 | 1 Provectus | 1 Ui | 2026-09-08 | 8.8 High |
| An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. No fixed release is available; the project has had no commit since 2024-04-08. | ||||
| CVE-2026-13608 | 1 Curl | 1 Curl | 2026-09-08 | 7.4 High |
| A flaw in the libcurl SASL negotiation for LDAP authentication allows an incomplete handshake sequence to be misinterpreted as a successful cryptographic verification. An attacker executing a Man-in-the-Middle (MITM) attack can inject a premature or shortcut response that bypasses complete peer validation. | ||||
| CVE-2026-19931 | 1 Curl | 1 Curl | 2026-09-08 | 9.8 Critical |
| A flaw in libcurl makes it wrongly reuse an HTTP connection setup for a given hostname using Negotiate authentication, when the initial request is done using empty credentials. This can make user B's request get sent over user A's previously authenticated connection. | ||||
| CVE-2026-84385 | 1 Fortinet | 2 Fortisoaron-premise, Fortisoarpaas | 2026-09-08 | 4.9 Medium |
| A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 through 7.5.3, FortiSOAR on-premise 7.4 all versions, FortiSOAR on-premise 7.3 all versions may allow attacker to escalation of privilege via <insert attack vector here> | ||||
| CVE-2026-84392 | 1 Fortinet | 3 Fortios, Fortipam, Fortiproxy | 2026-09-08 | 2.5 Low |
| A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM 1.6 all versions, FortiPAM 1.5 all versions, FortiPAM 1.4 all versions, FortiPAM 1.3 all versions, FortiPAM 1.2 all versions, FortiPAM 1.1 all versions, FortiPAM 1.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions may allow an authenticated attacker to crash the httpsd daemon via crafted HTTP requests. | ||||
| CVE-2026-84387 | 1 Fortinet | 1 Fortisandbox | 2026-09-08 | 6.7 Medium |
| A improper neutralization of special elements used in a command ('command injection') vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | ||||
| CVE-2026-22575 | 1 Fortinet | 2 Fortimanager, Fortimanagercloud | 2026-09-08 | 4.7 Medium |
| An improper access control vulnerability in Fortinet FortiManager 7.6.0 through 7.6.4, FortiManager 7.4.0 through 7.4.10, FortiManager 7.2 all versions, FortiManager Cloud 7.6.2 through 7.6.4, FortiManager Cloud 7.4.1 through 7.4.10, FortiManager Cloud 7.2 all versions may allow an administrator to bypass the approval process for workflow sessions via crafted HTTP or HTTPs requests. | ||||
| CVE-2026-84393 | 1 Fortinet | 2 Fortios, Fortiproxy | 2026-09-08 | 7.3 High |
| A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.6 may allow attacker to information disclosure via <insert attack vector here> | ||||
| CVE-2026-63523 | 1 Microsoft | 3 Skype For Business Server 2015, Skype For Business Server 2019, Skype For Business Server Subscription Edition | 2026-09-08 | 6.5 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-86675 | 1 Itsourcecode | 1 Sales And Inventory System | 2026-09-08 | 6.3 Medium |
| A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us_edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-78602 | 1 Elastic | 2 Elastic Maps Server, Maps Server | 2026-09-08 | 5.3 Medium |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elastic Maps Server can lead to information disclosure via Path Traversal (CAPEC-126). An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside its intended content directory that are readable by the server process. | ||||
| CVE-2026-86477 | 2026-09-08 | N/A | ||
| ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage. | ||||
| CVE-2026-9317 | 1 Nangohq | 1 Nango | 2026-09-08 | 8.1 High |
| Nango before 0.71.6 contains a missing authentication vulnerability in the runner tRPC server that allows unauthenticated attackers to execute arbitrary JavaScript code by invoking the exposed start procedure without credentials. Attackers with network access to the runner port can send requests to the unauthenticated start procedure, bypassing the unenforced RUNNER_SECRET_KEY environment variable, to achieve remote code execution within the runner process. | ||||
| CVE-2026-86667 | 1 Aircheng-org | 1 Iwebshop-5 | 2026-09-08 | 4.7 Medium |
| A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function member_list of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||