Export limit exceeded: 385309 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 385309 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385309 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-69223 | 3 Aio-libs, Aio-libs Project, Aiohttp | 4 Aiohttp Session, Aiohttp, Aio-libs and 1 more | 2026-09-01 | 7.5 High |
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by AIOHTTP could exhaust the host's memory. This issue is fixed in version 3.13.3. | ||||
| CVE-2025-15613 | 1 Kyverno | 1 Kyverno | 2026-09-01 | 6.5 Medium |
| Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission to create Kyverno (Cluster)Policies can specify an external URL in a policy's apiCall/service configuration; although Service Call is documented for in-cluster services, it also resolves external addresses, allowing requests to an attacker-controlled server. Because policy context data (including contents of Kubernetes resources such as secrets) is sent in these requests, an attacker can exfiltrate sensitive cluster data. | ||||
| CVE-2024-0682 | 2 Sivel, Theandystratton | 2 Page Restrict, Page Restrict | 2026-09-01 | 5.3 Medium |
| The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts. | ||||
| CVE-2024-24702 | 1 Sivel | 1 Page Restrict | 2026-09-01 | 4.3 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Matt Martz & Andy Stratton Page Restrict.This issue affects Page Restrict: from n/a through 2.5.5. | ||||
| CVE-2026-64785 | 1 Apple | 2 Swiftnio Http/2, Swiftnio Http\/2 | 2026-09-01 | 5.3 Medium |
| SwiftNIO HTTP/2 was missing validation on inbound HEADERS frames that let CR, LF, NUL, SP and other control characters reach an HTTP/1.1 backend through NIOHTTP2's HTTP/2-to-HTTP/1 codec, enabling HTTP request smuggling or response splitting. This vulnerability is addressed in swift-nio-http2 version 1.45.0. | ||||
| CVE-2026-51747 | 2026-09-01 | N/A | ||
| Incorrect access control in the keepAlive function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to emit indirect mesh heartbeat information toward the master via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-84235 | 1 Rockwell Automation | 1 1756-enbt Module | 2026-09-01 | N/A |
| A denial-of-service security issue exists in the affected product. The security issue stems from a crafted CIP packet being sent crashing the module. The device requires a restart to recover. | ||||
| CVE-2026-51744 | 2026-09-01 | N/A | ||
| Incorrect access control in the recv_mesh_info_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to force mesh configuration synchronization from an attacker-controlled host via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51743 | 2026-09-01 | N/A | ||
| Incorrect access control in the guest_wifi_sync function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to disable guest virtual AP interfaces via sending a crafted MQTT message to the cs_broker component. | ||||
| CVE-2026-51742 | 2026-09-01 | N/A | ||
| Incorrect access control in the discoverWan function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to trigger WAN discovery logic via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51741 | 2026-09-01 | N/A | ||
| Incorrect access control in the clearDiagnosisLog function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to erase diagnosis logs via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-79683 | 2026-09-01 | 8.8 High | ||
| Dell PowerStore contains a Protection Mechanism Failure vulnerability. An authenticated user with limited privileges could potentially exploit this vulnerability to write attacker-controlled content to arbitrary filesystem paths. | ||||
| CVE-2026-76111 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-09-01 | 8.8 High |
| Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit this vulnerability to invoke administrator-only operations, leading to privilege escalation. | ||||
| CVE-2026-19472 | 1 Rockwell Automation | 1 Armorstart Lt | 2026-09-01 | N/A |
| A denial-of-service security issue exists within ArmorStart® LT. The security issue stems from improper handling of a crafted HTTP PUT request sent to the embedded web server. This can result in a loss of web server availability | ||||
| CVE-2026-19471 | 1 Rockwell Automation | 1 Armorstart Lt | 2026-09-01 | N/A |
| Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. | ||||
| CVE-2026-58575 | 2026-09-01 | 8.8 High | ||
| Dell PowerStore contains an Authentication Bypass by Spoofing vulnerability. An authenticated attacker could potentially exploit this vulnerability to escalate privileges to Administrator. | ||||
| CVE-2026-11873 | 1 Redhat | 2 Certificate System, Enterprise Linux | 2026-09-01 | 6.5 Medium |
| An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication. | ||||
| CVE-2026-5096 | 2 Wordpress, Wpeverest | 2 Wordpress, Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder | 2026-09-01 | 5.3 Medium |
| The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_value()` method in `class-evf-form-task.php` accepting arbitrary URL values from `$_POST` data for upload fields without domain restriction, which are then passed to `wp_remote_head()` in the `get_local_file_size()` method of `class-evf-form-fields-upload.php`. This makes it possible for unauthenticated attackers to force the WordPress server to make outbound HTTP HEAD requests to arbitrary URLs by submitting a form with an upload field containing a malicious URL while leaving a required field empty to trigger form re-rendering. | ||||
| CVE-2026-81759 | 2 Magepeopleteam, Wordpress | 2 Wpevently, Wordpress | 2026-09-01 | 5.4 Medium |
| Contributor Broken Access Control in WpEvently <= 5.5.0 versions. | ||||
| CVE-2026-81761 | 2 Magepeopleteam, Wordpress | 2 Wpevently, Wordpress | 2026-09-01 | 4.3 Medium |
| Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. | ||||