Export limit exceeded: 18184 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (18184 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-44092 | 2 Phoenix Contact, Phoenixcontact | 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more | 2026-08-03 | 9.1 Critical |
| An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss. | ||||
| CVE-2026-18353 | 1 Eclipse | 1 Eclipse Pia | 2026-08-03 | 8.2 High |
| PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT and checks its **unverified** `iss` claim against an issuer allowlist using Python's `urlparse` before performing OIDC discovery with `requests`. Because `urlparse` and `requests`/`urllib3` parse an authority string containing a backslash (e.g. `https://attacker-host\@ci.eclipse.org/`) into *different* hostnames, an attacker can craft an issuer that passes the allowlist check yet drives `requests` — and subsequently `urllib.request.urlopen` for JWKS retrieval — to connect to an arbitrary attacker-chosen host, port, and scheme. | ||||
| CVE-2022-4994 | 1 Linux | 1 Linux Kernel | 2026-08-03 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: KVM: x86: wean fast IN from emulator_pio_in Use __emulator_pio_in() directly for fast PIO instead of bouncing through emulator_pio_in() now that __emulator_pio_in() fills "val" when handling in-kernel PIO. vcpu->arch.pio.count is guaranteed to be '0', so this a pure nop. emulator_pio_in_emulated is now the last caller of emulator_pio_in. No functional change intended. | ||||
| CVE-2026-50741 | 2 Revive, Revive-adserver | 2 Adserver, Revive Adserver | 2026-08-03 | N/A |
| Bypass to the fix for CVE-2026-34916. Variants of such vectors have been also reported by phucrio and offsetmd. The fix can be bypassed either by sending a disallowed but otherwise valid plugin identifier as `type`, or using the `ox.setChannelTargeting` XML-RPC API method. | ||||
| CVE-2026-24248 | 2 Linux, Nvidia | 3 Linux Kernel, Megatron-bridge, Nemo Megatron Bridge | 2026-08-03 | 7.8 High |
| NVIDIA Megatron Bridge for Linux contains a vulnerability where an attacker could cause improper control of code generation. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, data tampering, and information disclosure. | ||||
| CVE-2026-55115 | 1 Ui | 1 Unifi Protect | 2026-08-03 | 9.9 Critical |
| A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in UniFi Protect Application to escalate privileges on the host device. | ||||
| CVE-2026-51385 | 1 Graphify | 1 Graphify | 2026-08-03 | 6.9 Medium |
| An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url, safe_fetch, _build_opener, _fetch_html and _download_binary functions. | ||||
| CVE-2026-48290 | 5 Adobe, Apple, Google and 2 more | 11 C2pa, C2pa-web, C2patool and 8 more | 2026-08-02 | 8.2 High |
| CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. | ||||
| CVE-2026-65477 | 2 Select-themes, Wordpress | 2 Tonda Core, Wordpress | 2026-08-02 | 7.5 High |
| Contributor Local File Inclusion in Tonda Core <= 2.1.2 versions. | ||||
| CVE-2026-65481 | 2 Elated-themes, Wordpress | 2 Vino, Wordpress | 2026-08-02 | 7.5 High |
| Contributor Local File Inclusion in Vino <= 1.9 versions. | ||||
| CVE-2026-14540 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 6.1 Medium |
| A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints. | ||||
| CVE-2026-65310 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 7.5 High |
| ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration. | ||||
| CVE-2026-54725 | 1 Bank-vaults | 1 Vault-secrets-webhook | 2026-08-02 | 9.6 Critical |
| vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig() in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in pkg/webhook/webhook.go, and vault.security.banzaicloud.io/vault-serviceaccount can cause a ServiceAccount JWT to be sent to an attacker-controlled Vault address. This issue is fixed in version 1.23.1. | ||||
| CVE-2026-53500 | 1 Thumbor | 1 Thumbor | 2026-08-02 | 8.2 High |
| Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, the ALLOWED_SOURCES configuration passes plain strings to re.match() without escaping dots, so a hostname differing at dot positions can match the allowlist. This issue is fixed in 7.8.0. | ||||
| CVE-2026-53510 | 1 Savonrb | 1 Savon | 2026-08-02 | 8.1 High |
| Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .all_operations interpolates attacker-controlled WSDL operation names into Ruby source passed to module_eval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2. | ||||
| CVE-2026-65466 | 2 Crocoblock. Jetimpex Inc., Wordpress | 2 Jetreviews, Wordpress | 2026-08-02 | 4.9 Medium |
| Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions. | ||||
| CVE-2026-65467 | 2 Crocoblock. Jetimpex Inc., Wordpress | 2 Jetreviews, Wordpress | 2026-08-02 | 4.9 Medium |
| Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions. | ||||
| CVE-2026-65516 | 2 Peprodev, Wordpress | 2 Peprodev Ultimate Invoice, Wordpress | 2026-08-02 | 7.2 High |
| Unauthenticated Server Side Request Forgery (SSRF) in PeproDev Ultimate Invoice <= 2.2.6 versions. | ||||
| CVE-2026-16910 | 1 Redhat | 3 Openshift Update Service, Quay, Quay 3 | 2026-08-02 | 5.5 Medium |
| A flaw was found in Red Hat Quay's notification webhook feature. The Slack and generic webhook notification handlers accept user-supplied URLs without SSRF validation, allowing a repository administrator to make the Quay worker issue POST requests to internal network addresses or cloud infrastructure endpoints that should not be reachable from the application. | ||||
| CVE-2025-15662 | 2 Printcart, Wordpress | 2 Printcart Web To Print Product Designer For Woocommerce, Wordpress | 2026-08-02 | 8.6 High |
| The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetching it server-side and does not enforce a valid authorization check, allowing unauthenticated attackers to read arbitrary local files (including configuration files containing database credentials and secret keys) and to make server-side requests to internal resources. | ||||