Export limit exceeded: 388677 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 388677 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (388677 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16004 | 1 Asus | 1 Armoury Crate | 2026-09-08 | N/A |
| Exposed IOCTL with Insufficient Access Control in Armoury Crate driver allows a local user to read and write arbitrary PCI/PCIe configuration space via crafted IOCTL requests by bypassing the driver's verification. Refer to the ' Security Update for Armoury Crate App' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-14297 | 2026-09-08 | N/A | ||
| A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an authenticated BLE peer to overflow a 20-byte static buffer into adjacent BSS memory. The exploitable impact cannot be predetermined - it is entirely dependent on the linker-assigned BSS layout of the specific firmware build, which may vary. | ||||
| CVE-2026-14296 | 2026-09-08 | 7.5 High | ||
| When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least a single slot for each image available, the system is bootable and continues the boot process. This may lead to a situation when MCUboot picks different slot for different images (i.e. (a) for the main application and (b) for the radio image), boots the main application (from slot (a)) that afterwards starts the radio image by providing an address of the unauthenticated slot ((a) instead of (b)). | ||||
| CVE-2026-23922 | 1 Zabbix | 1 Zabbix | 2026-09-08 | 4.9 Medium |
| The email media OAuth field 'Client secret' cannot be read after saving, but a Super Admin can leak it by setting a malicious 'Token endpoint'. Changes were made to reset the client secret upon changing the token endpoint. | ||||
| CVE-2023-54354 | 1 Nokogiri | 1 Nokogiri | 2026-09-08 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2022-51000 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-09-08 | 8.8 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2022-50999 | 1 Nokogiri | 1 Nokogiri | 2026-09-08 | 8.6 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2022-50998 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-09-08 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2021-47996 | 2 Nokogiri, Sparklemotion | 2 Nokogiri, Nokogiri | 2026-09-08 | 7.5 High |
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-73312 | 1 Xenforo | 1 Xenforo | 2026-09-08 | 7.4 High |
| XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploiting the failure to mark tokens as consumed when the parent access token has expired. Attackers can repeatedly submit the same refresh token to generate additional independent token pairs, achieving persistent unauthorized access for the token's full lifetime. | ||||
| CVE-2026-73314 | 1 Xenforo | 1 Xenforo | 2026-09-08 | 7.5 High |
| XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers to bypass payment signature validation by submitting a webhook request with an unsupported auth_algo header value. When the algorithm cannot be mapped to a supported hash function, the verification function incorrectly returns true instead of failing, causing the caller to treat the fabricated request as verified and process the payment event without a valid PayPal signature. | ||||
| CVE-2026-73315 | 1 Xenforo | 1 Xenforo | 2026-09-08 | 8.6 High |
| XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme, hostname, or allowlist validation. Attackers can submit a crafted POST to the PayPal webhook callback endpoint to reach internal network resources including cloud instance metadata services, potentially disclosing IAM credentials or enabling secondary internal service exploitation. | ||||
| CVE-2026-86737 | 1 Snipeitapp | 1 Snipe-it | 2026-09-08 | 4.3 Medium |
| snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including soft-deleted and cross-company assets. | ||||
| CVE-2026-86736 | 1 Snipeitapp | 1 Snipe-it | 2026-09-08 | 4.3 Medium |
| snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrupt the assets.requests_counter through duplicate submissions and cancellations without active requests. Attackers can repeatedly call cancel endpoints without active requests to drive the counter negative, or submit duplicate checkout requests to inflate the counter, misrepresenting pending demand in the admin queue. | ||||
| CVE-2026-86731 | 1 Craftcms | 1 Craft Cms | 2026-09-08 | 6.5 Medium |
| Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdmin() when the targeted user is an administrator, unlike the mirror action actionDeactivateUser. As a result, an authenticated control panel user who is not an administrator but holds the administrateUsers permission can activate a pending or deliberately deactivated administrator account, which can lead to permission escalation when combined with resetting that account's password. The issue is fixed in Craft CMS 5.10.12. | ||||
| CVE-2026-86729 | 1 Wwbn | 1 Avideo | 2026-09-08 | 7.4 High |
| WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocumented login path. Unlike get_api_signIn, which enforces a rate limit of 10 attempts per 5 minutes via checkRateLimit(), get_api_preauthorize performs the same credential check with no throttling for any client, allowing unlimited remote password guessing against arbitrary accounts, including admin. The endpoint also acts as a credential oracle: it returns the message "Invalid credentials" for both correct and incorrect passwords, while the users_id field in the response body discloses the authenticated identity (users_id:1 on success, users_id:0 on failure), and a correct password establishes a session cookie that remains usable for authenticated API requests. Together these issues permit unauthenticated brute-force account takeover. | ||||
| CVE-2026-86727 | 1 Wwbn | 1 Avideo | 2026-09-08 | 7.5 High |
| AVideo through 29.0 contains an information disclosure vulnerability in plugin/Live/stats.json.php that allows unauthenticated attackers to retrieve stream keys and m3u8 URLs by accessing the endpoint without authentication. Attackers can enumerate private, unlisted, and group-restricted live streams by parsing the hidden_applications array in the JSON response to obtain sensitive streaming credentials. | ||||
| CVE-2026-86726 | 1 Wwbn | 1 Avideo | 2026-09-08 | 6.5 Medium |
| AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enumerate source stream keys and identities of all other streamers' active restreams. The endpoint fails to filter results by user ownership, exposing sensitive transmission credentials and streamer identity across all accounts to any user with streaming capability. | ||||
| CVE-2026-86724 | 1 Wwbn | 1 Avideo | 2026-09-08 | 6.5 Medium |
| AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/saveBalance.php that allows attackers to set arbitrary wallet balances by relying only on session cookies without token validation. Attackers can craft a malicious webpage that, when loaded by an administrator, submits a POST request to modify any user's wallet balance to any value. | ||||
| CVE-2026-86722 | 1 Wwbn | 1 Avideo | 2026-09-08 | 8.1 High |
| AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability where sqlDAL caches empty result sets that writeSql never invalidates. Attackers with a valid password can bypass email two-factor authentication on new devices because the confirmation code hash fails to generate from the stale cached empty result. | ||||