Export limit exceeded: 416411 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 416411 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (45626 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-71377 | 1 Hitachi | 1 Cosminexus Component Container | 2026-09-08 | 9.8 Critical |
| Command Argument Injection Vulnerability in Cosminexus Component Container. This issue affects Cosminexus Component Container: from 11-70-01 before 11-70-03, from 11-60 before 11-60-03, from 11-50 through 11-50-03, from 11-40 through 11-40-03, from 11-30 through 11-30-08, from 11-20 before 11-20-10, from 11-10 through 11-10-11, from 11-00 through 11-00-12, from 09-87 before 09-87-10, from 09-80 through 09-80-04, from 09-70 before 09-70-28, from 09-50 through 09-50-22, and from 09-00 through 09-00-18. | ||||
| CVE-2026-17509 | 2 Wordpress, Wpml | 2 Wordpress, Wpml Multilingual Cms | 2026-09-08 | 6.5 Medium |
| The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This vulnerability is exploitable due to an authorization bypass where the registered authorization callback fails to execute, allowing any authenticated user regardless of role to access administrative translation functionalities. | ||||
| CVE-2026-32773 | 1 Apache | 1 Spark | 2026-09-08 | 6.1 Medium |
| There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later. This CVE is marked as "low" since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page. Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later. | ||||
| CVE-2026-2520 | 2 Ladela, Wordpress | 2 Online Scheduling And Appointment Booking System – Bookly, Wordpress | 2026-09-08 | 5.4 Medium |
| The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update any plugin with a main file of 'main.php' to its latest version. | ||||
| CVE-2026-86504 | 1 Jetbrains | 1 Intellij Idea | 2026-09-08 | 7.8 High |
| In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execution | ||||
| CVE-2026-86499 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 4.3 Medium |
| In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission | ||||
| CVE-2026-86498 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 7.7 High |
| In JetBrains YouTrack before 2025.3.160480, 2026.1.14047 pUT requests on link sub-resources allowed modification linked entities without update permission | ||||
| CVE-2026-86496 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 4.3 Medium |
| In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses | ||||
| CVE-2026-86495 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects | ||||
| CVE-2026-86494 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 7.7 High |
| In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues | ||||
| CVE-2026-86493 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed read-only users to create and modify whiteboard cards | ||||
| CVE-2026-86490 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.18634 improper permission checks allowed overwriting of bundled apps via the app import endpoint | ||||
| CVE-2026-86487 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content | ||||
| CVE-2026-86479 | 1 Jetbrains | 1 Youtrack | 2026-09-08 | 8 High |
| In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR | ||||
| CVE-2026-76963 | 1 Sap Se | 1 Sap Netweaver And Abap Platform | 2026-09-08 | 4.3 Medium |
| Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal system details, resulting in low impact on confidentiality while integrity and availability remain unaffected. | ||||
| CVE-2026-19634 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-09-08 | 6.4 Medium |
| PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later | ||||
| CVE-2026-19633 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-09-08 | 8.8 High |
| PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions | ||||
| CVE-2024-42391 | 1 Cesanta | 1 Mongoose | 2026-09-08 | 4.3 Medium |
| Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space. | ||||
| CVE-2024-42386 | 1 Cesanta | 1 Mongoose | 2026-09-08 | 8.2 High |
| Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and produce a segmentation fault on the application. | ||||
| CVE-2026-7867 | 1 Redhat | 2 Enterprise Linux, Enterprise Linux Eus | 2026-09-08 | 7.8 High |
| A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount() D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on behalf of arbitrary users, including privileged accounts. This can lead to local privilege escalation through mount point injection and manipulation of the mount namespace visible to privileged users. | ||||