Export limit exceeded: 405615 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 405615 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405615 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78021 | 1 Dell | 2 Policy Manager For Secure Connect Gateway, Secure Connect Gateway Policy Manager | 2026-10-13 | 3.7 Low |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Generation of Error Message Containing Sensitive Information vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure and Information exposure. | ||||
| CVE-2026-32574 | 2026-10-13 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104. | ||||
| CVE-2026-54454 | 2026-10-13 | 9.1 Critical | ||
| OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCATS Import module in modules/import/ImportUI.php can preserve an uploaded file's original name for one import data type and place the file in the web-accessible temporary directory. An authenticated user with Import privileges can select the affected import path and upload a PHP file that remains under an attacker-controlled executable filename, and an import error can leave the file on disk. If the temporary directory is served with PHP execution enabled, requesting the staged file can execute arbitrary PHP code with the web server process privileges, exposing or modifying recruiting data and the host system. This issue is fixed in version 0.10.0. | ||||
| CVE-2026-42702 | 2026-10-13 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0. | ||||
| CVE-2026-39785 | 2 Serhii Pasiuk, Wordpress-extensions | 2 Gmedia Photo Gallery, Gmedia Photo Gallery | 2026-10-13 | 9.3 Critical |
| Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows Blind SQL Injection.This issue affects Gmedia Photo Gallery: from n/a through 1.25.1. | ||||
| CVE-2026-103030 | 2026-10-13 | 7.5 High | ||
| Dio is a powerful HTTP client for Dart and Flutter. From 1.0.0 until 2.8.0, dio_http2_adapter follows redirects in Http2Adapter._fetch by copying the original RequestOptions.headers into the redirected HTTP/2 request without comparing the source and destination origins. A server contacted by an application can return a cross-origin Location redirect to a different-origin destination, which then receives preserved Authorization, Cookie, and Proxy-Authorization headers because RequestOptions.copyWith retains the full header map. The issue applies when applications use Http2Adapter for authenticated requests, and redirect following is enabled by default. This issue is fixed in version 2.8.0. | ||||
| CVE-2026-109620 | 1 Sourcecodester | 1 Online Reviewer System | 2026-10-13 | 7.3 High |
| A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of the file login/index.php. Such manipulation of the argument username/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-109734 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109737 | 2026-10-13 | N/A | ||
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109740 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109746 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Mitigation bypass in the DOM: Security component. This vulnerability was fixed in Firefox 158. | ||||
| CVE-2026-109747 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Other issue in the Address Bar component. This vulnerability was fixed in Firefox 158. | ||||
| CVE-2026-109750 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158. | ||||
| CVE-2026-109709 | 1 Mozilla | 1 Firefox | 2026-10-13 | 8.8 High |
| Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109717 | 1 Mozilla | 1 Firefox | 2026-10-13 | 5.4 Medium |
| Use-after-free in the DOM: Bindings (WebIDL) component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109720 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109723 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109724 | 1 Mozilla | 1 Firefox | 2026-10-13 | 5.4 Medium |
| Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109731 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Incorrect boundary conditions in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109735 | 1 Mozilla | 1 Firefox | 2026-10-13 | 5.4 Medium |
| Use-after-free in the DOM: Animation component. This vulnerability was fixed in Firefox 158. | ||||