Export limit exceeded: 94626 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (94626 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76716 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Analytics And Location Engine, Ale | 2026-09-28 | 5.3 Medium |
| Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An unauthenticated remote attacker could exploit these vulnerabilities by sending specially crafted input or leveraging improper security configurations. Successful exploitation could result in a denial of service condition or unauthorized access to sensitive information. | ||||
| CVE-2026-76714 | 2 Arubanetworks, Hewlett Packard Enterprise (hpe) | 2 Analytics And Location Engine, Ale | 2026-09-28 | 7.2 High |
| Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise. | ||||
| CVE-2026-76690 | 3 Arubanetworks, Hewlett Packard Enterprise (hpe), Hpe | 3 Edgeconnect Sd-wan Orchestrator, Edgeconnect Sd-wan Gateways, Edgeconnect Operating System | 2026-09-28 | 7.2 High |
| A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could result in remote code execution as root. | ||||
| CVE-2026-76698 | 3 Arubanetworks, Hewlett Packard Enterprise (hpe), Hpe | 3 Edgeconnect Sd-wan Orchestrator, Edgeconnect Sd-wan Gateways, Edgeconnect Operating System | 2026-09-28 | 6.5 Medium |
| A command injection vulnerability exists in the web-based management interface of HPE Networking EdgeConnect SD-WAN Gateways. An authenticated remote attacker with limited access privileges could exploit this vulnerability through specially crafted input. Successful exploitation, under certain conditions, could result in the execution of arbitrary commands with elevated privileges or a denial-of-service condition on the affected appliance. | ||||
| CVE-2026-76675 | 3 Arubanetworks, Hewlett Packard Enterprise (hpe), Hpe | 3 Edgeconnect Sd-wan Orchestrator, Edgeconnect Sd-wan Gateways, Edgeconnect Operating System | 2026-09-28 | 9.1 Critical |
| A command injection vulnerability exists in the command line interface of EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with high privileges to execute arbitrary commands on the underlying operating system leading to complete system compromise. | ||||
| CVE-2026-1168 | 1 Gitlab | 1 Gitlab | 2026-09-28 | 7.5 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain conditions could have allowed an unauthenticated user to cause denial of service due to improper resource allocation limits in the GraphQL complexity calculation logic. | ||||
| CVE-2026-81885 | 2 Radare, Radareorg | 2 Radare2, Radare2 | 2026-09-28 | 5.5 Medium |
| radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's NE relocation fixup-chain parser was vulnerable because the NE relocation parser followed fixup chains without an active iteration limit or cycle detection. The vulnerability is triggered by opening a crafted NE executable whose in-bounds relocation entry points back to itself instead of reaching 0xffff. The parser repeatedly processed the same relocation and allocated another relocation object on each iteration. This can cause denial of service through continuous CPU and memory consumption. This issue is fixed in version 6.2.0. | ||||
| CVE-2026-78252 | 1 Gitlab | 1 Gitlab | 2026-09-28 | 8.2 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.3 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user could have induced a targeted user to perform unintended state-changing HTTP requests due to improper sanitization of user-controlled data in the Markdown JSON table renderer. | ||||
| CVE-2026-81886 | 2 Radare, Radareorg | 2 Radare2, Radare2 | 2026-09-28 | 5.5 Medium |
| radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's Windows 64-bit crash-dump dmp64 parser was vulnerable because the Windows dmp64 parser used an input-controlled physical-memory-run PageCount directly as the bound of a per-page allocation loop. The vulnerability is triggered by opening a small crafted full-memory Windows crash dump. The parser repeatedly allocated and appended page descriptors without validating the count against the dump size. This can cause denial of service through excessive memory consumption and processing time. This issue is fixed in version 6.2.0. | ||||
| CVE-2026-77256 | 2 Mcp-atlassian, Sooperset | 2 Mcp Atlassian, Mcp-atlassian | 2026-09-28 | 6.5 Medium |
| MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under common or permissive configurations, other local users can read the backup and retain Atlassian access through the refresh token. The advisory traces the vulnerable input and processing flow through OAuthConfig._save_tokens_to_file, refresh_token, access_token, and umask, which identify the affected entry points, controls, and code paths. This issue is fixed in version 0.22.0. | ||||
| CVE-2026-93647 | 1 Zimbra | 1 Zimbra Collaboration Suite | 2026-09-28 | 9.3 Critical |
| An unauthenticated calendar sender can place active markup in a COUNTER message's RFC From address. Selecting the message in Zimbra Classic triggers stored XSS, allowing the attacker to access mailbox data and act as the victim. | ||||
| CVE-2026-101052 | 1 Refly-ai | 1 Refly | 2026-09-28 | 7.3 High |
| A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-101017 | 1 Trusted Domain Project | 1 Opendmarc | 2026-09-28 | 6.5 Medium |
| A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-101011 | 1 Aapanel | 1 Baota | 2026-09-28 | 4.7 Medium |
| A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argument get results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-101008 | 1 Aapanel | 1 Baota | 2026-09-28 | 9.1 Critical |
| A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_path results in command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-101002 | 1 Netcore | 1 Nbr200v2 | 2026-09-28 | 9.9 Critical |
| A security flaw has been discovered in Netcore NBR200V2 1.3.241127.071246. Affected is the function system of the file /usr/bin/network_tools of the component Tools Ping Handler. Performing a manipulation of the argument url results in os command injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-101001 | 1 Netcore | 1 Nbr200v2 | 2026-09-28 | 10 Critical |
| A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the component Web Management Interface. Such manipulation of the argument QUERY_STRING leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-100904 | 1 Amirsanni | 1 Mini-inventory-and-sales-management-system | 2026-09-28 | 3.5 Low |
| A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-100898 | 1 Devaslanphp | 1 Project-management | 2026-09-28 | 6.3 Medium |
| A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-100887 | 1 Amirsanni | 1 Mini-inventory-and-sales-management-system | 2026-09-28 | 6.3 Medium |
| A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer. | ||||