Export limit exceeded: 21746 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95390 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-7427 | 1 Gitlab | 1 Gitlab | 2026-08-19 | 5.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation. | ||||
| CVE-2023-0945 | 1 Mayurik | 1 Best Pos Management System | 2026-08-19 | 3.5 Low |
| A vulnerability, which was classified as problematic, was found in SourceCodester Best POS Management System 1.0. Affected is an unknown function of the file index.php?page=add-category. The manipulation of the argument Name with the input "><img src=x onerror=prompt(document.domain);> leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-221592. | ||||
| CVE-2023-27206 | 1 Mayurik | 1 Best Pos Management System | 2026-08-19 | 6.1 Medium |
| A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the page parameter. | ||||
| CVE-2024-43112 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| Long pressing on a download link could potentially provide a means for cross-site scripting This vulnerability affects Firefox for iOS < 129. | ||||
| CVE-2024-43113 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| The contextual menu for links could provide an opportunity for cross-site scripting attacks This vulnerability affects Firefox for iOS < 129. | ||||
| CVE-2019-17003 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| Scanning a QR code that contained a javascript: URL would have resulted in the Javascript being executed. | ||||
| CVE-2023-5758 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 6.1 Medium |
| When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scripting (XSS) attack. This vulnerability affects Firefox for iOS < 119. | ||||
| CVE-2020-12404 | 1 Mozilla | 1 Firefox Mobile | 2026-08-19 | 4.3 Medium |
| For native-to-JS bridging the app requires a unique token to be passed that ensures non-app code can't call the bridging functions. That token could leak when used for downloading files. This vulnerability affects Firefox for iOS < 26. | ||||
| CVE-2024-43111 | 1 Mozilla | 2 Firefox For Ios, Firefox Mobile | 2026-08-19 | 9.8 Critical |
| Long pressing on a download link could potentially allow Javascript commands to be executed within the browser This vulnerability affects Firefox for iOS < 129. | ||||
| CVE-2023-29551 | 1 Mozilla | 3 Firefox, Firefox Mobile, Focus | 2026-08-19 | 8.8 High |
| Memory safety bugs present in Firefox 111. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox for Android < 112, Firefox < 112, and Focus for Android < 112. | ||||
| CVE-2026-74976 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | 6.5 Medium |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | ||||
| CVE-2026-75078 | 1 Sourcecodester | 1 Class And Exam Timetabling System | 2026-08-19 | 4.3 Medium |
| A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-75011 | 1 Kylecui | 1 Netforensicmcp | 2026-08-19 | 6.3 Medium |
| A flaw has been found in kylecui NetForensicMCP 2.1.0. Impacted is the function execAsync of the file index.js. Executing a manipulation of the argument interface/protocol can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-19980 | 2 Gl-inet, Gl.inet | 32 A1300, Ax1800, Axt1800 and 29 more | 2026-08-19 | 7.4 High |
| A security flaw has been discovered in GL.iNet A1300, AX1800, AXT1800, BE1400, BE3600, BE6500, BE9300, BE10000, E5800, MT2500, MT3000, MT3600BE, MT5000, MT6000, X2000, X3000 and XE3000 up to 4.8.x. Affected by this issue is the function ui.update_langs of the component Language Update. Performing a manipulation of the argument hour/min/week results in code injection. The attack can be initiated remotely. The vendor explains: "After our investigation, we have confirmed that the vulnerability described (...) does indeed exist." | ||||
| CVE-2026-19970 | 1 Assimp | 1 Assimp | 2026-08-19 | 6.3 Medium |
| A vulnerability was detected in Open Asset Import Library Assimp 17c12da. This affects the function Assimp::MDLImporter::AddBonesToNodeGraph_3DGS_MDL7 of the file code/AssetLib/MDL/MDLLoader.cpp of the component Node Parser. The manipulation of the argument bones_num results in heap-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-15780 | 2 Veronalabs, Wordpress | 2 Wp Statistics – Simple, Privacy-friendly Google Analytics Alternative, Wordpress | 2026-08-19 | 7.2 High |
| The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload can be planted without authentication via the public /wp-statistics/v2/hit REST endpoint, because the required signature is exposed on the public homepage and a base64-encoded page_uri POST parameter overrides the previously sanitized REQUEST_URI, allowing the malicious utm_campaign value to bypass sanitization and be stored in the database. | ||||
| CVE-2026-20497 | 2 Mediatek, Mediatek, Inc. | 23 Mt6989, Mt6989 Firmware, Mt8755 and 20 more | 2026-08-19 | 6 Medium |
| In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10965550 / ALPS11393405; Issue ID: MSV-6941. | ||||
| CVE-2026-20493 | 2 Mediatek, Mediatek, Inc. | 7 Mt6890, Mt6890 Firmware, Mt6988 and 4 more | 2026-08-19 | 4.4 Medium |
| In wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: BORA00154903; Issue ID: MSV-7575. | ||||
| CVE-2026-20491 | 2 Mediatek, Mediatek, Inc. | 11 Mt2735, Mt2735 Firmware, Mt2737 and 8 more | 2026-08-19 | 5.5 Medium |
| In med, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS10981478 (Note: For MT6890, MT6990, MT6988) / AUTO00851173 (Note: For MT2735, MT2737); Issue ID: MSV-7652. | ||||
| CVE-2026-21710 | 2 Nodejs, Redhat | 4 Node.js, Nodejs, Enterprise Linux and 1 more | 2026-08-19 | 7.5 High |
| A flaw in Node.js HTTP request handling causes an uncaught `TypeError` when a request is received with a header named `__proto__` and the application accesses `req.headersDistinct`. When this occurs, `dest["__proto__"]` resolves to `Object.prototype` rather than `undefined`, causing `.push()` to be called on a non-array. This exception is thrown synchronously inside a property getter and cannot be intercepted by `error` event listeners, meaning it cannot be handled without wrapping every `req.headersDistinct` access in a `try/catch`. * This vulnerability affects all Node.js HTTP servers on **20.x, 22.x, 24.x, and v25.x** | ||||