Export limit exceeded: 30244 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 95406 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (95406 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59795 | 1 Jetbrains | 1 Teamcity | 2026-07-31 | 8.1 High |
| In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible | ||||
| CVE-2026-54429 | 1 Siemens | 1 Simatic S7-plcsim Advanced | 2026-07-31 | 7.4 High |
| A vulnerability has been identified in SIMATIC S7-PLCSIM Advanced (All versions). Affected devices do not properly handle high-volume multicast network traffic, which can exhaust available memory resources in the affected application. This could allow an unauthenticated attacker on the local network segment to cause a denial-of-service condition of the affected application. The affected application becomes inaccessible and requires a manual restart; no project data is lost. Successful exploitation requires a specific project configuration to be already active on the targeted instance. | ||||
| CVE-2026-62641 | 1 Roundcube | 1 Webmail | 2026-07-31 | 4.3 Medium |
| In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size. | ||||
| CVE-2026-54433 | 1 Roundcube | 1 Webmail | 2026-07-31 | 7.2 High |
| In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click). | ||||
| CVE-2026-22622 | 1 Eaton | 1 Padm | 2026-07-31 | 8.8 High |
| Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated user to elevate privileges resulting in unrestricted access to the device. | ||||
| CVE-2026-12940 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-07-31 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP (Model Context Protocol) stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS_ENV_VARS blocklist fails to include SHELLOPTS , BASHOPTS , and PS4 environment variables. | ||||
| CVE-2026-17969 | 1 Google | 1 Chrome | 2026-07-31 | 8.8 High |
| Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-17774 | 1 Google | 1 Chrome | 2026-07-31 | 7.5 High |
| Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Medium) | ||||
| CVE-2026-58557 | 1 Huawei | 1 Harmonyos | 2026-07-31 | 4.8 Medium |
| Design defect vulnerability in Expedition mode. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-58559 | 1 Huawei | 2 Emui, Harmonyos | 2026-07-31 | 6.5 Medium |
| DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-15324 | 2 Phppoet, Wordpress | 2 Sysbasics Customize My Account For Woocommerce – Live My Account Customizer, Wordpress | 2026-07-31 | 4.4 Medium |
| The SysBasics Customize My Account for WooCommerce – Live My Account Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'row_type' parameter in all versions up to, and including, 4.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with shop manager-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-14371 | 1 Lenovo | 1 Xclarity Integrator For Microsoft Windows Admin Center | 2026-07-31 | N/A |
| The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing remote PowerShell commands. | ||||
| CVE-2025-51678 | 1 Yosyshq | 1 Picorv32 | 2026-07-31 | 7.5 High |
| An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior. | ||||
| CVE-2026-15395 | 2 Wordpress, Wpchill | 2 Wordpress, Kali Forms — Contact Form & Drag-and-drop Builder | 2026-07-31 | 7.2 High |
| The Kali Forms — Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'digitalSignature' Field Value in all versions up to, and including, 2.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required form-submission nonce is publicly available on any page containing the form shortcode, making this exploitable by fully unauthenticated attackers without any precondition beyond the form being published. | ||||
| CVE-2019-25764 | 1 Asus | 1 Aura Sync | 2026-07-31 | N/A |
| **UNSUPPORTED WHEN ASSIGNED** Exposed IOCTL with Insufficient Access Control in the ASUS AURA SYNC driver allows a local user to bypass the driver's verification and invoke arbitrary IOCTLs, resulting in privilege escalation. Refer to the 'End-of-Life Notice and Driver Update for Legacy ASUS Drivers ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2024-23565 | 1 Hclsoftware | 1 Aftermarket Epc | 2026-07-31 | 5.3 Medium |
| HCL Aftermarket EPC is vulnerable to email flooding as the application does not have a proper mail limitation mechanism at Forget Password functionality. The actor could b e a human or an automated process such as a virus or bot. This could be used to cause a denial of service, compromise program logic or other consequences. | ||||
| CVE-2025-59866 | 1 Hcltech | 3 Dfmpro For Catia, Dfxanalytics, Dfxserver | 2026-07-31 | 3.3 Low |
| The HCL DFMPro, DFXAnalytics and DFXServer installers are affected by ‘Insecure file permissions Leading to Privilege Escalation’ vulnerability, which enables any logged-in non-administrative user to overwrite or replace the executable file with a malicious binary. | ||||
| CVE-2026-21264 | 1 Microsoft | 2 Account, Microsoft Account | 2026-07-30 | 9.3 Critical |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-40953 | 1 Absolute | 1 Secure Access | 2026-07-30 | 4.4 Medium |
| CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control. | ||||
| CVE-2026-50144 | 1 Tencent | 1 Ncnn | 2026-07-30 | 7.1 High |
| ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020. | ||||