Export limit exceeded: 14161 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (14161 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16527 | 1 Redhat | 3 Enterprise Linux, Openshift, Openshift Container Platform | 2026-08-07 | 7.3 High |
| An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. | ||||
| CVE-2026-65668 | 1 Microsoft | 2 Office Purview Ediscovery, Purview Ediscovery | 2026-08-07 | 8.8 High |
| Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-56161 | 1 Microsoft | 1 Azure Logic Apps | 2026-08-07 | 9.6 Critical |
| Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-62896 | 1 Microsoft | 1 Teams | 2026-08-07 | 9.6 Critical |
| Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-66451 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-08-06 | 6.5 Medium |
| Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions. | ||||
| CVE-2026-18974 | 1 Heshengtao | 1 Super-agent-party | 2026-08-06 | 5.3 Medium |
| A vulnerability was found in heshengtao super-agent-party up to 0.4.1. This affects the function get_file_content of the file server.py of the component execute_tool_manually Endpoint. The manipulation of the argument tool_name/tool_params results in information disclosure. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-18990 | 1 Letta-ai | 1 Lettabot | 2026-08-06 | 7.3 High |
| A vulnerability was detected in letta-ai LettaBot 0.2.0. Impacted is an unknown function of the file src/api/server.ts of the component API Status Route. The manipulation results in missing authentication. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-70430 | 1 Jenkins Project | 1 Jenkins | 2026-08-06 | 2.7 Low |
| Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those intended for configuration only by administrators. | ||||
| CVE-2026-18992 | 1 Zhayujie | 1 Cowagent | 2026-08-06 | 6.3 Medium |
| A vulnerability was detected in zhayujie CowAgent up to 2.1.1. This vulnerability affects the function _select_tools of the file agent/evolution/executor.py of the component Self-Evolution Review Agent. Performing a manipulation results in incorrect authorization. The attack is possible to be carried out remotely. The exploit is now public and may be used. | ||||
| CVE-2026-18998 | 1 Cosmicstack-labs | 1 Mercury-agent | 2026-08-06 | 6.3 Medium |
| A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2025-63822 | 2026-08-06 | 8.1 High | ||
| SirenGPS Android Application 2.19.44 is vulnerable to Incorrect Access Control. An authenticated attacker can manipulate user identifier parameters to bypass authorization controls and gain unauthorized READ and WRITE access to other users' personal information. The API fails to validate that the requesting user is authorized to access the target user's data. | ||||
| CVE-2025-63823 | 2026-08-06 | 9.8 Critical | ||
| My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values. | ||||
| CVE-2026-18969 | 1 Rongzhitong | 1 Visual Integrated Command And Dispatch Platform | 2026-08-06 | 7.3 High |
| A vulnerability was detected in Rongzhitong Visual Integrated Command and Dispatch Platform up to 20260617. Impacted is an unknown function of the file /dm/dispatch/userinfo/upload. Performing a manipulation of the argument File results in unrestricted upload. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-18995 | 1 Netease-youdao | 1 Lobsterai | 2026-08-06 | 4.3 Medium |
| A flaw has been found in netease-youdao LobsterAI 2026.6.10. This affects the function parseMediaTokensFromText of the file src/renderer/services/artifactParser.ts of the component MEDIA Path Handler. This manipulation causes information disclosure. The attack is possible to be carried out remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-18997 | 1 Cosmicstack-labs | 1 Mercury-agent | 2026-08-06 | 6.3 Medium |
| A vulnerability was found in cosmicstack-labs mercury-agent up to 1.1.12. This issue affects the function Agent.handleBgCommand of the file src/core/agent.ts of the component bg Command Handler. Performing a manipulation results in incorrect authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-14829 | 2026-08-06 | 8.2 High | ||
| The Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13 does not properly restrict access to its license-management functionality, relying on a shared secret computed entirely from publicly available information, allowing unauthenticated attackers to deactivate the Checkimate — WooCommerce Checkout, Abandoned Cart Recovery & Order Bumps WordPress plugin through 1.0.13's premium licensing state and erase the stored license key. | ||||
| CVE-2026-14547 | 2026-08-06 | 5.3 Medium | ||
| The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not properly enforce its anti-spam check or restrict the recipient routing of its property request form, allowing unauthenticated users to send emails to arbitrary recipients with arbitrary subject, body and Reply-To, effectively using the site as a mail relay for spam or phishing. | ||||
| CVE-2026-18993 | 1 Nousresearch | 1 Hermes-agent | 2026-08-06 | 6.3 Medium |
| A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used. | ||||
| CVE-2026-55978 | 1 Secureage | 1 Catchpulse | 2026-08-06 | 8.4 High |
| An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement. | ||||
| CVE-2026-55979 | 1 Secureage | 1 Catchpulse | 2026-08-06 | 5.2 Medium |
| An improper access control check in CatchPulse's named pipe communication interface could allow an attacker to invoke CatchPulse functions. This is limited to operations that enforce more restrictive security policies. | ||||