Export limit exceeded: 377266 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377266 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377266 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16494 | 1 Gitlab | 1 Gitlab | 2026-08-13 | 7.1 High |
| GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint. | ||||
| CVE-2026-16459 | 1 Oberon Microsystems Ag | 1 Oberon Psa Crypto | 2026-08-13 | N/A |
| Padding oracle attack vulnerability in Oberon microsystem AG’s Oberon PSA Crypto library in all versions since 1.0.0 and prior to 2.1.1 allows an attacker to recover plaintexts via timing measurements of RSA PKCS#1 v1.5 decrypt operations. | ||||
| CVE-2026-15423 | 1 Gitlab | 1 Gitlab | 2026-08-13 | 8.5 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation. | ||||
| CVE-2026-15413 | 2026-08-13 | 10 Critical | ||
| The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check). | ||||
| CVE-2026-15217 | 1 Gitlab | 1 Gitlab | 2026-08-13 | 8.7 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component. | ||||
| CVE-2026-15216 | 1 Gitlab | 1 Gitlab | 2026-08-13 | 8.7 High |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component. | ||||
| CVE-2026-14298 | 1 Mattermost | 1 Mattermost | 2026-08-13 | 6.5 Medium |
| Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713 | ||||
| CVE-2026-14213 | 2 Ameliabooking, Wordpress | 2 Booking For Appointments And Events Calendar, Wordpress | 2026-08-13 | 3.7 Low |
| The Booking for Appointments and Events Calendar WordPress plugin before 2.4.6 does not verify that an authenticated employee (provider) is assigned to the appointment being accessed, allowing any employee to read any appointment by its identifier and disclose the booked customer's personal data. | ||||
| CVE-2026-14182 | 2 Wordpress, Wpfactory | 2 Wordpress, Customer Email Verification For Woocommerce | 2026-08-13 | 9.8 Critical |
| The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address. | ||||
| CVE-2026-13433 | 1 Ibm | 1 I Access Client Solutions | 2026-08-13 | 8.3 High |
| IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update from an IBM i. A bad actor could use this vulnerablity to run compromised code on the ACS user's workstation. | ||||
| CVE-2026-12263 | 1 Zohocorp | 2 Manageengine Pam360, Manageengine Password Manager Pro | 2026-08-13 | 8.8 High |
| Zohocorp ManageEngine Password Manager Pro versions before 13232 and PAM360 versions before 8551 are vulnerable to an authentication bypass vulnerability due to improper SAML validation. | ||||
| CVE-2026-12004 | 1 Ibm | 4 Security Verify Access, Security Verify Access Container, Verify Identity Access and 1 more | 2026-08-13 | 8.7 High |
| IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 contains a format string injection vulnerability in the management interface that allows attackers to cause denial of service and information disclosure by crafting a malicious HTTP request. | ||||
| CVE-2026-11970 | 1 Forcepoint | 1 F1e Mac | 2026-08-13 | N/A |
| This vulnerability allows a normal (non-admin) user to disable the Forcepoint One Endpoint SafariExtension and bypass DLP protection in F1E Mac OS before v26.04.5758. | ||||
| CVE-2026-11840 | 1 Zohocorp | 2 Manageengine Pam360, Manageengine Password Manager Pro | 2026-08-13 | 8.8 High |
| Zohocorp ManageEngine Password Manager Pro versions before 13232 and ManageEngine PAM360 versions before 8552 are vulnerable to authenticated SQL injection. | ||||
| CVE-2026-10543 | 1 Ibm | 1 Db2 | 2026-08-13 | 8.2 High |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query. | ||||
| CVE-2025-31114 | 1 Lllyasviel | 1 Fooocus | 2026-08-13 | N/A |
| Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available. | ||||
| CVE-2024-8060 | 1 Open-webui | 1 Open-webui | 2026-08-13 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2024-7990 | 1 Open-webui | 1 Open-webui | 2026-08-13 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2024-7053 | 2026-08-13 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2024-7046 | 1 Open-webui | 1 Open-webui | 2026-08-13 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||