Export limit exceeded: 391908 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (391908 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-92041 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Mitigation bypass in the DOM: Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92042 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Race condition in the DOM: Content Processes component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92018 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. | ||||
| CVE-2026-92021 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox ESR 140.16. | ||||
| CVE-2026-92023 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the XML component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. | ||||
| CVE-2026-92029 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the SVG component. This vulnerability was fixed in Firefox 156, Firefox ESR 115.41, Firefox ESR 140.16, and Firefox ESR 153.3. | ||||
| CVE-2026-92030 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Mitigation bypass in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. | ||||
| CVE-2026-76191 | 3 Adobe, Apple, Microsoft | 5 Adobe Animate 2023, Adobe Animate 2024, Animate and 2 more | 2026-09-15 | 8.2 High |
| Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-77179 | 1 Docker | 1 Docker Sandboxes | 2026-09-15 | N/A |
| On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path. A malicious guest can replace a parent directory with a symlink, escape the shared workspace, and read or modify arbitrary host files as the VMM user, potentially achieving host code execution. | ||||
| CVE-2026-81381 | 1 Microsoft | 1 Visual Studio Code | 2026-09-15 | 6.5 Medium |
| Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-92005 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3. | ||||
| CVE-2026-92054 | 2026-09-15 | 8.8 High | ||
| Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92003 | 1 Misp | 1 Misp | 2026-09-15 | N/A |
| Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure branches wrote directly to the Log model: - API requests with no authentication key; - requests supplying an API key with an incorrect length Unlike other authentication failures, these paths bypassed _shouldLog(), so every request could create another durable auth_fail entry. Version affected: ≤2.5.45 | ||||
| CVE-2026-91994 | 1 Semaphoreui | 1 Semaphore | 2026-09-15 | 6.5 Medium |
| Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner roles can read all project environments including plaintext secrets, credentials, and passwords via GET requests to the environment endpoint. | ||||
| CVE-2026-91925 | 2026-09-15 | 8.8 High | ||
| Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, allowing authenticated users to execute arbitrary code. Attackers can submit runs with Jinja2 payloads in queue, namespace, conditions, presets, or dependencies fields to execute operating system commands in the scheduler process context, exposing database credentials and service tokens. | ||||
| CVE-2026-91922 | 1 Steedos | 1 Steedos-platform | 2026-09-15 | 6.1 Medium |
| Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials. | ||||
| CVE-2026-91859 | 1 Misp | 1 Misp | 2026-09-15 | N/A |
| Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController extends AppController, exception rendering runs the application startup path a second time. As a result, __accessMonitor() calls AccessLog::logRequest() twice for one HTTP request. The second deferred writer measures the error-controller execution instead of the original request and can overwrite the row created by the first pass. The corrupted fields include request duration, SQL query count, memory usage, and potentially the recorded query log. The bug was masked because the same model instance retained the ID of the first saved row, causing the later save to issue an UPDATE rather than insert an obvious duplicate row. Version affected: ≤2.5.45 | ||||
| CVE-2026-89308 | 1 Trexom | 1 Trxtimeattendance | 2026-09-15 | N/A |
| An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary commands on the underlying operating system and achieve remote code execution. | ||||
| CVE-2026-86818 | 1 Fast-uri | 1 Fast-uri | 2026-09-15 | 4.8 Medium |
| fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3. In versions 4.1.3 and 4.1.4, the mailto parser compares each query field name to the reserved names to, subject, and body while the name is still percent-encoded, and decodes it only when storing it as a generic header, so a percent-encoded spelling of a reserved field name is not recognized as that field at parse time but is re-emitted as the literal field name when the parsed URI is serialized. An application that validates, logs, or displays the recipient list from the first parse and then serializes the URI and sends it can silently gain an attacker-chosen recipient, and the subject and body fields can be smuggled across the same roundtrip. The issue is fixed in fast-uri 4.1.5, and users should upgrade to 4.1.5 or later. As a workaround, do not act on a mailto URI that fast-uri has re-serialized without first decoding and re-validating its recipient, subject, and body fields. | ||||
| CVE-2026-86472 | 1 Fast-uri | 1 Fast-uri | 2026-09-15 | 4.8 Medium |
| fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize, and equal then disagree on the same host. An application that makes a case-sensitive host decision on fast-uri output, for example a host allowlist or denylist that compares the parsed host or uses equal, can be steered past the check with a percent-encoded uppercase octet, and because hostnames are case-insensitive in DNS and HTTP the evading spelling still reaches the host the check meant to gate. The issue is fixed in fast-uri 2.4.7, 3.1.8, and 4.1.5, and users should upgrade to one of those versions or later. As a workaround, compare hosts case-insensitively by lowercasing the parsed host before any allowlist or denylist decision. | ||||