Export limit exceeded: 392110 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (392110 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91950 | 1 Freerdp | 1 Freerdp | 2026-09-15 | 6.5 Medium |
| FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs. | ||||
| CVE-2026-91945 | 1 Freerdp | 1 Freerdp | 2026-09-15 | 6.5 Medium |
| FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination. | ||||
| CVE-2026-91934 | 1 Flowiseai | 1 Flowise | 2026-09-15 | 8.8 High |
| Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers to write arbitrary files. Attackers can write malicious SQLite databases to system directories or inject files into the web root to execute commands or perform stored XSS attacks. | ||||
| CVE-2026-91929 | 1 Flowiseai | 1 Flowise | 2026-09-15 | 7.1 High |
| Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attackers with Enterprise access can delete arbitrary workspaces, invite themselves into other organizations, modify cross-org roles, and abuse stored SSO secrets. | ||||
| CVE-2026-91842 | 1 Openbankproject | 1 Obp-api | 2026-09-15 | 4.1 Medium |
| A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-90805 | 1 Subhajitkhan | 1 Online-clinic-management-system | 2026-09-15 | 7.3 High |
| A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument doc_mail/doc_pswd can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-90786 | 1 Dvidelabs | 1 Flatcc | 2026-09-15 | 5.3 Medium |
| A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/semantics.c of the component Duplicate Symbol Handler. This manipulation causes reachable assertion. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 8b19ba4e992ebcad7f5970704d1afc5507fa5205. To fix this issue, it is recommended to deploy a patch. | ||||
| CVE-2026-90698 | 1 Memcached | 1 Memcached | 2026-09-15 | 5.3 Medium |
| A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component. | ||||
| CVE-2026-90688 | 1 Tenda | 2 W20e, W20e Firmware | 2026-09-15 | 6.5 Medium |
| A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the component HTTP Handler. Such manipulation of the argument IPMacBindRule leads to stack-based buffer overflow. It is possible to launch the attack remotely. | ||||
| CVE-2026-89160 | 1 Pcre | 1 Pcre2 | 2026-09-15 | 3.7 Low |
| PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. | ||||
| CVE-2026-88061 | 1 Santifer | 1 Career-ops | 2026-09-15 | N/A |
| career-ops is an open-source AI-assisted job search and application management tool. Prior to 0.8.0, the career-ops local web dashboard web/ exposed command-spawning and user-file-writing /api routes without validating request origin or restricting clients to loopback addresses. A malicious page in another browser tab could send cross-origin localhost requests while the dashboard was running, and a dashboard bound beyond loopback could receive direct requests from the local network. Both paths allowed unauthenticated command execution as the dashboard user, but npm installations were unaffected because web/ is excluded from the published package. This issue is fixed in version 0.8.0. | ||||
| CVE-2026-86903 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | 5.5 Medium |
| An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. An app may be able to disclose kernel memory. | ||||
| CVE-2026-86889 | 1 Apple | 1 Macos | 2026-09-15 | 4.8 Medium |
| A certificate validation issue was addressed with improved certificate validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to intercept network traffic. | ||||
| CVE-2026-86885 | 1 Apple | 1 Ios And Ipados | 2026-09-15 | 6.5 Medium |
| An input validation issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27. An attacker in radio range may be able to cause unexpected system termination. | ||||
| CVE-2026-86882 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | 6.5 Medium |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted image may lead to unexpected process termination. | ||||
| CVE-2026-84630 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | 4.7 Medium |
| A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-84617 | 1 Apple | 3 Ios And Ipados, Macos, Tvos | 2026-09-15 | 5.5 Medium |
| An authorization issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27. An app may be able to access sensitive user data. | ||||
| CVE-2026-84586 | 1 Apple | 2 Macos, Watchos | 2026-09-15 | 5.5 Medium |
| An information disclosure issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, watchOS 27. A malicious application may be able to leak sensitive user information. | ||||
| CVE-2026-84562 | 1 Apple | 1 Macos | 2026-09-15 | 4.7 Medium |
| A race condition was addressed with additional validation. This issue is fixed in macOS Tahoe 26.6. An app may be able to access protected user data. | ||||
| CVE-2026-84554 | 1 Apple | 1 Macos | 2026-09-15 | 5.9 Medium |
| An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attacker in a privileged network position may be able to cause a denial-of-service. | ||||