Export limit exceeded: 377116 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377116 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-61933 | 1 Microsoft | 7 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 4 more | 2026-08-13 | 5.5 Medium |
| Out-of-bounds read in Windows DWM Core Library allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-53226 | 1 Linux | 1 Linux Kernel | 2026-08-13 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: fix generic IRQ chip leak on remove The driver allocates domain generic chips using irq_alloc_domain_generic_chips() during probe. However, on driver remove/teardown, the generic chips are not automatically freed when the IRQ domain is removed because the domain flags do not include IRQ_DOMAIN_FLAG_DESTROY_GC. This causes both the domain generic chips structure and the associated generic chips to be leaked. Additionally, the generic chips remain on the global gc_list and may later be visited by generic IRQ chip suspend, resume, or shutdown callbacks after the GPIO bank has been removed, potentially resulting in a use-after-free and kernel crash. Fix the resource leak by explicitly calling irq_domain_remove_generic_chips() before removing the IRQ domain in rockchip_gpio_remove(). | ||||
| CVE-2026-53238 | 1 Linux | 1 Linux Kernel | 2026-08-13 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: netlabel: validate unlabeled address and mask attribute lengths netlbl_unlabel_addrinfo_get() used the address attribute length to determine whether the attribute data could be read as an IPv4 or IPv6 address, but did not independently validate the corresponding mask attribute length. A crafted Generic Netlink request could therefore provide a valid IPv4/IPv6 address attribute with a shorter mask attribute, which would later be read as a full struct in_addr or struct in6_addr. NLA_BINARY policy lengths are maximum lengths by default, so use NLA_POLICY_EXACT_LEN() for the unlabeled IPv4/IPv6 address and mask attributes. This rejects short attributes during policy validation and also exposes the exact length requirements through policy introspection. | ||||
| CVE-2026-8986 | 1 Autel | 2 Maxicharger Single Charger, Maxicharger Single Charger Firmware | 2026-08-13 | 9.8 Critical |
| Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station. | ||||
| CVE-2026-8984 | 1 Autel | 2 Maxicharger Single Charger, Maxicharger Single Charger Firmware | 2026-08-13 | 9.8 Critical |
| Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges. | ||||
| CVE-2026-21764 | 1 Hcltech | 1 Devops Loop | 2026-08-13 | 3.1 Low |
| HCL DevOps Loop is affected by insufficient input validation that allows special characters where they should be restricted. This may result in unintended application behavior under certain conditions. | ||||
| CVE-2026-72526 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 9.9 Critical |
| A flaw was found in the multicloud-integrations component. The Application propagation controller processes the `ocm-managed-cluster` annotation from an Application Custom Resource (CR) without proper validation. A tenant with permissions to create Applications on the hub cluster can exploit this to target arbitrary managed clusters. This can force ArgoCD on the spoke clusters to synchronize attacker-controlled manifests, leading to arbitrary code execution or privilege escalation on those clusters. | ||||
| CVE-2026-70398 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 9.6 Critical |
| A flaw was found in multicloud-integrations, a component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows an authenticated user, referred to as a tenant, to manipulate the GitOpsCluster controller. By exploiting this, a tenant can redirect sensitive spoke cluster bearer tokens from secure locations to a namespace they control. This unauthorized access to tokens can lead to the disclosure of critical information and bypass security policies within ArgoCD AppProjects. | ||||
| CVE-2026-73122 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 7.7 High |
| A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information. Specifically, the agent can read all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories. This could lead to significant information disclosure. | ||||
| CVE-2026-64927 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 6.4 Medium |
| A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information, known as Secrets, across different parts of the system (namespaces). By exploiting this, an attacker can modify these Secrets in unauthorized areas. This could lead to unauthorized access to information or elevated privileges within the system. | ||||
| CVE-2026-73607 | 1 Siyuan | 1 Siyuan | 2026-08-13 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any document by supplying its identifier, even for documents forbidden to the requester. | ||||
| CVE-2026-73609 | 1 Siyuan | 1 Siyuan | 2026-08-13 | 5.8 Medium |
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers can obtain the complete bookmark vocabulary across the workspace, disclosing subject matter and organizational information from inaccessible documents. | ||||
| CVE-2026-73610 | 1 Siyuan | 1 Siyuan | 2026-08-13 | 5.8 Medium |
| SiYuan before v3.7.4 contains an information disclosure vulnerability in the local storage filter that returns the administrator's entire storage map with only three keys sanitized. Unauthenticated attackers or publish readers can retrieve closed-tab history, search keywords, private document identifiers, and expanded folder paths by calling the getLocalStorage endpoint. | ||||
| CVE-2026-18725 | 1 Open-iscsi Project | 1 Open-iscsi | 2026-08-13 | 6.3 Medium |
| AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to trust an inflated `ipv6_plen` larger than the actual received payload, leading to MTU-bounded out-of-bounds reads and a potential one-byte out-of-bounds write that may disclose data beyond the valid packet boundary. Requirements to exploit: Adjacent-network access on the same L2 segment as a system running `iscsiuio` on an interface that processes IPv6/NDP traffic, plus the ability to send a crafted ICMPv6 Echo Request with a forged `IPv6.plen`. No authentication or user interaction is required. Component affected: `iscsi-initiator-utils` (`iscsiuio`): `iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and `ipv6_insert_protocol_chksum()`. Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when `iscsiuio` is processing IPv6/NDP traffic on a reachable interface. Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM) AV:A - Reachability is limited to an attacker on the same L2 segment who can send crafted IPv6/ICMPv6 traffic to the affected interface. AC:L - The attack relies on forging `IPv6.plen`; no race or unusual environment is needed beyond the vulnerable deployment. PR:N - No privileges are required. UI:N - No user interaction is required. S:U - The impact remains within the `iscsiuio` process and its packet buffer handling. C:L - The reply/checksum path can read and potentially transmit data beyond the valid packet boundary, but the demonstrated exposure is MTU-bounded. I:L - For odd forged lengths, the checksum path can write a single padding byte past the valid protocol data, which may affect adjacent buffer contents. A:L - Invalid memory access may destabilize or crash the process, but reliable high-impact denial of service is not established from the available evidence. Impact: Moderate. Under Red Hat's severity guidance, this is more consistent with a flaw that can affect confidentiality, integrity, or availability under constrained circumstances than with an Important issue. The bug is unauthenticated and adjacent-network reachable, but the currently supported outcome is MTU-bounded out-of-bounds access in a deployment-dependent IPv6/NDP path, not easy remote system compromise or clearly high-impact memory corruption. Embargo: no Reason: The currently supported impact is Moderate, exposure depends on `iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators can reduce exposure operationally by isolating or disabling the affected path. Acknowledgement: Aisle Research Vulnerability Details: In the ICMPv6 echo-reply path, the code reuses the inbound `ipv6_plen` field when sizing the reply instead of clamping it to the bytes actually received: ```c /* iscsiuio/src/uip/ipv6.c */ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { ... ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen)); } ``` Later, checksum generation also trusts `ipv6_plen` for memory traversal, and for odd lengths it writes a padding byte at `ptr + protocol_data_len` before iterating over `protocol_data_len` bytes: ```c /* iscsiuio/src/uip/ipv6.c */ protocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen); ... if (protocol_data_len & 1) { *((u8_t *) ptr + protocol_data_len) = 0; protocol_data_len++; } for (i = 0; i < protocol_data_len / 2; i++) { sum += HOST_TO_NET16(*ptr); ptr++; } ``` The available receive-side logic does not establish a payload-length bound strong enough to eliminate this condition. `uip_input()` compares the IPv6 payload length against `uip_len`, but `uip_len` is treated as full frame length in the observed path rather than the actual IPv6 payload length, and `ipv6_rx_packet()` receives a `len` argument without using it to bound parsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload stored in the buffer. The available evidence supports MTU-bounded out-of-bounds access in normal receive paths rather than the earlier arbitrary 64KB worst case. The affected logic appears to be present in the available 6.2.1.11 code base, but this report is scoped to the scanned SRPM package. Steps to reproduce: 1. Build `iscsiuio` with ASAN enabled. 2. Run `iscsiuio` with IPv6/NDP active on a test interface. 3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen` set larger than the actual payload bytes in the frame buffer; one tested shape is `plen=1491` with an Ethernet frame size near 1500 bytes. 4. Observe the reply path: ASAN reports invalid access in `ipv6_insert_protocol_chksum()` as the checksum walk reads past valid packet data, odd lengths may also trigger a one-byte write, and reply sizing is derived from the forged `ipv6_plen` rather than the actual received payload size. Mitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on trusted L2 segments only. Where operationally acceptable, disable IPv6 on those interfaces or filter ICMPv6 Echo Requests before they reach `iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific path is not reachable. Proposed Fix: Clamp the reply payload length to the actual received payload derived from `context->ustack->uip_len`, reject packets too short to contain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before calling `ipv6_send()`. ```diff diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c @@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { struct eth_hdr *eth = (struct eth_hdr *)context->ustack->data_link_layer; +u16_t rx_total, rx_payload, hdr_plen, safe_plen; +u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr); struct ipv6_hdr *ipv6 = (struct ipv6_hdr *)context->ustack->network_layer; struct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 + @@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) icmp->icmpv6_code = 0; icmp->icmpv6_cksum = 0; ILOG_DEBUG("IPv6: Send echo reply"); -ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen)); + +rx_total = context->ustack->uip_len; +if (rx_total <= l2_l3_len) +return; + +rx_payload = rx_total - l2_l3_len; +hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen); +safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload; +if (safe_plen < sizeof(struct icmpv6_hdr)) +return; + +ipv6->ipv6_plen = HOST_TO_NET16(safe_plen); +ipv6_send(context, l2_l3_len + safe_plen); + return; } ``` ------ This report was generated using AI technology. Always review AI-generated content prior to use | ||||
| CVE-2026-7366 | 1 Ibm | 3 Datapower Gateway 1050, Datapower Gateway 1060, Datapower Gateway 1100 | 2026-08-13 | 4.2 Medium |
| IBM DataPower Gateway 11.0.0.0 through 11.0.0.1 and IBM DataPower Gateway 10.5.0.0 through 10.5.0.21 and IBM DataPower Gateway 10.6.0.0 through 10.6.0.9 allows a race condition that results in improper isolation of request state when handling the built‑in X‑Client‑IP header. Under concurrent request processing, X‑Client‑IP values may be contaminated across requests, enabling IP spoofing and disclosure of other clients’ IP addresses. | ||||
| CVE-2026-73626 | 1 Jupyter | 1 Jupyterlab | 2026-08-13 | 0 Low |
| JupyterLab versions >=4.6.0,<=4.6.1 and <=4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install(). A missing 'await' caused the is_install_allowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install(). The stock JupyterLab HTTP API and Extension Manager UI are not affected, as they perform a separate, correctly awaited check. The issue affects only deployments where a custom extension or downstream integration imports PyPIExtensionManager and calls install() directly with a package name influenced by untrusted input, an allowlist/blocklist is configured, the PyPI Extension Manager is enabled, and kernels and terminals are disabled or delegated to remote hosts. Fixed in JupyterLab 4.6.2 and 4.5.10. | ||||
| CVE-2026-73622 | 1 Gitpython-developers | 1 Gitpython | 2026-08-13 | 7.5 High |
| GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into .git/config and .gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations. | ||||
| CVE-2026-73618 | 1 Budibase | 1 Budibase | 2026-08-13 | 8.3 High |
| Budibase Server before 3.40.0 contains a NoSQL injection vulnerability in the MongoDB query execution endpoint where user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permission can inject JSON structural characters to alter MongoDB queries, bypassing filters to read, modify, or delete arbitrary documents. | ||||
| CVE-2026-73614 | 1 Jovancoding | 1 Network-ai | 2026-08-13 | 8.8 High |
| Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field to bypass the operator's hard-deny list and execute arbitrary commands. | ||||
| CVE-2026-73606 | 2026-08-13 | 5.8 Medium | ||
| SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/block/getRefIDs endpoint that fails to check password-protected document tiers. Unauthenticated readers can discover that password-protected documents reference specific blocks and obtain block identifiers without entering the document password. | ||||