Export limit exceeded: 392328 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (392328 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18116 | 1 Concretecms | 1 Concrete Cms | 2026-09-15 | N/A |
| Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval workflow could submit an event whose name contained a script payload, which then executed in an administrator's browser when the pending request was displayed and could be used to create a new administrator account. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks v01demort for reporting. | ||||
| CVE-2026-14986 | 1 Zephyrproject | 1 Zephyr | 2026-09-15 | 6.8 Medium |
| The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copies host-supplied write data into the fixed-size data->target_in_buffer inside its target FIFO interrupt handler target_i2c_isr_fifo() in drivers/i2c/i2c_ite_it51xxx.c. The copy loop stores to target_in_buffer[i + data->w_index] and only checks data->w_index against sizeof(data->target_in_buffer) after the write has already completed, so the bounds check cannot prevent the overflow. The running index data->w_index accumulates count bytes on every FIFO-fill interrupt of an ongoing transaction and is reset to zero only on a STOP or timeout condition. An I2C host that streams a single write transaction longer than the buffer (default CONFIG_I2C_TARGET_IT51XXX_MAX_BUF_SIZE = 256 bytes) drives data->w_index past the end of the buffer, and each subsequent host byte is written out of bounds into the adjacent data->target_out_buffer and following static device data. The trigger is a malicious or misbehaving I2C master on the same bus (for example a compromised application processor or a rogue device on an exposed I2C bus); no software privilege on the victim is required and the handler runs in the target's kernel/firmware context. Because both the written values and the overflow length are attacker-controlled, this is an out-of-bounds write that can crash the controller or be shaped toward code execution. The fix adds a pre-write bounds check in target_i2c_fifo_read_to_buf() that aborts and resets the FIFO before any out-of-bounds store. | ||||
| CVE-2026-14277 | 1 Ibm | 1 I Access Family | 2026-09-15 | 6.3 Medium |
| IBM i Access Family 1.1.2.0 through 1.1.9.15 could allow an authenticated user to execute arbitrary commands with normal user privileges on the system due to improper validation of user supplied input in a session file. | ||||
| CVE-2026-13285 | 1 Ibm | 1 Mq | 2026-09-15 | 7.1 High |
| IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.25 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. | ||||
| CVE-2025-9606 | 1 Portabilis | 1 I-educar | 2026-09-15 | 6.3 Medium |
| A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this vulnerability is an unknown functionality of the file /intranet/agenda_preferencias.php. Performing a manipulation of the argument cod_agenda results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. Upgrading to version 2.12 addresses this issue. Upgrading the affected component is advised. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced." | ||||
| CVE-2025-9531 | 1 Portabilis | 1 I-educar | 2026-09-15 | 6.3 Medium |
| A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /intranet/agenda.php of the component Agenda Module. Performing a manipulation of the argument cod_agenda results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 2.12 mitigates this issue. It is suggested to upgrade the affected component. The vendor confirms: "The reported attack vector was tested against the corrected code, and the previously described SQL Injection behavior could no longer be reproduced." | ||||
| CVE-2026-28662 | 1 Google | 1 Android | 2026-09-15 | 8 High |
| In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28658 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-28657 | 1 Google | 1 Android | 2026-09-15 | 7.8 High |
| In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-78299 | 2026-09-15 | 9.1 Critical | ||
| In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk. | ||||
| CVE-2026-92050 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92051 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92053 | 1 Mozilla | 1 Firefox | 2026-09-15 | 8.8 High |
| Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92055 | 1 Mozilla | 1 Firefox | 2026-09-15 | 8.8 High |
| Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92057 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92058 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92059 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||
| CVE-2026-92061 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92063 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156. | ||||
| CVE-2026-92064 | 1 Mozilla | 1 Firefox | 2026-09-15 | N/A |
| Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. | ||||