Export limit exceeded: 377391 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377391 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377391 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 377391 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (377391 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-67613 | 2 Cyberpanel, Usmannasir | 2 Cyberpanel, Cyberpanel | 2026-08-14 | 4.9 Medium |
| CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files. | ||||
| CVE-2026-64639 | 1 Webpros | 1 Plesk | 2026-08-14 | N/A |
| Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator. | ||||
| CVE-2026-63702 | 2026-08-14 | 6.3 Medium | ||
| Dell Wyse Management Suite (WMS), versions prior to 2605.0.2, contain a Use of Hard-coded Credentials vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. | ||||
| CVE-2026-59765 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.5 High |
| SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata | ||||
| CVE-2026-16708 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-14 | 8.3 High |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to obtain sensitive information due to external control of system configuration. | ||||
| CVE-2026-58508 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 9.1 Critical |
| Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation) | ||||
| CVE-2026-58507 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 5.3 Medium |
| Private Repository Existence Disclosure via go-get Meta Endpoint | ||||
| CVE-2026-58445 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 2.7 Low |
| Cross-repository label-ID enumeration oracle via unscoped DeleteIssueLabel API | ||||
| CVE-2026-58444 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 4.3 Medium |
| Personal access token scope enforcement bypass on the repository home page (`GET /{owner}/{repo}`) discloses private repository contents | ||||
| CVE-2026-58437 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 7.1 High |
| Repository Visibility Manipulation via Git Push Options | ||||
| CVE-2026-55986 | 1 Gitea | 1 Gitea Open Source Git Server | 2026-08-14 | 5.4 Medium |
| Email Management API Bypasses ManageCredentials Feature Restrictions | ||||
| CVE-2026-53799 | 2 Rsync Project, Samba | 2 Rsync, Rsync | 2026-08-14 | 6.3 Medium |
| rsync before 3.5.0 contains a symlink race condition vulnerability that allows local attackers to cause rsync to apply arbitrary ACLs or extended attributes to unintended files by substituting a symlink at a predictable destination path between the file write and the subsequent acl_set_file() or lsetxattr() call. Attackers can exploit this timing window to redirect ACL and xattr application through a crafted symlink to files outside the intended destination tree, potentially granting elevated permissions and enabling local privilege escalation. | ||||
| CVE-2026-53791 | 2 Rsync Project, Samba | 2 Rsync, Rsync | 2026-08-14 | 9.1 Critical |
| rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address. | ||||
| CVE-2026-18150 | 1 Ibm | 1 I | 2026-08-14 | 4.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information due to a race condition. | ||||
| CVE-2026-17445 | 1 Ibm | 1 I | 2026-08-14 | 8.2 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to improper validation of an attacker-supplied user profile name. | ||||
| CVE-2026-17229 | 1 Ibm | 1 I | 2026-08-14 | 7.5 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to an infinite loop. | ||||
| CVE-2026-17078 | 1 Ibm | 1 I | 2026-08-14 | 5.3 Medium |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to resource exhaustion. | ||||
| CVE-2026-16896 | 1 Ibm | 1 I | 2026-08-14 | 7.1 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to obtain unauthorized access to files due to a time-of-check time-of-use (TOCTOU) race condition. | ||||
| CVE-2026-16722 | 1 Ibm | 1 I | 2026-08-14 | 8.8 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain unauthorized privileges due to improper privilege management. | ||||
| CVE-2026-14525 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-08-14 | 9.4 Critical |
| IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 IBM WebSphere Application Server Liberty is vulnerable to an authentication bypass when the rtcomm-1.0 or rtcommGateway-1.0 feature is enabled. | ||||