Export limit exceeded: 372122 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 372122 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372122 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-56687 | 1 Dell | 1 Thinos | 2026-07-30 | 7.8 High |
| Dell ThinOS 10, versions prior to 2605_10.2100, contain an Obsolete Feature in UI vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. | ||||
| CVE-2026-40952 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local access to the client or server can use it to elevate privileges to Administrator when Secure Access is installed in a non-default location. | ||||
| CVE-2026-40953 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40953 is a heap overflow in the certificate parsing function of Secure Access clients prior to 14.55. Attackers with local access and administrator permissions can create a denial of service attack against the client over which they have control. | ||||
| CVE-2026-40954 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40954 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client | ||||
| CVE-2026-40955 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40955 is an integer underflow vulnerability in the traffic parsing function of Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client. | ||||
| CVE-2026-40956 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40956 is a memory disclosure vulnerability in Secure Access client versions prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can cause a small amount of random memory to leak. | ||||
| CVE-2026-40957 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator. | ||||
| CVE-2026-40958 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-40958 is a input validation error in Secure Access clients prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against their client. | ||||
| CVE-2026-50144 | 1 Tencent | 1 Ncnn | 2026-07-30 | 7.1 High |
| ncnn is a high-performance neural network inference framework optimized for the mobile platform. In commit e54f7b1f88434e1d844ea0551b880a1cfb079ce1 and earlier, ncnn allows an out-of-bounds heap write in ncnn::ParamDict::load_param() when Net::load_param() loads a malicious .param model file because the parsed parameter id is checked only against id >= NCNN_MAX_PARAM_COUNT, allowing a negative id to index before the params[NCNN_MAX_PARAM_COUNT] array. This vulnerability is fixed by commit 5a0288f255daa6c3294f77109f67718e434ec020. | ||||
| CVE-2026-33443 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-33443 is a memory management error in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server. | ||||
| CVE-2026-33444 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-33444 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server. | ||||
| CVE-2026-33445 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-33445 is a memory management vulnerability in Secure Access servers prior to 14.55. Attackers with an intimate knowledge of and total control over the tunnel protocol can create a persistent DoS against the server. | ||||
| CVE-2026-55398 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-55398 is a memory management vulnerability in Secure Access clients and servers prior to 14.55. Attackers with intimate knowledge of and total control over the tunnel protocol can create a non-persistent DoS against the server. | ||||
| CVE-2026-55399 | 1 Absolute | 1 Secure Access | 2026-07-30 | N/A |
| CVE-2026-55399 is a resource exhaustion vulnerability in the Secure Access publisher prior to 14.55. Attackers with valid credentials to the Secure Access tunnel can create a non-persistent DoS against the publisher. | ||||
| CVE-2026-62361 | 1 Nadh | 1 Listmonk | 2026-07-30 | 5.5 Medium |
| listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET /api/subscribers, allowing an authenticated user with subscribers:sql_query and subscribers:get_all to read arbitrary database tables such as users and settings and execute data-modifying PostgreSQL CTEs. This issue is fixed in version 6.2.0. | ||||
| CVE-2026-6424 | 1 Eset | 2 Endpoint Antivirus, Server Security | 2026-07-30 | N/A |
| Use-after-free vulnerability in ESET Linux products potentially allowed an attacker to trigger kernel panic on the system | ||||
| CVE-2026-14254 | 1 Perforce | 1 Delphix Continuous Data | 2026-07-30 | N/A |
| A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account. | ||||
| CVE-2026-53597 | 1 Microsoft | 1 Prompty | 2026-07-30 | N/A |
| Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/packages/core/src/core/loader.ts used gray-matter without overriding executable js and javascript frontmatter engines, allowing an attacker-controlled .prompty file with ---js frontmatter to execute arbitrary JavaScript during prompt loading. This issue is fixed in version 2.0.0-beta.3. | ||||
| CVE-2026-53598 | 1 Microsoft | 1 Prompty | 2026-07-30 | 7.5 High |
| Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter without enforcing that resolved paths stayed within the prompt directory or allowed roots, allowing an attacker-controlled prompt file to read local files through absolute paths, .. traversal, or symlink escapes. This issue is fixed in versions 2.0.0-beta.2. | ||||
| CVE-2026-45695 | 1 Kopia | 1 Kopia | 2026-07-30 | 9.8 Critical |
| Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0. | ||||