Export limit exceeded: 372138 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372138 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-48284 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 9.6 Critical |
| ColdFusion is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48322 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 9.6 Critical |
| ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48321 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 9.3 Critical |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain unauthorized read and write access. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48319 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 9.1 Critical |
| ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48329 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 2.7 Low |
| ColdFusion is affected by an Insufficient Session Expiration vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue does not require user interaction. | ||||
| CVE-2026-48338 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 6.8 Medium |
| ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48327 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 9 Critical |
| ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48318 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 9.9 Critical |
| ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48332 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 7.7 High |
| ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read access. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48324 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 9.1 Critical |
| ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-48320 | 1 Adobe | 2 Coldfusion 2023, Coldfusion 2025 | 2026-07-30 | 8.5 High |
| ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed. | ||||
| CVE-2026-61371 | 1 Microsoft | 1 Avml | 2026-07-30 | 7.5 High |
| Microsoft AVML before 0.17.0 could follow a symlink when opening a destination output path on Unix, allowing truncation/overwrite of the symlink target. The destructive effect is performed at open-time via O_TRUNC, and can happen before full input validation completes (“truncation-before-validation”). | ||||
| CVE-2026-51290 | 1 Sqlite | 1 Sqlite | 2026-07-30 | 9.1 Critical |
| SQLite 3.41 has a use-after-free vulnerability in the shared cache lock management logic of the btree module. The program frees a BtLock structure without removing the node from the linked list. Subsequent linked list traversal accesses the released memory, which can lead to denial of service and sensitive memory information disclosure. | ||||
| CVE-2026-68503 | 2026-07-30 | 9.8 Critical | ||
| LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn ships default C2 credentials LazyOwn and LazyOwn in payload.json and core/payload_schema.py and passes them unchanged to lazyc2.py HTTP Basic authentication, allowing any network-reachable attacker who knows the defaults to authenticate to the C2 dashboard with operator-level access. This issue is fixed in 0.2.154. | ||||
| CVE-2026-68502 | 2026-07-30 | 9.8 Critical | ||
| LazyOwn RedTeam/APT Framework is an AI-powered C2 and red-team operations framework. Prior to 0.2.154, LazyOwn's lazyc2.py registers an unauthenticated Socket.IO input event handler that dispatches data.get('value') to LazyOwnShell.one_cmd, reaching LazyOwnShell.do_cmd and subprocess.call(command, shell=True), allowing unauthenticated remote code execution in the C2 process. This issue is fixed in 0.2.154. | ||||
| CVE-2026-55777 | 2026-07-30 | N/A | ||
| GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to 1.11, the parse_ios() function uses an attacker-controlled keyword-to-OS offset as both the source offset and copy length for memmove, allowing a crafted User-Agent in a processed access log to read up to approximately 4 KB beyond the heap allocation and conditionally crash GoAccess. This issue is fixed in version 1.11. | ||||
| CVE-2026-55768 | 2026-07-30 | N/A | ||
| GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the browser. Prior to version 1.11, the built-in WebSocket server narrows a 64-bit extended frame length into the signed 32-bit WSFrame.payloadlen field before enforcing the maximum frame size, allowing an unauthenticated remote client to bypass the guard and force an approximately 18-exabyte allocation request that terminates the process. This issue is fixed in version 1.11. | ||||
| CVE-2025-69938 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. | ||||
| CVE-2025-69937 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id. | ||||
| CVE-2025-69936 | 2026-07-30 | N/A | ||
| CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1. | ||||