Export limit exceeded: 390745 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (2799 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76242 | 1 Eidetic-labs | 1 Stigmem | 2026-08-20 | N/A |
| stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted. | ||||
| CVE-2026-73542 | 1 Seiko Epson Corporation | 1 Multiple Seiko Epson Printers And Scanners | 2026-08-20 | 3.7 Low |
| Multiple SEIKO EPSON printers and scanners contain revoked root certificates. A man-in-the-middle attack may allow an attacker to obtain communication data transmitted by the product. As for the details of the affected products and versions, refer to the vendor's information. | ||||
| CVE-2026-49283 | 1 Simplesamlphp | 1 Saml2 | 2026-08-19 | 8.7 High |
| The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1, the HTTPArtifact::receive() flow can treat an unsigned embedded SAML Response as cryptographically valid for the wrong identity provider. SOAPClient::addSSLValidator() attaches a TLS-based validator to the outer SOAP ArtifactResponse, while the embedded Response receives a validator that delegates to the outer message and is later checked against metadata selected from the embedded response issuer rather than necessarily the artifact issuer. SOAPClient::validateSSL() returns normally when the TLS public key does not match the key being validated, and SAML2\Message::validate() treats a validator call that does not throw as successful. In a multi-IdP federation, a malicious or lower-trust IdP can therefore provide an ArtifactResponse containing an unsigned Response that claims a higher-trust victim IdP as issuer and authenticate as arbitrary users with attacker-chosen assertion attributes, NameID, and session data. This issue is fixed in versions 4.19.3, 4.20.2, 5.0.6, and 6.2.1. | ||||
| CVE-2026-2368 | 1 Lenovo | 1 Filez | 2026-08-19 | 7.1 High |
| An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to execute arbitrary code. | ||||
| CVE-2026-1068 | 1 Lenovo | 1 Filez | 2026-08-19 | 5.3 Medium |
| An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application. | ||||
| CVE-2020-1113 | 1 Microsoft | 18 Windows 10, Windows 10 1507, Windows 10 1607 and 15 more | 2026-08-19 | 5.3 Medium |
| A security feature bypass vulnerability exists in Microsoft Windows when the Task Scheduler service fails to properly verify client connections over RPC. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. To exploit this vulnerability, a man-in-the-middle attacker would need to send a specially crafted request to a vulnerable system. The security update addresses the vulnerability by correcting how the Task Scheduler service validates connections. | ||||
| CVE-2021-42308 | 1 Microsoft | 1 Edge Chromium | 2026-08-19 | 3.1 Low |
| Microsoft Edge (Chromium-based) Spoofing Vulnerability | ||||
| CVE-2021-43220 | 1 Microsoft | 2 Edge, Edge Ios | 2026-08-19 | 3.1 Low |
| Microsoft Edge for iOS Spoofing Vulnerability | ||||
| CVE-2026-8367 | 1 Aria2 Project | 1 Aria2 | 2026-08-19 | 4.8 Medium |
| aria2c accepts a server certificate with incorrect Extended Key Usage (EKU). If the attackers compromise a certificate (with the associated private key) issued for a different purpose, they may be able to reuse it for TLS server authentication. | ||||
| CVE-2026-73995 | 2 Wordpress, Wpeverest | 2 Wordpress, User Registration | 2026-08-18 | 5.4 Medium |
| Subscriber Broken Authentication in User Registration <= 5.2.6 versions. | ||||
| CVE-2026-47632 | 1 Microsoft | 2 Azure Connected Machine Agent, Azure Monitor Agent Metrics Extension | 2026-08-18 | 8.8 High |
| Improper certificate validation in Azure Connected Machine Agent allows an unauthorized attacker to elevate privileges over an adjacent network. | ||||
| CVE-2026-73683 | 1 Laravel | 1 Socialite | 2026-08-18 | 8.1 High |
| Laravel Socialite's Facebook provider contains an authentication bypass vulnerability that allows unauthenticated attackers to replay captured OIDC id_tokens by exploiting the missing nonce claim validation in the getUserByOIDCToken() function within FacebookProvider.php. Attackers who obtain a valid, unexpired id_token issued for the same Facebook App ID can submit the captured token to the backend userFromToken() endpoint, bypassing authentication controls because signature, aud, and iss checks pass while no session-bound nonce comparison is performed, resulting in unauthorized access to victim accounts. | ||||
| CVE-2026-72815 | 1 Go-chi | 1 Chi | 2026-08-18 | 6.5 Medium |
| go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0. | ||||
| CVE-2026-59914 | 1 Dell | 1 Display And Peripheral Manager | 2026-08-17 | 7.8 High |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | ||||
| CVE-2026-46731 | 1 Dell | 1 Display And Peripheral Manager | 2026-08-17 | 7.8 High |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | ||||
| CVE-2026-59916 | 1 Dell | 1 Display And Peripheral Manager | 2026-08-17 | 7.8 High |
| Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution. | ||||
| CVE-2026-71290 | 1 Apache | 2 Httpclient, Httpcomponents Client | 2026-08-17 | 9.1 Critical |
| Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicy#BUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonate the server by presenting a valid certificate for a different domain. Please note the classic version of HttpClient is not affected by this vulnerability. Affected users are recommended to upgrade to at least version 5.6.4, which fixes the issue. | ||||
| CVE-2026-65942 | 1 Apache | 1 Ranger | 2026-08-17 | 7.5 High |
| TLS hostname verification issue in Apache Ranger Client Code in versions <= 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue. | ||||
| CVE-2026-63650 | 1 Openvpn | 1 Openvpn | 2026-08-17 | 3.1 Low |
| OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field | ||||
| CVE-2026-17045 | 1 Ibm | 1 I | 2026-08-17 | 8.1 High |
| IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform unauthorized operations and access sensitive information due to improper session management. | ||||