Export limit exceeded: 391801 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 391801 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 391801 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (391801 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76441 | 1 Cisco | 1 Secure Email And Web Manager | 2026-09-15 | 9.8 Critical |
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Email Gateway and Cisco Secure Email and Web Manager engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76441 are related to issues with improper access control that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284. | ||||
| CVE-2026-55073 | 1 Kozea | 1 Weasyprint | 2026-09-15 | 6.2 Medium |
| WeasyPrint helps web developers to create PDF documents. Prior to 70.0, server-side applications that configure a restrictive url_fetcher and pass attacker-influenced values to HTML.write_pdf() can have the restriction bypassed through the xmp_metadata or stylesheets options. In weasyprint/pdf/init.py, xmp_metadata calls select_source() without the document url_fetcher, allowing an accessible local file to be read and embedded verbatim in the output PDF. In weasyprint/document.py, stylesheets constructs CSS() without the document url_fetcher, allowing local or internal resource loading and propagating the permissive fetcher through nested CSS imports and url() references. The stylesheets channel applies fetched resources but does not by itself disclose stylesheet comments verbatim. This issue is fixed in version 70.0. | ||||
| CVE-2026-81900 | 1 Concretecms | 1 Concrete Cms | 2026-09-15 | N/A |
| Concrete CMS before 9.5.3 applied only trim() to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with edit_block permission could inject an event handler that executed script for visitors rendering the page, acting with administrative privileges where the victim was an administrator. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 7.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. Thanks sh4d0byss for reporting. | ||||
| CVE-2026-84609 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | N/A |
| A permissions issue was addressed with improved path validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. An app may be able to modify protected system files. | ||||
| CVE-2026-84511 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | N/A |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted asset catalog may lead to unexpected process termination. | ||||
| CVE-2026-86917 | 1 Apple | 1 Macos | 2026-09-15 | 7.8 High |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges. | ||||
| CVE-2026-86924 | 1 Apple | 2 Ios And Ipados, Macos | 2026-09-15 | N/A |
| A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tahoe 26.7. Connecting a malicious accessory may cause unexpected system termination. | ||||
| CVE-2026-86895 | 1 Apple | 4 Ios And Ipados, Tvos, Visionos and 1 more | 2026-09-15 | N/A |
| An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. A local app may be able to read a persistent account identifier. | ||||
| CVE-2026-86909 | 1 Apple | 1 Macos | 2026-09-15 | N/A |
| A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to bypass Gatekeeper checks. | ||||
| CVE-2026-57129 | 1 Mervinpraison | 1 Praisonaiagents | 2026-09-15 | 7.5 High |
| PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, MentionsParser._process_file_mention accepts file-mention values and falls back from workspace-relative resolution to Path(file_path) without traversal, symlink, or workspace-boundary validation. Prompt input from users, bots, or workflows can therefore read arbitrary files accessible to the process, including credentials, keys, environment files, source code, and system configuration. This issue is fixed in praisonaiagents 1.6.59. | ||||
| CVE-2026-84597 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | N/A |
| An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, watchOS 27. Processing a maliciously crafted font may result in the disclosure of process memory. | ||||
| CVE-2026-91091 | 1 Gpac | 1 Gpac | 2026-09-15 | 4.3 Medium |
| A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component. | ||||
| CVE-2026-84631 | 1 Apple | 1 Macos | 2026-09-15 | 7.8 High |
| This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to gain root privileges. | ||||
| CVE-2026-59569 | 1 Zscaler | 1 Client Connector | 2026-09-15 | 8.1 High |
| An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zscaler controls. | ||||
| CVE-2026-4103 | 1 Wso2 | 4 Api Control Plane, Api Manager, Wso2 Api Control Plane and 1 more | 2026-09-15 | 6.4 Medium |
| Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges. | ||||
| CVE-2026-65390 | 1 Apple | 6 Ios And Ipados, Macos, Safari and 3 more | 2026-09-15 | N/A |
| An integer overflow was addressed with improved input validation. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Processing maliciously crafted web content may lead to memory corruption. | ||||
| CVE-2026-65407 | 1 Apple | 5 Ios And Ipados, Macos, Tvos and 2 more | 2026-09-15 | N/A |
| A use after free issue was addressed with improved memory management. This issue is fixed in iOS 26.6 and iPadOS 26.6, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6, macOS Tahoe 26.7, tvOS 26.6, tvOS 27, visionOS 26.6, visionOS 27, watchOS 26.6, watchOS 27. An app may be able to cause unexpected system termination. | ||||
| CVE-2026-91090 | 1 Gpac | 1 Gpac | 2026-09-15 | 3.9 Low |
| A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded. | ||||
| CVE-2026-86900 | 1 Apple | 1 Macos | 2026-09-15 | N/A |
| An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27. Mounting a maliciously crafted exFAT volume may cause unexpected system termination or kernel memory disclosure. | ||||
| CVE-2026-57127 | 1 Mervinpraison | 1 Praisonai | 2026-09-15 | 9.8 Critical |
| PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator selects api-key or JWT authentication, but each middleware forwards requests when PRAISONAI_API_KEY or PRAISONAI_JWT_SECRET and the corresponding recipe value are absent. Unauthenticated clients can then reach recipe execution, input, and output surfaces and may trigger connected tools despite the operator explicitly enabling authentication. This issue is fixed in 4.6.58. | ||||