Export limit exceeded: 390851 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 390851 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (390851 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-89212 | 1 Perforce | 1 Akana Api | 2026-09-13 | 8.6 High |
| A flaw resulting in XML external entity (XXE) was found in Akana API Platform in which references were improperly restricted during XML-to-JSON processing. The issue affects Akana versions 2026.1, 2025.1.1, and all versions before 2024.1.6 (including older unsupported versions of Akana) and has been fixed as a security patch in the latest release of supported versions. | ||||
| CVE-2026-71416 | 1 Headroom Labs | 1 Headroom | 2026-09-13 | 8.8 High |
| Headroom compresses data before the data reaches a large language model. Prior to version 0.35.0, the Headroom WebSocket server does not validate the `Origin` header of incoming client WebSocket requests before forwarding the request to the upstream server, allowing malicious WebSocket clients to perform arbitrary LLM requests without authentication. This can be exploited by a malicious WebSocket client executed in a traditional or headless browser such as lightpanda, if the browser has access to the Headroom proxy and the OpenAI API key is stored in the `OPENAI_API_KEY` environment variable. Version 0.35.0 fixes the issue. | ||||
| CVE-2026-57842 | 1 Netbsd | 1 Netbsd | 2026-09-13 | 7 High |
| NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kernel panic or memory corruption by calling recvmsg() with msg_iovlen between 9 and IOV_MAX, causing the kernel to access a freed iovec buffer and subsequently free the same allocation a second time. | ||||
| CVE-2026-57843 | 1 Netbsd | 1 Netbsd | 2026-09-13 | 5.5 Medium |
| NetBSD contains an information disclosure vulnerability in mm_open() within sys/dev/mm.c that allows unprivileged local users to obtain real kernel virtual addresses by opening world-accessible devices such as /dev/null or /dev/zero, which incorrectly receive the PK_KMEM process flag. Attackers can exploit this misconfigured flag to bypass the CANSEE_KPTR obfuscation mechanism and read kernel virtual addresses for sensitive kernel structures including struct proc, kauth_cred, filedesc, and vmspace via sysctl KERN_PROC queries. | ||||
| CVE-2026-87983 | 1 Mistral | 1 Mistral-vibe | 2026-09-13 | N/A |
| An arbitrary file read vulnerability in Mistral Vibe, introduced in version 2.6.0, allows an attacker to bypass workspace restrictions using quoted absolute paths in allowlisted shell commands. Improper handling of quotation marks during path validation enables files outside the active workspace to be read without user approval. | ||||
| CVE-2026-87984 | 1 Mistral | 1 Mistral-vibe | 2026-09-13 | N/A |
| An arbitrary file write vulnerability in Mistral Vibe, introduced in version 1.3.4, allows an attacker to create or overwrite files outside the active workspace without user approval. Shell redirection destinations are omitted from permission checks, enabling otherwise allowlisted commands to write to arbitrary paths accessible to the Vibe process. | ||||
| CVE-2026-87985 | 1 Mistral | 1 Mistral-vibe | 2026-09-13 | N/A |
| An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted arguments. These arguments are not properly inspected, enabling a crafted allowlisted command to execute arbitrary code on the user's system without approval. | ||||
| CVE-2026-87986 | 1 Mistral | 1 Mistral-vibe | 2026-09-13 | N/A |
| An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's parser cannot interpret. Unparsed portions are omitted from inspection, enabling embedded commands to execute on the user's system without approval. | ||||
| CVE-2026-87987 | 1 Mistral | 1 Mistral-vibe | 2026-09-13 | N/A |
| An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable assignments preceding allowlisted commands. These assignments are excluded from inspection, enabling attacker-controlled environment variables to cause arbitrary code execution without user approval. | ||||
| CVE-2026-87988 | 1 Mistral | 1 Mistral-vibe | 2026-09-13 | N/A |
| An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as unconditionally allowed. Missing path validation for these commands enables access to files outside the active workspace without user approval. | ||||
| CVE-2026-15439 | 2 Rubengc, Wordpress | 2 Gamipress – Gamification Plugin To Reward Points, Achievements, Badges & Ranks In Wordpress, Wordpress | 2026-09-13 | 6.5 Medium |
| The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integration AJAX selector (action gamipress_wpforo_get_posts) in versions up to, and including, 7.9.7. The value is passed only through $wpdb->esc_like() and interpolated directly into a single-quoted LIKE clause with no %s placeholder. Because esc_like() runs after WordPress core magic quotes, it doubles the injected backslash (\' -> \\'), which MySQL reads as one literal backslash followed by a live closing quote, allowing the attacker to break out of the string and inject boolean-based SQL. The wpForo plugin only needs to be active to register the callback; no wpForo vulnerability is used. Requires a Subscriber account, which can read the gamipress_admin nonce (exposed on every admin page, e.g. /wp-admin/profile.php). Note: the researcher's Simple:Press vectors (PoC 2 & 3) do not reproduce in current code, which uses $wpdb->prepare() with %s placeholders; only the wpForo selector is confirmed. | ||||
| CVE-2026-70341 | 1 Microsoft | 3 Edge, Edge Chromium, Microsoft Edge (chromium-based) | 2026-09-13 | 8.5 High |
| Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-62140 | 2 Expresstech, Wordpress | 2 Quiz And Survey Master, Wordpress | 2026-09-13 | 5.3 Medium |
| Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions. | ||||
| CVE-2026-62107 | 2 Masteriyo, Wordpress | 2 Masteriyo, Wordpress | 2026-09-13 | 8.8 High |
| Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. | ||||
| CVE-2026-62114 | 2 Wordpress, Wpchill | 2 Wordpress, Passster | 2026-09-13 | 5.3 Medium |
| Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. | ||||
| CVE-2026-62132 | 2 Masteriyo, Wordpress | 2 Masteriyo, Wordpress | 2026-09-13 | 5.3 Medium |
| Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. | ||||
| CVE-2026-53952 | 2 Get-simple, Getsimple-ce | 2 Getsimplecms, Getsimple Cms | 2026-09-13 | 9.8 Critical |
| GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. A logic flaw in GetSimple CMS (v3.4.0a and below) and GetSimpleCMS-CE (v3.3.22 and below) allows unauthenticated attackers to create a new administrator account. The application features an automated security control designed to delete the sensitive `admin/setup.php` file post-installation. However, this control is neutralized by a self-exclusion bug within the deletion logic, leaving the setup script accessible for unauthorized account creation even after a legitimate installation is completed. As of time of publication, no known patched versions are available. | ||||
| CVE-2026-54240 | 1 Struktur | 1 Libde265 | 2026-09-13 | 7.4 High |
| libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate pixel offsets, allowing a crafted HEVC stream with large image dimensions to trigger an integer overflow and cause out-of-bounds heap reads or writes, potentially disclosing data, corrupting memory, or crashing the decoder. Version 1.1.1 contains a patch. | ||||
| CVE-2026-54241 | 1 Struktur | 1 Libde265 | 2026-09-13 | 7.4 High |
| libde265 is an open source implementation of the h.265 video codec. Versions prior to 1.1.1 use signed 32-bit arithmetic to calculate the sample adaptive offset input-buffer size, allowing a crafted HEVC stream with large dimensions and 16-bit luma samples to cause an integer overflow, an undersized allocation, and an out-of-bounds heap read that may expose heap data in decoded output or crash the decoder. Version 1.1.1 contains a patch. | ||||
| CVE-2026-90443 | 1 Cisagov | 1 Malcolm | 2026-09-13 | N/A |
| A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does not require authentication to reach. This allows an unauthenticated network attacker to craft a link that, when visited by a user, executes arbitrary script in the context of the affected application and can redirect the user's browser to an arbitrary external site. Successful exploitation could allow an attacker to act with the compromised user's session privileges within the application. | ||||