Export limit exceeded: 380904 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (9308 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18634 | 1 Sonicwall | 1 Gms | 2026-08-13 | 8.4 High |
| An insecure handling of serialized objects vulnerability was found in the one of the service of GMS application 9.5.1 (Build 9510.1044) and earlier versions. A local attacker with the ability to interact with the service could exploit this behavior to perform unauthorized actions through the affected component. | ||||
| CVE-2026-49349 | 1 Regclient | 1 Regclient | 2026-08-13 | 6.8 Medium |
| regclient is a Docker and OCI Registry Client in Go. Prior to version 0.11.5, credentials for a registry may be inadvertently leaked to external servers. A prerequisite for this attack is a malicious registry server, a malicious blob store, or a registry that does not restrict the external URLs for foreign blobs. Version 0.11.5 fixes the issue. | ||||
| CVE-2026-71845 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 6.3 Medium |
| A flaw was found in insights-client. The setDefault() function logs the value of every environment variable it processes, including CCX_TOKEN, a bearer credential used in disconnected cluster deployments. When glog verbosity is set to level 2 or higher, the token is written in clear text to the pod log on every startup. An attacker with access to pod logs or centralized logging could obtain the credential, leading to unauthorized access to the CCX API. | ||||
| CVE-2026-71474 | 1 Redhat | 2 Acm, Advanced Cluster Management For Kubernetes | 2026-08-13 | 6.3 Medium |
| A flaw was found in insights-client. When the application receives a non-200 response, it logs the request headers, which can include the cloud.openshift.com pull-secret token. A local user with access to pod logs on the hub could read this long-lived credential. This information disclosure could grant unauthorized access to Red Hat cloud services. | ||||
| CVE-2026-18710 | 1 Mongodb | 1 Mongodb Server | 2026-08-13 | 6.5 Medium |
| A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only. | ||||
| CVE-2026-18391 | 2 Woocommerce, Wordpress | 2 Subscriptions, Wordpress | 2026-08-13 | 9.8 Critical |
| The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies. | ||||
| CVE-2026-4901 | 3 Control System, Hydrosystem, Hydrosystem.poznan | 3 Alanweb Scada, Control System, Control System | 2026-08-13 | 6.5 Medium |
| AlanWeb SCADA saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user. This issue was fixed in AlanWeb SCADA version 9.8.5 | ||||
| CVE-2026-16267 | 2026-08-13 | 8.1 High | ||
| The Newsletters WordPress plugin before 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects. | ||||
| CVE-2026-17061 | 1 Dassault Systèmes | 1 Simulia Execution Engine | 2026-08-13 | 10 Critical |
| A Deserialization of Untrusted Data vulnerability affecting SIMULIA Execution Engine from Release 2023 through Release 2026 could lead to an unauthenticated remote code execution. | ||||
| CVE-2026-66832 | 1 Quanovate Tech | 2 Mira Android App, Mira Firmware | 2026-08-13 | 6.5 Medium |
| When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context. | ||||
| CVE-2026-73325 | 1 Fujitsu Research | 1 Onecompression | 2026-08-13 | 7.8 High |
| Fujitsu Research's OneCompression library 1.2.0 contains an unsafe deserialization vulnerability that allows attackers to execute arbitrary code by supplying a crafted model.pt checkpoint file, as QuantizedModelLoader.load_quantized_model_pt() unconditionally calls torch.load with weights_only=False, invoking Python's pickle machinery during deserialization. Attackers can embed malicious __reduce__ methods in a crafted model checkpoint to execute arbitrary Python code, including system commands, when the library loads the file from a caller-selected model directory. | ||||
| CVE-2026-70321 | 1 Microsoft | 2 Sharepoint Server, Sharepoint Server Subscription Edition | 2026-08-13 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-63514 | 1 Microsoft | 5 Sharepoint Enterprise Server 2016, Sharepoint Server, Sharepoint Server 2016 and 2 more | 2026-08-13 | 8.8 High |
| Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-47234 | 1 Admidio | 1 Admidio | 2026-08-12 | 4.4 Medium |
| Admidio is an open-source user management solution. Prior to version 5.0.10, when debug logging is enabled, `Session::setCookie()` logs full cookie values and `Session::start()` logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live bearer-style credentials from the logs. Version 5.0.10 contains a fix. | ||||
| CVE-2026-0637 | 1 Wso2 | 17 Api Control Plane, Api Manager, Identity Server and 14 more | 2026-08-12 | 4.4 Medium |
| When an Event Publisher output adapter is configured with irrelevant properties, the affected products log these properties. This logging occurs without sufficient validation or sanitization of the property values. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information, such as user credentials or other confidential data, that was inadvertently logged due to misconfiguration, potentially leading to unauthorized access. | ||||
| CVE-2025-30240 | 1 Tp-link | 33 Eb810v(eu1) V1.0, Ex220(br) V1.0/1.20/1.28/1.29/1.8, Ex220(br) V2.0 and 30 more | 2026-08-12 | N/A |
| The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem. | ||||
| CVE-2026-68756 | 1 Jfrog | 1 Artifactory | 2026-08-12 | 6.6 Medium |
| A party with write access to stored session data may affect JFrog Artifactory under specific conditions. | ||||
| CVE-2024-31249 | 1 Wpkube | 1 Subscribe To Comments Reloaded | 2026-08-12 | 5.3 Medium |
| Insertion of Sensitive Information into Log File vulnerability in WPKube Subscribe To Comments Reloaded.This issue affects Subscribe To Comments Reloaded: from n/a through 220725. | ||||
| CVE-2024-31245 | 1 Convertkit | 1 Convertkit - Email Marketing\, Email Newsletter And Landing Pages | 2026-08-12 | 5.3 Medium |
| Insertion of Sensitive Information into Log File vulnerability in ConvertKit.This issue affects ConvertKit: from n/a through 2.4.5. | ||||
| CVE-2026-50656 | 1 Microsoft | 1 Malware Protection Engine | 2026-08-12 | 7.8 High |
| Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". | ||||