Export limit exceeded: 48368 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 22007 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (22007 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-72901 | 1 Dokploy | 1 Dokploy | 2026-08-13 | 9.9 Critical |
| Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec, with Docker socket access making execution host/root-equivalent. This issue is fixed in version 0.29.13. | ||||
| CVE-2026-72877 | 1 Dokploy | 1 Dokploy | 2026-08-13 | 9.6 Critical |
| Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the dockerImage field is interpolated without quoting into shell commands in buildRemoteDocker() in packages/server/src/utils/providers/docker.ts and is validated only as an optional string. An authenticated user with application create or update permission can use shell command substitution in dockerImage to execute arbitrary commands on the local build host or a remote SSH build target, exposing host secrets and other projects. This issue is fixed in version 0.29.13. | ||||
| CVE-2026-68806 | 1 Microsoft | 10 365 Apps, Excel, Excel 2016 and 7 more | 2026-08-13 | 7.8 High |
| Out-of-bounds write in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-73224 | 1 Electerm | 1 Electerm | 2026-08-13 | 8.8 High |
| electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to execute arbitrary commands when a user downloads a crafted folder and invokes Properties and Calculate Size because calcLocal in src/client/components/sftp/file-info-modal.jsx inserts the server-controlled folder name into a du -sh shell command without safely escaping single quotes. This issue is fixed in version 3.15.120. | ||||
| CVE-2026-73222 | 1 Davila7 | 1 Claude-code-templates | 2026-08-13 | 8.8 High |
| Claude Code Templates is a CLI tool for configuring and monitoring Claude Code. Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin requests, and requires no authentication. The POST /api/execute endpoint passes the prompt request-body field to executeLocalTask(), and POST /api/install-agent passes the agentName request-body field to a child process. The same unsafe agent field path is reachable from /api/execute through checkAndInstallAgent(). These attacker-controlled values reach child_process.spawn() with shell execution enabled, causing Node.js to construct a shell command in which metacharacters are interpreted. An attacker who can reach the port directly, or who convinces a developer running Studio to visit a malicious website, can execute arbitrary operating-system commands with the developer's privileges and compromise source code, credentials, and local data. This issue is fixed in version 1.29.4. | ||||
| CVE-2026-63298 | 1 Canonical | 1 Lxd | 2026-08-13 | 8.7 High |
| An improper neutralization of special elements vulnerability in LXD's NVIDIA instance configuration handling allows an authenticated attacker to inject arbitrary configuration directives. By supplying newline characters within the 'nvidia.driver.capabilities' or 'nvidia.require.*' configuration values, an attacker can manipulate the generated lxc.conf file. This flaw enables the attacker to execute arbitrary code on the host system with the privileges of the LXD daemon. | ||||
| CVE-2026-19696 | 1 Wireshark | 1 Wireshark | 2026-08-13 | 6.6 Medium |
| Ixia IxVeriWave and Vector Informatik BLF file parser crashes in 4.6.0 to 4.6.7 allows denial of service on Windows | ||||
| CVE-2026-18888 | 1 Mongodb | 1 Bi Connector Odbc Driver | 2026-08-13 | 6.5 Medium |
| The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read. | ||||
| CVE-2026-64285 | 1 Linux | 1 Linux Kernel | 2026-08-13 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guest When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. [sean: rewrite shortlog and changelog, tag for stable@] | ||||
| CVE-2026-48410 | 2 Adobe, Microsoft | 3 Lightroom, Lightroom Classic, Windows | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48409 | 2 Adobe, Microsoft | 3 Lightroom, Lightroom Classic, Windows | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48408 | 2 Adobe, Microsoft | 3 Lightroom, Lightroom Classic, Windows | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48407 | 2 Adobe, Microsoft | 3 Lightroom, Lightroom Classic, Windows | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48406 | 2 Adobe, Microsoft | 3 Lightroom, Lightroom Classic, Windows | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48405 | 2 Adobe, Microsoft | 3 Lightroom, Lightroom Classic, Windows | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-48404 | 2 Adobe, Microsoft | 3 Lightroom, Lightroom Classic, Windows | 2026-08-13 | 7.8 High |
| Lightroom Classic is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-0297 | 1 Palo Alto Networks | 1 Globalprotect App | 2026-08-13 | N/A |
| A buffer overflow vulnerability exists in the Palo Alto Networks GlobalProtect™ app that enables a man-in-the-middle (MitM) attacker or a rogue gateway to disrupt system processes and potentially execute arbitrary code with elevated privileges (SYSTEM privileges on Windows, and root privileges on macOS and Linux). | ||||
| CVE-2026-8985 | 1 Autel | 2 Maxicharger Single Charger, Maxicharger Single Charger Firmware | 2026-08-13 | 9.8 Critical |
| Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands. | ||||
| CVE-2026-8986 | 1 Autel | 2 Maxicharger Single Charger, Maxicharger Single Charger Firmware | 2026-08-13 | 9.8 Critical |
| Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A malicious or compromised OCPP server can supply a crafted diagnostics URL that results in arbitrary command execution on the charging station. | ||||
| CVE-2026-18725 | 1 Open-iscsi Project | 1 Open-iscsi | 2026-08-13 | 6.3 Medium |
| AI_ONLY_REPORT package: iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10 ------ Summary: Out-of-Bounds Write and Information Disclosure via Unvalidated IPv6 Payload Length: crafted ICMPv6 Echo Requests can cause `iscsiuio` to trust an inflated `ipv6_plen` larger than the actual received payload, leading to MTU-bounded out-of-bounds reads and a potential one-byte out-of-bounds write that may disclose data beyond the valid packet boundary. Requirements to exploit: Adjacent-network access on the same L2 segment as a system running `iscsiuio` on an interface that processes IPv6/NDP traffic, plus the ability to send a crafted ICMPv6 Echo Request with a forged `IPv6.plen`. No authentication or user interaction is required. Component affected: `iscsi-initiator-utils` (`iscsiuio`): `iscsiuio/src/uip/ipv6.c` in `ipv6_icmp_handle_echo_request()` and `ipv6_insert_protocol_chksum()`. Version affected: `iscsi-initiator-utils-6.2.1.11-0.git4b3e853.el10` when `iscsiuio` is processing IPv6/NDP traffic on a reachable interface. Patch available: no released package fix established; proposed patch included below Version fixed: unknown Upstream coordination: Not notified. CVSS: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - 6.3 (MEDIUM) AV:A - Reachability is limited to an attacker on the same L2 segment who can send crafted IPv6/ICMPv6 traffic to the affected interface. AC:L - The attack relies on forging `IPv6.plen`; no race or unusual environment is needed beyond the vulnerable deployment. PR:N - No privileges are required. UI:N - No user interaction is required. S:U - The impact remains within the `iscsiuio` process and its packet buffer handling. C:L - The reply/checksum path can read and potentially transmit data beyond the valid packet boundary, but the demonstrated exposure is MTU-bounded. I:L - For odd forged lengths, the checksum path can write a single padding byte past the valid protocol data, which may affect adjacent buffer contents. A:L - Invalid memory access may destabilize or crash the process, but reliable high-impact denial of service is not established from the available evidence. Impact: Moderate. Under Red Hat's severity guidance, this is more consistent with a flaw that can affect confidentiality, integrity, or availability under constrained circumstances than with an Important issue. The bug is unauthenticated and adjacent-network reachable, but the currently supported outcome is MTU-bounded out-of-bounds access in a deployment-dependent IPv6/NDP path, not easy remote system compromise or clearly high-impact memory corruption. Embargo: no Reason: The currently supported impact is Moderate, exposure depends on `iscsiuio` processing IPv6 traffic on a reachable L2 segment, and operators can reduce exposure operationally by isolating or disabling the affected path. Acknowledgement: Aisle Research Vulnerability Details: In the ICMPv6 echo-reply path, the code reuses the inbound `ipv6_plen` field when sizing the reply instead of clamping it to the bytes actually received: ```c /* iscsiuio/src/uip/ipv6.c */ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { ... ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6->ipv6_plen)); } ``` Later, checksum generation also trusts `ipv6_plen` for memory traversal, and for odd lengths it writes a padding byte at `ptr + protocol_data_len` before iterating over `protocol_data_len` bytes: ```c /* iscsiuio/src/uip/ipv6.c */ protocol_data_len = HOST_TO_NET16(ipv6->ipv6_plen); ... if (protocol_data_len & 1) { *((u8_t *) ptr + protocol_data_len) = 0; protocol_data_len++; } for (i = 0; i < protocol_data_len / 2; i++) { sum += HOST_TO_NET16(*ptr); ptr++; } ``` The available receive-side logic does not establish a payload-length bound strong enough to eliminate this condition. `uip_input()` compares the IPv6 payload length against `uip_len`, but `uip_len` is treated as full frame length in the observed path rather than the actual IPv6 payload length, and `ipv6_rx_packet()` receives a `len` argument without using it to bound parsing. A forged `ipv6_plen` can therefore exceed the real IPv6 payload stored in the buffer. The available evidence supports MTU-bounded out-of-bounds access in normal receive paths rather than the earlier arbitrary 64KB worst case. The affected logic appears to be present in the available 6.2.1.11 code base, but this report is scoped to the scanned SRPM package. Steps to reproduce: 1. Build `iscsiuio` with ASAN enabled. 2. Run `iscsiuio` with IPv6/NDP active on a test interface. 3. From the same L2 segment, send an ICMPv6 Echo Request with `IPv6.plen` set larger than the actual payload bytes in the frame buffer; one tested shape is `plen=1491` with an Ethernet frame size near 1500 bytes. 4. Observe the reply path: ASAN reports invalid access in `ipv6_insert_protocol_chksum()` as the checksum walk reads past valid packet data, odd lengths may also trigger a one-byte write, and reply sizing is derived from the forged `ipv6_plen` rather than the actual received payload size. Mitigation: Until a fix is available, keep `iscsiuio`-managed interfaces on trusted L2 segments only. Where operationally acceptable, disable IPv6 on those interfaces or filter ICMPv6 Echo Requests before they reach `iscsiuio`. If `iscsiuio` is not processing IPv6/NDP traffic, this specific path is not reachable. Proposed Fix: Clamp the reply payload length to the actual received payload derived from `context->ustack->uip_len`, reject packets too short to contain a complete ICMPv6 header, and rewrite `ipv6->ipv6_plen` before calling `ipv6_send()`. ```diff diff --git a/iscsiuio/src/uip/ipv6.c b/iscsiuio/src/uip/ipv6.c @@ -1100,6 +1100,8 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) { struct eth_hdr *eth = (struct eth_hdr *)context->ustack->data_link_layer; +u16_t rx_total, rx_payload, hdr_plen, safe_plen; +u16_t l2_l3_len = sizeof(struct eth_hdr) + sizeof(struct ipv6_hdr); struct ipv6_hdr *ipv6 = (struct ipv6_hdr *)context->ustack->network_layer; struct icmpv6_hdr *icmp = (struct icmpv6_hdr *)((u8_t *)ipv6 + @@ -1126,8 +1128,20 @@ static void ipv6_icmp_handle_echo_request(struct ipv6_context *context) icmp->icmpv6_code = 0; icmp->icmpv6_cksum = 0; ILOG_DEBUG("IPv6: Send echo reply"); -ipv6_send(context, (u8_t *) icmp - (u8_t *) eth + sizeof(struct ipv6_hdr) + HOST_TO_NET16(ipv6>ipv6_plen)); + +rx_total = context->ustack->uip_len; +if (rx_total <= l2_l3_len) +return; + +rx_payload = rx_total - l2_l3_len; +hdr_plen = HOST_TO_NET16(ipv6->ipv6_plen); +safe_plen = (hdr_plen <= rx_payload) ? hdr_plen : rx_payload; +if (safe_plen < sizeof(struct icmpv6_hdr)) +return; + +ipv6->ipv6_plen = HOST_TO_NET16(safe_plen); +ipv6_send(context, l2_l3_len + safe_plen); + return; } ``` ------ This report was generated using AI technology. Always review AI-generated content prior to use | ||||