Export limit exceeded: 375775 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (375775 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-15555 | 1 Redhat | 3 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack, Jbosseapxp | 2026-08-11 | 8.8 High |
| A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node. | ||||
| CVE-2026-13738 | 2026-08-11 | N/A | ||
| CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X. | ||||
| CVE-2026-13737 | 2026-08-11 | N/A | ||
| CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X. | ||||
| CVE-2026-13716 | 1 Arcadia Technology | 1 Crafty Controller | 2026-08-11 | 9.1 Critical |
| Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution. | ||||
| CVE-2026-11893 | 1 Zephyrproject | 1 Zephyr | 2026-08-11 | 5.9 Medium |
| The Bluetooth HCI driver for Bouffalo Lab on-chip BLE controllers (BL60x/BL70x/BL61x), bt_bflb_send() in drivers/bluetooth/hci/hci_bflb.c, violates the bt_hci_driver_api.send() buffer-ownership contract. That contract (documented at include/zephyr/drivers/bluetooth.h) requires the buffer reference to be consumed only on success; on error the caller still owns the reference and unrefs it. The driver instead routed all error paths through a shared label that unconditionally called net_buf_unref(buf) before returning the error code, consuming the buffer on failure as well. When send() returns an error, the host TX path (send_buf() in subsys/bluetooth/host/conn.c) unrefs the same buffer again, believing it still owns it. This double-unref over-decrements the net_buf reference count. Because the buffer is a TX fragment whose destroy callback also decrements its still-queued parent buffer, the parent is freed prematurely while reachable on the connection TX queue, producing a use-after-free and corruption of the shared net_buf pool rather than a benign leak. The error conditions are on the host-to-controller transmit path (controller send failure, or an unsupported H:4 packet type), so they are not driven directly by attacker-supplied radio bytes; a remote/adjacent peer can influence them only indirectly, e.g. by inducing controller TX failures under heavy link load. The consequence when reached is BLE-stack denial of service (crash / pool corruption) with possible further memory corruption, bounded to devices using one of these Bouffalo Lab on-chip controllers. | ||||
| CVE-2026-10579 | 1 Redhat | 1 Jboss Enterprise Application Platform | 2026-08-11 | 9.8 Critical |
| A flaw was found in Picketlink Federation SAML; the unsolcited response handler would accept forged assertions with no verification or validation, permitting an unauthed attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws. | ||||
| CVE-2025-31114 | 2026-08-11 | N/A | ||
| Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available. | ||||
| CVE-2026-64215 | 1 Linux | 1 Linux Kernel | 2026-08-11 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xx_hfi_send_perf_table Check the return value of kzalloc() to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/ | ||||
| CVE-2026-64216 | 1 Linux | 1 Linux Kernel | 2026-08-11 | 9.8 Critical |
| In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential UAF in netfs_unlock_abandoned_read_pages() netfs_unlock_abandoned_read_pages(rreq) accesses the index of the folios it is wanting to unlock and compares that to rreq->no_unlock_folio so that it doesn't unlock a folio being read for netfs_perform_write() or netfs_write_begin(). However, given that netfs_unlock_abandoned_read_pages() is called _after_ NETFS_RREQ_IN_PROGRESS is cleared, the one folio that it's not allowed to dereference is the one specified by ->no_unlock_folio as ownership immediately reverts to the caller. Fix this by storing the folio pointer instead and using that rather than the index. Also fix netfs_unlock_read_folio() where the same applies. | ||||
| CVE-2026-3324 | 1 Zohocorp | 1 Manageengine Log360 | 2026-08-11 | 8.2 High |
| Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration. | ||||
| CVE-2025-8087 | 2026-08-11 | N/A | ||
| A DLL hijacking vulnerability in AMD Power Design Manager could allow a malicious local attacker to escalate privileges during the uninstallation process, potentially resulting in arbitrary code execution. | ||||
| CVE-2026-62869 | 1 Microsoft | 1 Microsoft Entra Id | 2026-08-11 | 8.8 High |
| Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-50516 | 1 Microsoft | 1 Azure Kubernetes Service | 2026-08-11 | 9.4 Critical |
| Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62917 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-08-11 | 4.6 Medium |
| Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-62839 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-08-11 | 6.5 Medium |
| Insufficiently protected credentials in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-58639 | 1 Microsoft | 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 | 2026-08-11 | 6.5 Medium |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-65767 | 1 Microsoft | 1 Teams | 2026-08-11 | 8.8 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-62898 | 1 Microsoft | 3 .net, Visual Studio 2022, Visual Studio 2026 | 2026-08-11 | 7.5 High |
| Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-62738 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-08-11 | 5.5 Medium |
| Out-of-bounds read in Windows Management Instrumentation allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-71331 | 1 Microsoft | 4 Windows 10 1809, Windows Server 2019, Windows Server 2022 and 1 more | 2026-08-11 | 8.1 High |
| Integer overflow or wraparound in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to execute code over a network. | ||||