Export limit exceeded: 424699 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424699 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424699 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424699 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-7297 | 1 Sourcecodester | 1 Pizzafy Ecommerce System | 2026-07-24 | 2.4 Low |
| A vulnerability was determined in SourceCodester Pizzafy Ecommerce System 1.0. This vulnerability affects the function save_user of the file /admin/ajax.php?action=save_user. Executing a manipulation of the argument Name can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-7222 | 1 Code-projects | 1 Coaching Management System | 2026-07-24 | 3.5 Low |
| A vulnerability was determined in code-projects Coaching Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /cims/modules/student/complaint.php of the component Complaint Form Page. This manipulation of the argument Complaint causes cross site scripting. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-7215 | 1 Egtai | 1 Gmx-vmd-mcp | 2026-07-24 | 7.3 High |
| A security flaw has been discovered in egtai gmx-vmd-mcp up to 0.1.0. This issue affects the function launch_vmd_gui_tool of the file mcp_server.py of the component VMD Launch Handler. The manipulation of the argument structure_file/trajectory_file results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-7205 | 1 Duartium | 1 Papers-mcp-server | 2026-07-24 | 7.3 High |
| A vulnerability was identified in duartium papers-mcp-server 9ceb3812a6458ba7922ca24a7406f8807bc55598. Impacted is the function search_papers of the file src/main.py. Such manipulation of the argument topic leads to path traversal. The attack may be launched remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-7200 | 1 Sourcecodester | 1 Pharmacy Sales And Inventory System | 2026-07-24 | 4.3 Medium |
| A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /index.php?page=types. Executing a manipulation of the argument ID can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been published and may be used. | ||||
| CVE-2026-6666 | 1 Pgbouncer | 1 Pgbouncer | 2026-07-24 | 5.9 Medium |
| A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE field. | ||||
| CVE-2026-16378 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 7.5 High |
| Other issue in the DOM: Copy & Paste and Drag & Drop component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16385 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 7.5 High |
| Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16386 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 7.5 High |
| Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16388 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 9.8 Critical |
| Sandbox escape in the DOM: Networking component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16389 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 9.8 Critical |
| Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16399 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 7.5 High |
| Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-16402 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 9.8 Critical |
| Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2023-4875 | 3 Debian, Mutt, Redhat | 3 Debian Linux, Mutt, Enterprise Linux | 2026-07-24 | 2.2 Low |
| Null pointer dereference when composing from a specially crafted draft message in Mutt >1.5.2 <2.2.12 | ||||
| CVE-2023-4874 | 3 Debian, Mutt, Redhat | 3 Debian Linux, Mutt, Enterprise Linux | 2026-07-24 | 4.3 Medium |
| Null pointer dereference when viewing a specially crafted email in Mutt >1.5.2 <2.2.12 | ||||
| CVE-2026-16407 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-07-24 | 9.8 Critical |
| Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. | ||||
| CVE-2026-13059 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-07-24 | 8.1 High |
| An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level access controls, due to insufficient validation of certain client-supplied command parameters. The issue affects find, update, delete, and aggregate commands in non-apiStrict configurations. | ||||
| CVE-2026-13067 | 1 Mongodb | 2 Mongodb, Mongodb Server | 2026-07-24 | 6.3 Medium |
| When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority. | ||||
| CVE-2026-59139 | 1 Egor | 1 Data::reqrep::shared | 2026-07-24 | 9.1 Critical |
| Data::ReqRep::Shared versions before 0.05 for Perl allow an out-of-bounds read via an unvalidated arena offset and length in reqrep_recv_locked. The attach-time validator reqrep_validate_header checks the header scalars and region layout against the file size, but does not validate the array contents it then trusts. reqrep_recv_locked does memcpy(copy_buf, req_arena + arena_off, len) with arena_off and len read raw from the mmap'd segment and never bounded against the arena capacity (req_arena_cap). A local peer that can write the backing file can leave the header valid while poisoning a request slot's offset and length, so receiving the request copies a file-controlled offset and length out of the arena, reading adjacent memory or crashing the process. | ||||
| CVE-2026-47143 | 1 Capstone-engine | 1 Capstone | 2026-07-24 | 5.1 Medium |
| Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`, allowing a remote attacker to crash any application using the reduced X86 Capstone library by supplying a crafted input containing the 4-byte sequence `0F 0F <modrm> <imm8>`. Versions 6.0.0-Alpha8 and 5.0.8 patch the issue. | ||||