Export limit exceeded: 336180 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (336180 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-13601 | 2 Gnome, Redhat | 40 Glib, Ceph Storage, Codeready Linux Builder and 37 more | 2026-03-05 | 7.7 High |
| A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calculation of the length of the escaped string could overflow, leading to a potential write off the end of the newly allocated string. | ||||
| CVE-2025-5987 | 2 Libssh, Redhat | 6 Libssh, Enterprise Linux, Enterprise Linux Eus and 3 more | 2026-03-05 | 8.1 High |
| A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detected and may lead to libssh using a partially initialized cipher context. This occurs because the OpenSSL error code returned aliases with the SSH_OK code, resulting in libssh not properly detecting the error returned by the OpenSSL library. This issue can lead to undefined behavior, including compromised data confidentiality and integrity or crashes. | ||||
| CVE-2026-3236 | 2026-03-05 | N/A | ||
| In affected versions of Octopus Server it was possible to create a new API key from an existing access token resulting in the new API key having a lifetime exceeding the original API key used to mint the access token. | ||||
| CVE-2025-40931 | 2026-03-05 | N/A | ||
| Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. | ||||
| CVE-2024-57854 | 2026-03-05 | N/A | ||
| Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions. | ||||
| CVE-2026-29069 | 1 Craftcms | 2 Craft Cms, Craftcms | 2026-03-05 | 5.3 Medium |
| Craft is a content management system (CMS). Prior to 5.9.0-beta.2 and 4.17.0-beta.2, the actionSendActivationEmail() endpoint is accessible to unauthenticated users and does not require a permission check for pending users. An attacker with no prior access can trigger activation emails for any pending user account by knowing or guessing the user ID. If the attacker controls the target user’s email address, they can activate the account and gain access to the system. This vulnerability is fixed in 5.9.0-beta.2 and 4.17.0-beta.2. | ||||
| CVE-2026-28784 | 1 Craftcms | 2 Craft Cms, Craftcms | 2026-03-05 | 7.2 High |
| Craft is a content management system (CMS). Prior to 5.8.22 and 4.16.18, it is possible to craft a malicious payload using the Twig map filter in text fields that accept Twig input under Settings in the Craft control panel or using the System Messages utility, which could lead to a RCE. For this to work, you must have administrator access to the Craft Control Panel, and allowAdminChanges must be enabled for this to work, which is against our recommendations for any non-dev environment. Alternatively, you can have a non-administrator account with allowAdminChanges disabled, but you have access to the System Messages utility. Users should update to the patched versions (5.8.22 and 4.16.18) to mitigate the issue. | ||||
| CVE-2026-28697 | 1 Craftcms | 2 Craft Cms, Craftcms | 2026-03-05 | 9.1 Critical |
| Craft is a content management system (CMS). Prior to 4.17.0-beta.1 and 5.9.0-beta.1, an authenticated administrator can achieve Remote Code Execution (RCE) by injecting a Server-Side Template Injection (SSTI) payload into Twig template fields (e.g., Email Templates). By calling the craft.app.fs.write() method, an attacker can write a malicious PHP script to a web-accessible directory and subsequently access it via the browser to execute arbitrary system commands. This vulnerability is fixed in 4.17.0-beta.1 and 5.9.0-beta.1. | ||||
| CVE-2026-21628 | 2026-03-05 | N/A | ||
| A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution. | ||||
| CVE-2026-1605 | 2026-03-05 | 7.5 High | ||
| In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak. | ||||
| CVE-2025-11143 | 2026-03-05 | 3.7 Low | ||
| The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details. | ||||
| CVE-2026-28551 | 2026-03-05 | 4.7 Medium | ||
| Race condition vulnerability in the device security management module. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-28549 | 2026-03-05 | 6.6 Medium | ||
| Race condition vulnerability in the permission management service. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-28548 | 2026-03-05 | 7.1 High | ||
| Vulnerability of improper verification in the email application. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2026-28547 | 2026-03-05 | 6.8 Medium | ||
| Vulnerability of uninitialized pointer access in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-28546 | 2026-03-05 | 5.9 Medium | ||
| Buffer overflow vulnerability in the scanning module. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-28542 | 2026-03-05 | 7.3 High | ||
| Permission bypass vulnerability in the system service framework. Impact: Successful exploitation of this vulnerability may affect availability. | ||||
| CVE-2026-24924 | 1 Huawei | 1 Harmonyos | 2026-03-05 | 6.1 Medium |
| Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. | ||||
| CVE-2025-70220 | 1 Dlink | 1 Dir-513 | 2026-03-05 | 9.8 Critical |
| Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAutoDetecWAN_wizard4. | ||||
| CVE-2025-70218 | 1 Dlink | 1 Dir-513 | 2026-03-05 | N/A |
| Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via POST to the goform/formAdvFirewall component. | ||||