Export limit exceeded: 372093 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (372093 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66414 | 1 Leantime | 1 Leantime | 2026-07-30 | 6.1 Medium |
| Leantime 3.6.2 contains an open redirect vulnerability in the Login controller that allows unauthenticated attackers to redirect authenticated users to arbitrary external sites by manipulating the redirectUrl POST parameter. Attackers can craft a malicious login URL with a tampered redirectUrl value that bypasses FILTER_SANITIZE_URL validation to redirect victims to attacker-controlled sites for phishing or credential theft. | ||||
| CVE-2026-17741 | 1 Google | 1 Chrome | 2026-07-30 | 7.1 High |
| Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17739 | 1 Google | 1 Chrome | 2026-07-30 | 4.2 Medium |
| Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium) | ||||
| CVE-2026-17737 | 1 Google | 1 Chrome | 2026-07-30 | 5 Medium |
| Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17736 | 1 Google | 1 Chrome | 2026-07-30 | 5.8 Medium |
| Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17999 | 1 Google | 1 Chrome | 2026-07-30 | 6.5 Medium |
| Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-12943 | 1 Ibm | 2 Hmc V10310500, Hmc V11111100 | 2026-07-30 | 9.8 Critical |
| IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the system due to improper validation of user supplied input. | ||||
| CVE-2026-13444 | 1 Ibm | 1 Langflow Oss | 2026-07-30 | N/A |
| IBM Langflow OSS 1.0.0 through 1.10.1 can allow an attacker to access another user's private vector documents by creating their own flow with matching Chroma persist_directory and collection_name values. The attacker receives exact victim content in their workflow output despite having no authorization to read the victim's flow. Additionally, the attacker can pollute the victim's collection by inserting their own documents into the shared namespace. | ||||
| CVE-2026-17986 | 1 Google | 1 Chrome | 2026-07-30 | 6.5 Medium |
| Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-10545 | 1 Ibm | 1 Planning Analytics Local | 2026-07-30 | 7.5 High |
| IBM Planning Analytics Local 2.1.0 through 2.1.21 is vulnerable to an open redirect that allows an attacker to redirect users to arbitrary external websites via a crafted URL. If used in SSO authentication flows, this could result in exposure of session tokens and allow attackers to hijack user sessions. | ||||
| CVE-2026-15054 | 2 Bit Form, Wordpress | 2 Bit Form, Wordpress | 2026-07-30 | 3.7 Low |
| The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email notifications) of forms the site owner has deactivated or unpublished. | ||||
| CVE-2026-17996 | 1 Google | 1 Chrome | 2026-07-30 | 6.2 Medium |
| Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low) | ||||
| CVE-2026-15899 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-15900 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Use after free in GPU in Google Chrome on Android prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-15901 | 1 Google | 1 Chrome | 2026-07-30 | 9.6 Critical |
| Use after free in Network in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-15903 | 1 Google | 1 Chrome | 2026-07-30 | 8.8 High |
| Out of bounds read and write in V8 in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-15904 | 1 Google | 1 Chrome | 2026-07-30 | 8.8 High |
| Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.128 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-30632 | 1 Knowns-dev | 1 Knowns | 2026-07-30 | 7.5 High |
| Directory traversal vulnerability in knowns-dev/knowns 0.11.4 via crafted folder name value to the create_doc tool. | ||||
| CVE-2026-13379 | 1 Openvpn | 1 Openvpn | 2026-07-30 | N/A |
| The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during the disconnection process | ||||
| CVE-2026-13117 | 1 Openvpn | 1 Openvpn | 2026-07-30 | N/A |
| An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage | ||||