Export limit exceeded: 369657 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369657 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-13182 | 2026-07-22 | 7.5 High | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, RadAsyncUpload client-state processing can distinguish decrypt failures from invalid-JSON parse failures, creating an oracle that reveals protected metadata values to remote attackers. | ||||
| CVE-2026-13184 | 2026-07-22 | 7.5 High | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, when Telerik.Upload.ConfigurationHashKey is absent and machineKey is not explicitly configured, upload metadata integrity protection may fall back to a predictable default key, enabling attackers to forge protected upload metadata and unlock further exploit chains. | ||||
| CVE-2026-13185 | 2026-07-22 | 8.1 High | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout deserialize attacker-controlled cookie content, allowing unauthenticated remote code execution. | ||||
| CVE-2026-13186 | 2026-07-22 | 8.1 High | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-based persistence storage provider can be exploited when the storage key is derived from user-controlled input, enabling attacker-controlled deserialization and remote code execution. | ||||
| CVE-2026-13187 | 2026-07-22 | 8.1 High | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler provider type input may be tampered with, potentially altering dialog processing and enabling chained exploitation. | ||||
| CVE-2026-13188 | 2026-07-22 | 5.9 Medium | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, DialogHandler request parameters may be tampered with, potentially altering dialog server-side behavior and enabling chained exploitation. | ||||
| CVE-2026-13077 | 2026-07-22 | 7.1 High | ||
| A missing bounds check in the BSON CodeWScope element accessors allows an attacker to trigger an out-of-bounds heap read via a crafted aggregation pipeline. The vulnerability can be exploited by an authenticated user by generating a malformed BSONColumn data containing a CodeWScope element, bypassing wire-level BSON validation. When the forged element is decompressed, the unchecked size value is used in pointer arithmetic, causing either a server crash or disclosure of adjacent heap memory contents. | ||||
| CVE-2026-13189 | 2026-07-22 | 7.5 High | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to influence server-side file path resolution and trigger unintended server-side requests. | ||||
| CVE-2026-13190 | 2026-07-22 | 8.1 High | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, a deserialization vulnerability in the persistence utilities allows unsafe type instantiation from attacker-influenced persisted state, which can lead to remote code execution. | ||||
| CVE-2026-13192 | 2026-07-22 | 6.5 Medium | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of content submitted to the RadEditor PDF export feature may allow an authenticated attacker to trigger server-side requests to arbitrary hosts, resulting in outbound network connections and potential exposure of Windows authentication credentials. | ||||
| CVE-2026-14865 | 2026-07-22 | 5.3 Medium | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, the internal LayoutBuilder control processes client-state XML without disabling DTD processing, allowing unauthenticated denial of service via recursive XML entity expansion. | ||||
| CVE-2025-71395 | 2026-07-22 | N/A | ||
| SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service. | ||||
| CVE-2026-14932 | 2026-07-22 | 6.5 Medium | ||
| In Progress® Telerik® UI for AJAX prior to v2026.2.708, the obsolete RadChart component's ChartImage.axd handler is vulnerable to unauthenticated file read and deletion of image-extension files within the application directory. | ||||
| CVE-2026-59849 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-07-22 | 3.1 Low |
| A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service. | ||||
| CVE-2026-59846 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-07-22 | 3.9 Low |
| A flaw was found in libssh. A malicious username expanded through %r in ProxyCommand handling can inject shell metacharacters, exposing environment variables and causing unintended shell behavior. | ||||
| CVE-2026-59842 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-07-22 | 3.7 Low |
| A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory. | ||||
| CVE-2026-59850 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-07-22 | 4.3 Medium |
| A flaw was found in libssh. If data packets are processed after a channel is closed, channel data callbacks can be invoked after the associated data has already been freed, leading to crashes or possible use-after-free conditions. | ||||
| CVE-2026-16441 | 1 Eclipse | 1 Openj9 | 2026-07-22 | N/A |
| In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstract, execution is incorrectly delegated to an interface default method. | ||||
| CVE-2026-59848 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-07-22 | 5.3 Medium |
| A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service. | ||||
| CVE-2026-59847 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-07-22 | 5.9 Medium |
| A flaw was found in libssh. Incorrect AES-GCM finalization checks in builds using the OpenSSL backend can effectively remove integrity protection, allowing an in-path attacker to modify plaintext on the wire without detection. | ||||