Export limit exceeded: 369514 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (369514 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-16379 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Privilege escalation in the DOM: Content Processes component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. | ||||
| CVE-2026-16380 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Mitigation bypass in the Networking component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16382 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16384 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16386 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Information disclosure due to uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16387 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. | ||||
| CVE-2026-16389 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Incorrect boundary conditions, integer overflow in the Libraries component in NSS. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16390 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 153 and Firefox ESR 140.13. | ||||
| CVE-2026-16392 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16393 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Incorrect boundary conditions in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-8505 | 1 Ibm | 1 Langflow Oss | 2026-07-22 | 9.8 Critical |
| IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of any flow. The system incorrectly bypasses API key validation when the WEBHOOK_AUTH_ENABLE configuration is set to False (which is the default setting). This allows a remote attacker who knows a flow's UUID to execute it as if they were the owner, potentially leading to Remote Code Execution (RCE). | ||||
| CVE-2026-16398 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16402 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Integer overflow in the Graphics: ImageLib component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16407 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Mitigation bypass in the DOM: Service Workers component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16409 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| Invalid pointer in the Security: PSM component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-16410 | 1 Mozilla | 1 Firefox | 2026-07-22 | N/A |
| JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 153. | ||||
| CVE-2026-7755 | 1 Ibm | 1 Langflow Oss | 2026-07-22 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files. | ||||
| CVE-2026-13448 | 1 Ibm | 1 Langflow Oss | 2026-07-22 | 8.1 High |
| IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/build_public_tmp/{flow_id}/flow ). The vulnerability stems from an incomplete denylist in the validate_public_flow_no_code_execution() function that fails to block several code-execution agent components including OpenDsStarAgent, CodeActAgentSmolagents, and CSVAgent. | ||||
| CVE-2026-56623 | 1 Apache | 1 Mina Sshd | 2026-07-22 | 7.1 High |
| Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server implemented with Apache MINA SSHD component sshd-git and running on Windows could allow an authenticated remote user access to git repositories outside of the configured server-side root directory. The path validation applied for CVE-2026-48827 in Apache MINA SSHD 2.18.0 and 3.0.0-M4 was partly ineffective for Servers running on Windows. Applications are affected if they use org.apache.sshd:sshd-git to implement a git server and run on Windows. Applications not using sshd-git or not running on Windows are not affected. Users are advised to upgrade affected applications to Apache MINA SSHD 2.19.0, which fixes the issue. The issue also is present in the pre-release milestones 3.0.0-M1 to 3.0.0-M4 for a new upcoming new major version 3.0.0. Again, applications are affected only if they use sshd-git and run on Windows. Upgrade affected applications to 3.0.0-M5. | ||||
| CVE-2026-13439 | 2 Hassantafreshi, Wordpress | 2 Easy Form Builder By Whitestudio — Drag & Drop Form Builder, Wordpress | 2026-07-22 | 9.8 Critical |
| The Easy Form Builder by WhiteStudio plugin for WordPress is vulnerable to Unauthenticated Privilege Escalation to Administrator in versions up to, and including, 4.0.11 This is due to the password recovery flow using the publicly-visible session identifier ('sid') as the password reset token stored in wp_emsfb_temp_links, combined with a publicly-accessible nonce refresh endpoint (Emsfb/v1/nonce/refresh) that issues valid WordPress REST nonces to unauthenticated visitors. This makes it possible for unauthenticated attackers to reset the password of any WordPress user — including administrators — by scraping the public sid from a published login form page, submitting a recovery request for any known user email via Emsfb/v1/forms/message/add, and then calling Emsfb/v1/forms/recovery/efb_set_password with the known sid to set an arbitrary new password and gain full administrator access. | ||||