Search
CVE Explorer
Search the full tracked CVE corpus across every vendor — by keyword, vendor, severity, CVSS band and publication date. Server-rendered; each filtered view has its own URL.
01
Filters
Submit to refine — state is held in the URL.
02
Results
38,006 matching · page 182/761Each CVE id links to its NVD record.
| CVE | Severity | CVSS | Summary | Published |
|---|---|---|---|---|
| CVE-2026-53788(opens NVD record) | Medium | 6.5 | rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic. | Aug 13, 2026 |
| CVE-2026-53786(opens NVD record) | Medium | 6.5 | rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude. | Aug 13, 2026 |
| CVE-2026-53785(opens NVD record) | High | 7.1 | rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem. | Aug 13, 2026 |
| CVE-2026-53784(opens NVD record) | High | 7.1 | rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access. | Aug 13, 2026 |
| CVE-2026-53783(opens NVD record) | High | 8.1 | rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree. | Aug 13, 2026 |
| CVE-2026-49857(opens NVD record) | High | 7.4 | auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue. | Aug 13, 2026 |
| CVE-2026-49856(opens NVD record) | Medium | 4.3 | @jshookmcp/jshook is an MCP server that gives AI agents tools for JavaScript analysis and security research. In version 0.3.1, he network domain has a central SSRF authorization policy that blocks private, loopback, link-local, and reserved targets unless an explicit authorization object allows private network access. The policy is enforced by raw HTTP/TCP/TLS RTT tools, but the ICMP probe and traceroute tools resolve the target and invoke the native ICMP/traceroute sink directly. An MCP client with access to an active network domain can therefore ask the jshookmcp server to probe internal addresses even when local SSRF access is disabled for the other raw network tools. This exposes an internal reachability and route mapping primitive from the server network position. Version 0.3.2 fixes the issue. | Aug 13, 2026 |
| CVE-2026-49820(opens NVD record) | Medium | 4.7 | Probo is a self-hostable governance, risk, and compliance (GRC) platform built for engineering and security teams. Probo's `saferedirect` package validates redirect URLs used across authentication flows (OIDC, SAML, session transfer, OAuth connectors, and trust-center magic links). Prior to version 0.19.3.1, the validator only inspected the second character of relative paths, so a URL like `/../\evil.com` passed validation because the second character is `.`. Go's `http.Redirect` normalizes this path to `/\evil.com` before setting the `Location` header. Browsers can interpret the backslash as a host separator and redirect the user to an external domain (`https://evil.com`), bypassing the intended same-origin restriction. This enables open-redirect phishing: an attacker can craft a `continue` parameter (or embed a malicious URL in a session-transfer token) that appears to originate from a trusted Probo domain but redirects victims elsewhere. This is fixed in `go.probo.inc/probo` 0.193.1 by normalizing relative paths with `path.Clean` before validation, rejecting backslashes (including percent-encoded `%5c`) anywhere in the path, and re-checking the normalized result for protocol-relative and backslash prefixes. Self-hosted deployments should upgrade to probod v0.194.1 or later. SaaS deployments on getprobo.com are patched. No practical workaround is available for self-hosted installations. | Aug 13, 2026 |
| CVE-2026-28154(opens NVD record) | High | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7. | Aug 13, 2026 |
| CVE-2026-19734(opens NVD record) | Unscored | — | Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id. | Aug 13, 2026 |
| CVE-2026-19293(opens NVD record) | High | 8.8 | SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below. | Aug 13, 2026 |
| CVE-2026-19292(opens NVD record) | High | 8.8 | Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below. | Aug 13, 2026 |
| CVE-2026-19291(opens NVD record) | High | 8.8 | Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below. | Aug 13, 2026 |
| CVE-2026-16101(opens NVD record) | High | 8.8 | Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below | Aug 13, 2026 |
| CVE-2026-15994(opens NVD record) | High | 7.0 | During an internal security assessment, an improper link following vulnerability was identified in Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to execute code with elevated privileges. | Aug 13, 2026 |
| CVE-2026-14456(opens NVD record) | High | 7.5 | Issue summary: When an OpenSSL QUIC server (Listener SSL object) processes valid QUIC Initial packets for unknown destination connection IDs, it can allocate and queue new incoming channels without enforcing any limit. Impact summary: A remote peer that can make many Initial packets reach the server listener faster than the application accepts connections, can cause the memory allocated to store the per-channel state to grow without any limits, potentially making the QUIC listener unavailable and causing Denial of Service. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: The function that handles inbound QUIC packets uses Connection-Id from the packet header to find an existing connection (QUIC channel). If no existing connection is found and the packet type is INITIAL, the function treats the packet as a new connection. It allocates a new channel object and inserts it into a queue where it waits to be accepted by the local application with SSL_accept(3ossl). The memory occupied by these initial channel objects may grow without bounds if the application is not able to call SSL_accept() frequently enough to serve these inbound connection requests. The issue is present since OpenSSL 3.5 when the QUIC server implementation was added. The fix introduces a limit for pending connections. The default limit is set to 256 pending connections (waiting to be accepted by the local application). Applications may change the default by calling SSL_set_value_uint(3ossl). FIPS impact: no The FIPS module is not affected as the QUIC implementation is outside of the OpenSSL FIPS module boundary. | Aug 13, 2026 |
| CVE-2026-14256(opens NVD record) | Medium | 4.7 | ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash. | Aug 13, 2026 |
| CVE-2026-12036(opens NVD record) | High | 7.1 | An improper link following vulnerability was reported in the VantageCoreAddin for Lenovo Vantage and Lenovo Commercial Vantage that could allow a local authenticated user to perform an arbitrary file deletion with elevated privileges. | Aug 13, 2026 |
| CVE-2026-73403(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. | Aug 13, 2026 |
| CVE-2026-73401(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions. | Aug 13, 2026 |
| CVE-2026-73357(opens NVD record) | Medium | 6.5 | Donor Cross Site Scripting (XSS) in GiveWP < 4.16.6 versions. | Aug 13, 2026 |
| CVE-2026-73353(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions. | Aug 13, 2026 |
| CVE-2026-73349(opens NVD record) | Medium | 5.3 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | Aug 13, 2026 |
| CVE-2026-73346(opens NVD record) | High | 7.6 | Administrator SQL Injection in MailChimp For WooCommerce < 6.2 versions. | Aug 13, 2026 |
| CVE-2026-73344(opens NVD record) | Medium | 5.9 | Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | Aug 13, 2026 |
| CVE-2026-73340(opens NVD record) | Medium | 6.5 | Contributor Cross Site Scripting (XSS) in Featured Image from URL <= 5.3.3 versions. | Aug 13, 2026 |
| CVE-2026-73188(opens NVD record) | Unscored | — | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Duplicate to CVE-2026-13610. | Aug 13, 2026 |
| CVE-2026-67991(opens NVD record) | High | 7.5 | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition in RubyLLM::Utils.underscore on Ruby 3.1.x. A very long crafted class, agent, or tool name can cause excessive CPU consumption and a denial of service. | Aug 13, 2026 |
| CVE-2026-67990(opens NVD record) | Medium | 5.4 | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f disables Rails CSRF protection for its Alertmanager and Prometheus proxy controllers. An unauthenticated attacker can induce a logged-in user's browser to submit requests that are forwarded to enabled upstream write or management endpoints, such as creating an Alertmanager silence or requesting a Prometheus reload. The final impact depends on the APIs enabled by the upstream services. | Aug 13, 2026 |
| CVE-2026-67986(opens NVD record) | High | 8.4 | amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names. | Aug 13, 2026 |
| CVE-2026-66704(opens NVD record) | High | 7.2 | Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions. | Aug 13, 2026 |
| CVE-2026-66700(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Smart Online Order for Clover <= 1.6.1 versions. | Aug 13, 2026 |
| CVE-2026-66698(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in SureDash <= 1.10.1 versions. | Aug 13, 2026 |
| CVE-2026-66697(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. | Aug 13, 2026 |
| CVE-2026-66693(opens NVD record) | Medium | 6.5 | Subscriber Broken Access Control in Motors <= 1.4.113 versions. | Aug 13, 2026 |
| CVE-2026-66691(opens NVD record) | Critical | 9.8 | Unauthenticated Broken Access Control in Nokri <= 1.6.6 versions. | Aug 13, 2026 |
| CVE-2026-66689(opens NVD record) | Medium | 6.3 | Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions. | Aug 13, 2026 |
| CVE-2026-66687(opens NVD record) | Medium | 6.5 | Customer Cross Site Scripting (XSS) in WpBookingly <= 1.3.2 versions. | Aug 13, 2026 |
| CVE-2026-66661(opens NVD record) | High | 7.7 | Subscriber Privilege Escalation in Directories Pro <= 2.0.5 versions. | Aug 13, 2026 |
| CVE-2026-66660(opens NVD record) | Medium | 6.5 | Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. | Aug 13, 2026 |
| CVE-2026-66658(opens NVD record) | High | 8.5 | Subscriber SQL Injection in Reviewer <= 3.14.2 versions. | Aug 13, 2026 |
| CVE-2026-66657(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Biagiotti Core <= 2.1.1 versions. | Aug 13, 2026 |
| CVE-2026-66656(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Foton Core <= 1.1.1 versions. | Aug 13, 2026 |
| CVE-2026-66655(opens NVD record) | High | 7.1 | Unauthenticated Cross Site Scripting (XSS) in MultiParcels Shipping For WooCommerce <= 1.30.36 versions. | Aug 13, 2026 |
| CVE-2026-66654(opens NVD record) | Medium | 6.0 | Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions. | Aug 13, 2026 |
| CVE-2026-66653(opens NVD record) | High | 8.1 | Unauthenticated Local File Inclusion in Barista <= 2.5.1 versions. | Aug 13, 2026 |
| CVE-2026-66478(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Church Admin <= 5.1.1 versions. | Aug 13, 2026 |
| CVE-2026-66472(opens NVD record) | Critical | 9.3 | Unauthenticated SQL Injection in Everest Backup <= 2.3.12 versions. | Aug 13, 2026 |
| CVE-2026-66471(opens NVD record) | Medium | 6.5 | Subscriber Cross Site Scripting (XSS) in Accordion <= 3.0.6 versions. | Aug 13, 2026 |
| CVE-2026-66469(opens NVD record) | High | 7.5 | Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions. | Aug 13, 2026 |