Total
925 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-74895 | 1 Jahlives | 1 Openssl Encrypt | 2026-09-01 | N/A | 9.8 CRITICAL |
| openssl_encrypt versions before 1.4.0 fail to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules. | |||||
| CVE-2026-74896 | 1 Jahlives | 1 Openssl Encrypt | 2026-09-01 | N/A | 9.8 CRITICAL |
| openssl_encrypt versions before 1.4.0 contain a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code. | |||||
| CVE-2024-0682 | 1 Sivel | 1 Page Restrict | 2026-09-01 | N/A | 5.3 MEDIUM |
| The Page Restrict plugin for WordPress is vulnerable to information disclosure in all versions up to, and including, 2.5.5. This is due to the plugin not properly restricting access to posts via the REST API when a page has been made private. This makes it possible for unauthenticated attackers to view protected posts. | |||||
| CVE-2026-74790 | 2026-08-31 | N/A | 9.1 CRITICAL | ||
| Scriban before 7.0.0 caches TypedObjectAccessor by Type only without considering MemberFilter changes, allowing reused TemplateContext instances to expose members that should be hidden. Attackers can access filtered properties and fields by reusing a TemplateContext after tightening its MemberFilter, bypassing sandbox policies across requests or tenants. | |||||
| CVE-2024-11734 | 2026-08-31 | N/A | 6.5 MEDIUM | ||
| A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This action is done by modifying any of the security headers and inserting newlines, which causes the Keycloak server to write to a request that has already been terminated, leading to the failure of said request. | |||||
| CVE-2026-79988 | 2026-08-28 | N/A | N/A | ||
| The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities. | |||||
| CVE-2026-79006 | 1 Google | 1 Chrome | 2026-08-28 | N/A | 4.3 MEDIUM |
| Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium) | |||||
| CVE-2026-43670 | 1 Apple | 4 Ipados, Iphone Os, Macos and 1 more | 2026-08-27 | N/A | 8.8 HIGH |
| A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5. Processing maliciously crafted web content may bypass Content Security Policy. | |||||
| CVE-2026-0012 | 1 Google | 1 Android | 2026-08-26 | N/A | 6.2 MEDIUM |
| In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-0011 | 1 Google | 1 Android | 2026-08-26 | N/A | 8.4 HIGH |
| In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | |||||
| CVE-2026-13342 | 2026-08-26 | N/A | 5.3 MEDIUM | ||
| The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeating the access control the administrator configured. | |||||
| CVE-2026-74957 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-24 | N/A | 8.1 HIGH |
| Mitigation bypass in the Safe Browsing component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74959 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-24 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the Storage: Cache API component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2025-46291 | 1 Apple | 1 Macos | 2026-08-21 | N/A | 7.8 HIGH |
| A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.2. An app may bypass Gatekeeper checks. | |||||
| CVE-2025-46281 | 1 Apple | 1 Macos | 2026-08-21 | N/A | 8.8 HIGH |
| A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to break out of its sandbox. | |||||
| CVE-2026-17079 | 1 Ibm | 1 Db2 Mirror For I | 2026-08-20 | N/A | 6.3 MEDIUM |
| IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due to the ability to disable server-side input validation via a request parameter. | |||||
| CVE-2026-13601 | 2 Gnome, Redhat | 2 Yelp, Enterprise Linux | 2026-08-20 | N/A | 7.1 HIGH |
| A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information. | |||||
| CVE-2026-74983 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 8.1 HIGH |
| Mitigation bypass in the Data Loss Prevention component. This vulnerability was fixed in Firefox 154, Firefox ESR 140.14, Firefox ESR 153.1, Thunderbird 154, Thunderbird 140.14, and Thunderbird 153.1. | |||||
| CVE-2026-74938 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-19 | N/A | 9.1 CRITICAL |
| Mitigation bypass in the JavaScript: GC component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-18428 | 2026-08-14 | N/A | 8.8 HIGH | ||
| A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint. | |||||