Total
398152 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-77034 | 2026-08-28 | N/A | N/A | ||
| Joomla Extension - joomlaeventmanager.net - Unauthenticated article overwrite and force-publish in Joomla Event Manager < 5.0.1 - Any visitor holding their own session token can republish and overwrite an article associated with an event. | |||||
| CVE-2026-76149 | 2026-08-28 | N/A | 4.4 MEDIUM | ||
| CorvusSKK contains an integer overflow vulnerability, which may allow malicious data to be written to a dictionary file. | |||||
| CVE-2026-57279 | 2026-08-28 | N/A | 6.8 MEDIUM | ||
| Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product. | |||||
| CVE-2026-66839 | 2026-08-28 | N/A | 6.7 MEDIUM | ||
| NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Unquoted Search Path or Element vulnerability (CWE-428). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges. | |||||
| CVE-2026-66109 | 2026-08-28 | N/A | 7.8 HIGH | ||
| A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the Windows system on which the affected product is installed may execute arbitrary code with SYSTEM privilege. | |||||
| CVE-2026-65875 | 2026-08-28 | N/A | 7.1 HIGH | ||
| BaserCMS provided by baserCMS Users Community contains a CSV file injection vulnerability. If a user downloads and opens a CSV file containing malicious code injected by an attacker, the malicious code may be executed. | |||||
| CVE-2026-59504 | 2026-08-28 | N/A | 9.1 CRITICAL | ||
| : Client-Side Enforcement of Server-Side Security vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-59501 | 2026-08-28 | N/A | 8.2 HIGH | ||
| : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-59506 | 2026-08-28 | N/A | 9.3 CRITICAL | ||
| : Missing Authentication for Critical Function vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-59502 | 2026-08-28 | N/A | 5.3 MEDIUM | ||
| : Observable Discrepancy vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-59499 | 2026-08-28 | N/A | 8.6 HIGH | ||
| : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions).. This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions).: All versions without Priwall v3. | |||||
| CVE-2026-59500 | 2026-08-28 | N/A | 10.0 CRITICAL | ||
| : Improper Authentication vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-59505 | 2026-08-28 | N/A | 8.6 HIGH | ||
| : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-59507 | 2026-08-28 | N/A | 9.3 CRITICAL | ||
| : Use of Hard-coded Credentials : Exposure of Sensitive Information to an Unauthorized Actor : Improper Access Control vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-59503 | 2026-08-28 | N/A | 9.1 CRITICAL | ||
| : Exposure of Sensitive Information to an Unauthorized Actor : Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Priority Portal Generator addon to Priority ERP (developed by Soft Solutions). This issue affects Portal Generator addon to Priority ERP (developed by Soft Solutions): All versions without Priwall v3. | |||||
| CVE-2026-1524 | 1 Neo4j | 1 Neo4j | 2026-08-28 | N/A | 9.8 CRITICAL |
| An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions: If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider. When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities. We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed. | |||||
| CVE-2026-1497 | 1 Neo4j | 1 Neo4j | 2026-08-28 | N/A | 7.2 HIGH |
| Incorrect resolving of namespaces in composite databases in Neo4j Enterprise edition prior to versions 2026.02 and 5.26.22 can lead to the following scenario: an admin that intends to give a user an access to a remote database constituent "namespace.name" will inadvertently grant access to any local database or remote alias called "name". If such database or alias doesn't exist when the command is run, the privileges will apply if it's created in the future. | |||||
| CVE-2026-14587 | 1 Neo4j | 1 Neo4j | 2026-08-28 | N/A | 7.5 HIGH |
| Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same way it treats a truncated bit mask. When an unauthenticated client sends a selected protocol version followed by 32 continuation bytes in the capability mask, the decoder resets the reader index and waits for more bytes instead of rejecting the protocol message and closing the channel. Because the same unread bytes remain at the front of the decoder buffer, appending a terminating byte later does not recover the connection. The decoder re-reads the same first 32 continuation bytes, returns without producing a handshake-finalization message, and leaves the channel open. This can be triggered before authentication by any client that can reach the Bolt connector. | |||||
| CVE-2026-1337 | 1 Neo4j | 1 Neo4j | 2026-08-28 | N/A | 5.4 MEDIUM |
| Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01. Proof of concept exploit: https://github.com/JoakimBulow/CVE-2026-1337 | |||||
| CVE-2024-34517 | 1 Neo4j | 1 Neo4j | 2026-08-28 | N/A | 6.5 MEDIUM |
| The Cypher component in Neo4j 5.0.0 through 5.18 mishandles IMMUTABLE privileges in some situations where an attacker already has admin access. | |||||