Total
398478 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-70963 | 1 Oracle | 1 Hyperion Infrastructure Technology | 2026-08-25 | N/A | 4.2 MEDIUM |
| Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 4.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). | |||||
| CVE-2026-70964 | 1 Oracle | 1 Hyperion Infrastructure Technology | 2026-08-25 | N/A | 8.2 HIGH |
| Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. While the vulnerability is in Oracle Hyperion Infrastructure Technology, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized access to critical data or complete access to all Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N). | |||||
| CVE-2026-70965 | 1 Oracle | 1 Hyperion Infrastructure Technology | 2026-08-25 | N/A | 8.8 HIGH |
| Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | |||||
| CVE-2026-65770 | 1 Microsoft | 1 Azure Managed Instance For Apache Cassandra | 2026-08-25 | N/A | 10.0 CRITICAL |
| Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-70966 | 1 Oracle | 1 Hyperion Infrastructure Technology | 2026-08-25 | N/A | 8.8 HIGH |
| Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks of this vulnerability can result in takeover of Oracle Hyperion Infrastructure Technology. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). | |||||
| CVE-2026-35244 | 1 Oracle | 1 Hyperion Infrastructure Technology | 2026-08-25 | N/A | 5.2 MEDIUM |
| Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management). The supported version that is affected is 11.2.24.0.000. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Hyperion Infrastructure Technology. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Hyperion Infrastructure Technology accessible data as well as unauthorized read access to a subset of Oracle Hyperion Infrastructure Technology accessible data. CVSS 3.1 Base Score 5.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:H/A:N). | |||||
| CVE-2026-16938 | 1 Ibm | 18 Power System E1080 \(9080-hex\), Power System E1080 \(9080-hex\) Firmware, Power System E1180 \(9080-heu\) and 15 more | 2026-08-25 | N/A | 6.9 MEDIUM |
| IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in access controls over privileged system configuration operations on the FSP. An attacker with authenticated administrator-level access to the FSP can place the managed system into a non-production operational mode, allowing certain system components to be disabled. This condition persists across FSP resets and requires explicit operator intervention — clearing the affected configuration — to restore normal operation. Successful exploitation results in an availability impact to the managed system. | |||||
| CVE-2026-26080 | 1 Haproxy | 3 Aloha, Haproxy, Haproxy Enterprise | 2026-08-25 | N/A | 3.7 LOW |
| HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected. | |||||
| CVE-2026-26081 | 1 Haproxy | 3 Aloha, Haproxy, Haproxy Enterprise | 2026-08-25 | N/A | 4.8 MEDIUM |
| HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEW_TOKEN format. HAProxy Enterprise and ALOHA are also affected. | |||||
| CVE-2026-74980 | 1 Mozilla | 1 Firefox Mobile | 2026-08-25 | N/A | 6.5 MEDIUM |
| Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | |||||
| CVE-2026-74975 | 1 Mozilla | 1 Firefox Mobile | 2026-08-25 | N/A | 5.4 MEDIUM |
| Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154. | |||||
| CVE-2026-74985 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-25 | N/A | 9.8 CRITICAL |
| Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74970 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-25 | N/A | 5.4 MEDIUM |
| Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-74977 | 1 Mozilla | 2 Firefox, Thunderbird | 2026-08-25 | N/A | 7.5 HIGH |
| Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | |||||
| CVE-2026-17497 | 1 Notegen | 1 Notegen | 2026-08-25 | N/A | 8.3 HIGH |
| NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine. | |||||
| CVE-2026-17496 | 1 Notegen | 1 Notegen | 2026-08-25 | N/A | 8.1 HIGH |
| NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt (for example a malicious skill REFERENCE.md that instructs the model to emit HTML) can cause the model response to include executable markup such as an img onerror handler. When the user views the chat response, that markup runs as JavaScript in the privileged Tauri webview, enabling arbitrary script execution in the application context (cross-site scripting). | |||||
| CVE-2026-73585 | 1 Redhat | 1 Enterprise Linux | 2026-08-25 | N/A | 6.3 MEDIUM |
| A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with elevated privileges and may be mitigated by sticky-directory symlink protections. | |||||
| CVE-2026-73584 | 1 Redhat | 1 Enterprise Linux | 2026-08-25 | N/A | 6.3 MEDIUM |
| A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system. | |||||
| CVE-2026-73583 | 1 Redhat | 1 Enterprise Linux | 2026-08-25 | N/A | 6.6 MEDIUM |
| A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure. | |||||
| CVE-2026-77036 | 2026-08-25 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was found in elunez eladmin up to 2.7. The impacted element is the function EmailController/AliPayController/GeneratorController/GenConfigController. The manipulation results in improper authorization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||