Total
398522 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-45820 | 1 101arrowz | 1 Fflate | 2026-08-19 | N/A | 7.5 HIGH |
| fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true. | |||||
| CVE-2017-20277 | 1 Joomboost | 1 Joomla Joomrecipe | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla JoomRecipe 1.0.4 component contains a blind SQL injection vulnerability in the search_author parameter on the search results page. Attackers can inject SQL code through POST requests to the search endpoint to extract database information using boolean-based blind SQL injection techniques. | |||||
| CVE-2017-20276 | 1 Simbunch | 1 Simgenealogy | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla! Component SIMGenealogy 2.1.5 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the type parameter. Attackers can send GET requests to index.php with the option=com_simgenealogy, view=latest parameters and inject malicious SQL in the type parameter to extract sensitive database information. | |||||
| CVE-2026-60846 | 1 Oracle | 1 E-business Suite | 2026-08-19 | N/A | 6.7 MEDIUM |
| Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA Terminal Server). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Mobile Application Server accessible data as well as unauthorized update, insert or delete access to some of Oracle Mobile Application Server accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Mobile Application Server. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H). | |||||
| CVE-2017-20278 | 1 Joomboost | 1 Joomrecipe | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla Component JoomRecipe 1.0.3 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the category parameter. Attackers can send GET requests to the all-recipes endpoint with malicious SQL payloads in the category path segment to extract sensitive database information. | |||||
| CVE-2026-60845 | 1 Oracle | 1 E-business Suite | 2026-08-19 | N/A | 7.2 HIGH |
| Vulnerability in the Oracle Mobile Application Server product of Oracle E-Business Suite (component: MWA General Bugs). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle Mobile Application Server. Successful attacks of this vulnerability can result in takeover of Oracle Mobile Application Server. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). | |||||
| CVE-2017-20279 | 1 Extensions | 1 Joomla Payage | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the aid parameter. Attackers can send GET requests to index.php with malicious aid values in the make_payment task to extract sensitive database information using boolean-based blind or time-based blind techniques. | |||||
| CVE-2017-20280 | 1 Myportfolio | 1 Myportfolio | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla Component Myportfolio 3.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the pid parameter. Attackers can send GET requests to index.php with malicious pid values in the task=project&view=grid endpoint to extract sensitive database information. | |||||
| CVE-2017-20281 | 1 Joomlaboat | 1 Extra Search | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the establename parameter. Attackers can send GET requests to index.php with the option=com_extrasearch parameter and malicious SQL in the establename field to extract sensitive database information. | |||||
| CVE-2017-20282 | 1 Soft-php | 1 Jcart For Opencart | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla! Component jCart for OpenCart 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the product_id parameter. Attackers can send GET requests to index.php with the option=com_jcart&route=product/product parameters and malicious product_id values to extract sensitive database information. | |||||
| CVE-2019-25748 | 1 Cmsjunkie | 1 Jhotelreservation | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla JHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the rooms parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL payloads in the rooms parameter to extract sensitive database information including version details. | |||||
| CVE-2026-2368 | 1 Lenovo | 1 Filez | 2026-08-19 | N/A | 7.1 HIGH |
| An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to execute arbitrary code. | |||||
| CVE-2026-1068 | 1 Lenovo | 1 Filez | 2026-08-19 | N/A | 5.3 MEDIUM |
| An improper certificate validation vulnerability was reported in the Lenovo Filez application that could allow a user capable of intercepting network traffic to obtain sensitive user data from the application. | |||||
| CVE-2026-0520 | 1 Lenovo | 1 Filez | 2026-08-19 | N/A | 2.8 LOW |
| A potential vulnerability was reported in the Lenovo FileZ Android application that, under certain conditions, could allow a local authenticated user to retrieve some sensitive data stored in a log file. | |||||
| CVE-2019-25749 | 1 Cmsjunkie | 1 J-cruiseportal | 2026-08-19 | N/A | 7.1 HIGH |
| Joomla J-CruisePortal 6.0.4 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the guest_adult parameter. Attackers can send POST requests to the cruises endpoint with crafted SQL payloads in the guest_adult parameter to extract sensitive database information or manipulate database records. | |||||
| CVE-2019-25750 | 1 Cmsjunkie | 1 Multiplehotelreservation | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla Component J-MultipleHotelReservation 6.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the hotel_id parameter. Attackers can send POST requests to the search-hotels endpoint with crafted SQL UNION SELECT statements to extract sensitive database information including table names and column data. | |||||
| CVE-2019-25751 | 1 Cmsjunkie | 1 Classifiedsmanager | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla Component J-ClassifiedsManager 3.0.5 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through POST parameters. Attackers can submit crafted SQL payloads in the categorySearch, adType, and citySearch parameters to the displayads component to extract sensitive database information including usernames, databases, and version details. | |||||
| CVE-2026-20474 | 1 Mediatek | 34 Mt6991, Mt6991 Firmware, Mt6993 and 31 more | 2026-08-19 | N/A | 6.0 MEDIUM |
| In display, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11019183; Issue ID: MSV-7758. | |||||
| CVE-2019-25752 | 1 Cmsjunkie | 1 J-businessdirectory | 2026-08-19 | N/A | 8.2 HIGH |
| Joomla! Component J-BusinessDirectory 4.9.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the type parameter. Attackers can send GET requests to index.php with the option=com_jbusinessdirectory&task=categories.getCategories parameters and inject UNION-based SQL statements in the type parameter to extract database information including schema names and sensitive data. | |||||
| CVE-2025-71395 | 1 Surrealdb | 1 Surrealdb | 2026-08-19 | N/A | 6.5 MEDIUM |
| SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex patterns. An authenticated attacker can craft a malicious query to exhaust server memory through unbounded string allocations, causing denial of service. | |||||