Total
398912 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-54386 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned. | |||||
| CVE-2023-54385 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned. | |||||
| CVE-2023-54384 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned. | |||||
| CVE-2023-54383 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; never assigned. | |||||
| CVE-2023-54382 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2023-54381 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2023-54380 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2023-54379 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2023-54378 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2023-54377 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2023-54376 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2023-54375 | 2026-08-06 | N/A | N/A | ||
| Rejected reason: Erroneously reserved under wrong year by automation defect; superseded by correct-year CVE. | |||||
| CVE-2026-55767 | 1 Guzzlephp | 1 Guzzle | 2026-08-05 | N/A | 5.8 MEDIUM |
| Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, CookieJar incorrectly accepts cookies with a dot-only Domain attribute and whitespace-padded variants. SetCookie::matchesDomain() removes leading dots from the cookie domain, normalizing dot-only values to the empty string; SetCookie::validate() only rejected a strictly empty domain, so these cookies could be stored and the empty normalized domain was treated as matching any request host. An attacker-controlled origin that an application requests with a shared cookie jar can therefore set a cookie that Guzzle later sends to unrelated hosts using the same jar. This may allow cookie injection or session fixation against downstream services, depending on how those services interpret the injected cookie. This vulnerability is fixed in 7.12.1. | |||||
| CVE-2022-1353 | 4 Debian, Linux, Netapp and 1 more | 19 Debian Linux, Linux Kernel, H300e and 16 more | 2026-08-05 | 3.6 LOW | 7.1 HIGH |
| A vulnerability was found in the pfkey_register function in net/key/af_key.c in the Linux kernel. This flaw allows a local, unprivileged user to gain access to kernel memory, leading to a system crash or a leak of internal kernel information. | |||||
| CVE-2021-3501 | 4 Fedoraproject, Linux, Netapp and 1 more | 27 Fedora, Linux Kernel, Cloud Backup and 24 more | 2026-08-05 | 3.6 LOW | 7.1 HIGH |
| A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated by a user process at anytime which could lead to an out-of-bounds write. The highest threat from this vulnerability is to data integrity and system availability. | |||||
| CVE-2021-3483 | 3 Debian, Linux, Netapp | 19 Debian Linux, Linux Kernel, Cloud Backup and 16 more | 2026-08-05 | 4.6 MEDIUM | 7.8 HIGH |
| A flaw was found in the Nosy driver in the Linux kernel. This issue allows a device to be inserted twice into a doubly-linked list, leading to a use-after-free when one of these devices is removed. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Versions before kernel 5.12-rc6 are affected | |||||
| CVE-2024-13461 | 1 Patternsinthecloud | 1 Autoship Cloud For Woocommerce | 2026-08-05 | N/A | 6.4 MEDIUM |
| The Autoship Cloud for WooCommerce Subscription Products plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'autoship-create-scheduled-order-action' shortcode in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | |||||
| CVE-2026-17346 | 1 Pgadmin | 1 Pgadmin 4 | 2026-08-05 | N/A | 8.8 HIGH |
| The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in test_sql_string_literal_lint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and subscription names sourced from pg_catalog via the browser tree could never contain an apostrophe. PostgreSQL permits arbitrary characters in quoted identifiers, so a low-privileged user able to CREATE TABLE, CREATE PUBLICATION, or CREATE SUBSCRIPTION can plant an apostrophe'd object name that breaks out of the unescaped '{{ name }}' template interpolation the moment any user (including a higher-privileged one) opens that object's Statistics or Dependencies tab, allowing arbitrary SQL statement injection in the viewing user's database session. Affected sinks: the Index Statistics query for all-indexes listing (coll_stats.sql, both the 16_plus and default PostgreSQL-version template variants -- distinct from the single-index stats.sql path already fixed in CVE-2026-12044), and the publication and subscription dependencies.sql / get_position.sql templates (both the pg and ppas/EPAS dialect variants for publications). Fix switches all of these templates to qtLiteral(conn) for name interpolation, and updates publications/__init__.py and subscriptions/__init__.py to pass conn=self.conn into the dependencies.sql render_template call so the qtLiteral filter has a connection to quote against. The corresponding ALLOWLIST entries in test_sql_string_literal_lint.py are removed now that these sinks are properly escaped rather than merely assumed safe. A behavioral regression test renders each fixed template with a stacked-statement apostrophe payload and asserts both that the object name appears exactly as qtLiteral-escaped and that the rendered SQL parses as exactly one statement, verifying the assertion genuinely fails against the pre-patch raw-interpolation form. This issue affects pgAdmin 4: the Index Statistics sink from 1.0, and the Publications/Subscriptions sinks from 5.0, both before 9.17. | |||||
| CVE-2026-11536 | 1 Ibm | 1 Websphere Application Server | 2026-08-05 | N/A | 8.5 HIGH |
| IBM WebSphere Application Server 9.0, and 8.5 is affected by a remote code execution vulnerability in the SOAP/JMX connector. | |||||
| CVE-2026-10695 | 1 Ibm | 1 Db2 | 2026-08-05 | N/A | 6.2 MEDIUM |
| IBM Db2 12.1.0 through 12.1.4 federated server is vulnerable to a denial of service when running non fenced federated queries. | |||||