Total
400422 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-9487 | 1 Xml\ | 1 \ | 2026-08-05 | N/A | 9.1 CRITICAL |
| XML::Sig versions before 0.71 for Perl allow signature wrapping via duplicate ID. _get_signed_xml() in lib/XML/Sig.pm, called from verify(), resolves the SignedInfo Reference/@URI to a node with the XPath expression "//*[@ID='$id']" and returns the first node of the resulting node set. A document in which two elements share that ID value is accepted: the digest and signature are checked against whichever element comes first in document order, and the duplicate is not detected. Such a document verifies successfully while an application that resolves the same ID independently can read the second, attacker supplied element; in a SAML2 context this places the contents of an Assertion under attacker control. | |||||
| CVE-2026-9390 | 1 Xml\ | 1 \ | 2026-08-05 | N/A | 9.1 CRITICAL |
| XML::Sig versions before 0.71 for Perl allow XPath injection in ID lookup. verify() and _get_signed_xml() in lib/XML/Sig.pm build XPath expressions by concatenating the SignedInfo/Reference/@URI value read from the document being verified. The value is neither escaped nor checked against the NCName grammar that XML requires of an ID, so a URI containing a single quote closes the string literal in the generated expression and appends arbitrary XPath operators. A crafted URI can make the lookup match elements the reference does not name, or every element in the document, so which node is selected for digest verification is decided by the injected expression rather than by the reference. | |||||
| CVE-2026-56609 | 1 Hcltech | 1 Icontrol | 2026-08-05 | N/A | 4.8 MEDIUM |
| HCL iControl is affected by Weak SSL/TLS Version Supported vulnerability. It was observed that the application was using weak TLS versions such as TLS 1.0 and 1.1. These outdated protocols lack modern security features, making them vulnerable to known attacks and exposing sensitive information during data transmission. | |||||
| CVE-2026-56608 | 1 Hcltech | 1 Icontrol | 2026-08-05 | N/A | 3.7 LOW |
| HCL iControl is affected by Missing Access Control vulnerability. The application failed to enforce proper granular access controls, allowing users to access or view administrator-level functionalities without appropriate authorization. | |||||
| CVE-2026-56571 | 1 Hcltech | 1 Icontrol | 2026-08-05 | N/A | 3.7 LOW |
| HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated. | |||||
| CVE-2026-13062 | 1 Mongodb | 1 Mongodb | 2026-08-05 | N/A | 6.5 MEDIUM |
| An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata fields that are intended to be server-controlled, by sending crafted write commands through the mongos router on a sharded cluster. This can result in corruption of encrypted query correctness. | |||||
| CVE-2026-12947 | 1 Ibm | 1 App Connect Enterprise | 2026-08-05 | N/A | 7.5 HIGH |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 stores potentially sensitive information in log files that could be read by a local user. | |||||
| CVE-2026-13063 | 1 Mongodb | 1 Mongodb | 2026-08-05 | N/A | 4.3 MEDIUM |
| An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sending a crafted aggregation command. MongoDB's libmongocrypt library insufficiently validates payload-supplied values, which can result in an excessively large memory allocation. | |||||
| CVE-2026-13064 | 1 Mongodb | 1 Mongodb | 2026-08-05 | N/A | 6.5 MEDIUM |
| Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB deployments, potentially leading to resource exhaustion. The resulting CPU-bound operation cannot be interrupted through standard administrative controls. | |||||
| CVE-2026-13065 | 1 Mongodb | 1 Mongodb | 2026-08-05 | N/A | 6.5 MEDIUM |
| A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sortBy expression type to cause the mongod process to terminate abnormally, resulting in denial of service. The issue stems from insufficient validation of sort specifications during execution. | |||||
| CVE-2026-13066 | 1 Mongodb | 1 Mongodb | 2026-08-05 | N/A | 6.5 MEDIUM |
| Improper handling of DBPointer objects during BSON serialization in MongoDB's server-side JavaScript engine can result in internal process memory contents being included in data returned to the client. This constitutes an unintended information disclosure affecting deployments that use server-side JavaScript. | |||||
| CVE-2026-13067 | 1 Mongodb | 1 Mongodb | 2026-08-05 | N/A | 6.3 MEDIUM |
| When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local access to the proxy Unix domain socket and a valid X.509 certificate issued by a trusted certificate authority. | |||||
| CVE-2026-14519 | 1 Ibm | 1 App Connect Enterprise | 2026-08-05 | N/A | 7.5 HIGH |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to read arbitrary files due to a path traversal vulnerability. | |||||
| CVE-2026-14522 | 1 Ibm | 1 App Connect Enterprise | 2026-08-05 | N/A | 8.8 HIGH |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to execute arbitrary commands due to improper neutralization of CRLF characters. | |||||
| CVE-2026-56570 | 1 Hcltech | 1 Icontrol | 2026-08-05 | N/A | 3.7 LOW |
| HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser suggestions. | |||||
| CVE-2026-15435 | 1 Ibm | 1 App Connect Enterprise | 2026-08-05 | N/A | 9.8 CRITICAL |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. | |||||
| CVE-2026-56569 | 1 Hcltech | 1 Icontrol | 2026-08-05 | N/A | 4.0 MEDIUM |
| HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening. | |||||
| CVE-2026-39875 | 1 Apple | 1 Macos | 2026-08-05 | N/A | 7.8 HIGH |
| A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges. | |||||
| CVE-2026-10842 | 1 Ibm | 1 Websphere Application Server | 2026-08-05 | N/A | 7.5 HIGH |
| IBM WebSphere Application Server 8.5, and 9.0 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 Traditional and Liberty could allow a remote attacker to bypass security constraints. | |||||
| CVE-2026-13068 | 1 Mongodb | 1 Mongodb | 2026-08-05 | N/A | 4.2 MEDIUM |
| An authenticated user holding cursor termination privileges on one database may incorrectly be permitted to terminate active cursors on a separate database, disrupting ongoing query operations for other users. The behavior stems from an authorization check that does not correctly scope privileges to the appropriate namespace. | |||||