Total
397465 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-50773 | 2026-08-31 | N/A | 7.8 HIGH | ||
| An issue in CGM Germany - CompuGroup Medical CGM ISIS MED 2510.1.0.20 allows a remote attacker to execute arbtirary code via a crafted .dll file. | |||||
| CVE-2026-52607 | 2026-08-31 | N/A | 6.5 MEDIUM | ||
| A directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the target_format parameter in conjunction with the execute_mode=EXECUTE parameter of the run.php endpoint. | |||||
| CVE-2026-36851 | 2026-08-31 | N/A | 7.5 HIGH | ||
| Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration. | |||||
| CVE-2026-42162 | 2026-08-31 | N/A | 9.1 CRITICAL | ||
| Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated. | |||||
| CVE-2026-42164 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| Mahara before 25.04.5 and 26.04.0 is vulnerable in the Text block/section functionality when a call is crafted in a certain way that allows it to recall the backed-up content from another Text section. | |||||
| CVE-2026-79718 | 2026-08-31 | N/A | N/A | ||
| Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution. | |||||
| CVE-2026-79719 | 2026-08-31 | N/A | N/A | ||
| Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution. | |||||
| CVE-2026-12259 | 2026-08-31 | N/A | 5.3 MEDIUM | ||
| In nltk version 3.9.4, the `nltk.downloader.Downloader._download_package()` function writes downloaded package bytes to disk and may extract them before enforcing SHA-256 or MD5 checksum validation. This allows an attacker to tamper with the package response body for `info.url` through a compromised mirror, malicious proxy, or other source-substitution condition, leading to the installation of attacker-controlled package bytes. The vulnerability can result in malicious corpus or model content being trusted by downstream users or applications. | |||||
| CVE-2026-70435 | 2026-08-31 | N/A | 4.2 MEDIUM | ||
| A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2026-70433 | 2026-08-31 | N/A | 4.3 MEDIUM | ||
| Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-70444 | 2026-08-31 | N/A | 4.3 MEDIUM | ||
| A missing permission check in Jenkins Violation Comments to GitLab Plugin 2.62.0 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-70434 | 2026-08-31 | N/A | 4.2 MEDIUM | ||
| A cross-site request forgery (CSRF) vulnerability in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins. | |||||
| CVE-2026-70437 | 2026-08-31 | N/A | 3.7 LOW | ||
| Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bearer token. | |||||
| CVE-2026-70438 | 2026-08-31 | N/A | 4.3 MEDIUM | ||
| A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||
| CVE-2026-70443 | 2026-08-31 | N/A | 4.3 MEDIUM | ||
| Jenkins Horreum Plugin 0.16.162.v33b_4a_a_b_5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL. | |||||
| CVE-2026-70436 | 2026-08-31 | N/A | 4.3 MEDIUM | ||
| Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1.4.1) when providing access to externally-managed workspaces through the workspace browser, allowing attackers with Overall/Read permission to read files in workspaces they are not authorized to access. | |||||
| CVE-2026-70439 | 2026-08-31 | N/A | 6.5 MEDIUM | ||
| Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conversion functionality. | |||||
| CVE-2026-70441 | 2026-08-31 | N/A | 5.4 MEDIUM | ||
| Jenkins Summary Display Plugin 1.15 and earlier does not escape the job name in a JavaScript context in build report pages, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Create or Item/Configure permission. | |||||
| CVE-2026-70440 | 2026-08-31 | N/A | 5.4 MEDIUM | ||
| Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. | |||||
| CVE-2026-70445 | 2026-08-31 | N/A | 4.3 MEDIUM | ||
| Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. | |||||