Export limit exceeded: 421002 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421002 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421002 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-64816 | 1 Cybertimon | 1 Rapidraw | 2026-08-02 | 6.5 Medium |
| RapidRAW before 1.6.0 does not validate the lutPath field in preset files before passing it to File::open() in lut_processing.rs. On Windows, a UNC path in lutPath causes an outbound SMB connection to an attacker-controlled host, leaking the victim's NTLMv2 credentials. The vulnerable code path is reachable through two vectors: community presets fetched automatically from the remote preset repository when the victim opens the Community tab, and individual preset files imported directly by the victim via the preset import feature (handle_import_presets_from_file in file_management.rs). The second vector does not require control of the community preset repository and is triggered when a user imports a preset file shared through Discord, forums, or similar channels. | ||||
| CVE-2026-18064 | 1 Nasa | 1 Core Flight System (cfs) Health & Safety (hs) Application | 2026-08-02 | 7.5 High |
| An incomplete fix for CVE-2026-15352 in the NASA core Flight System (cFS) Health and Safety (HS) application leaves a separate NULL pointer dereference reachable in versions through 7.0.1. An attacker who can trigger the affected command under specific conditions could cause the HS application to crash, resulting in a denial-of-service condition and processor reset. | ||||
| CVE-2026-63559 | 1 O6 Automation | 1 Open62541 | 2026-08-02 | 7.5 High |
| An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to read out-of-bounds heap memory, potentially disclosing sensitive information. | ||||
| CVE-2026-63035 | 1 O6 Automation | 1 Open62541 | 2026-08-02 | 8.1 High |
| A heap use-after-free vulnerability in the TransferSubscriptions service in open62541 may allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code. | ||||
| CVE-2026-65423 | 1 O6 Automation | 1 Open62541 | 2026-08-02 | 8.8 High |
| An integer overflow in the UA_Variant arrayDimensions product computation in open62541 may allow a remote attacker to trigger an out-of-bounds write. | ||||
| CVE-2026-14537 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 9.8 Critical |
| Incorrect Authorization in the direct HTTP API tool invocation endpoint in Google mcp-toolbox versions v1.3.0 and v1.4.0 allows an unauthenticated attacker to invoke tools protected by the scopeRequired feature via sending tool invocation requests through legacy HTTP endpoints when the --enable-api flag is active. | ||||
| CVE-2026-14538 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 7.7 High |
| An improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component of Google mcp-toolbox versions 0.16.1 through 1.4.0 allows an authenticated attacker to bypass allowedDatasets validation checks. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. This allows the attacker to extract structural DDL schemas for explicitly excluded datasets via INFORMATION_SCHEMA, and access downstream federated row data via EXTERNAL_QUERY connections. | ||||
| CVE-2026-14539 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 7.5 High |
| An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error. | ||||
| CVE-2026-14540 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 6.1 Medium |
| A Server-Side Request Forgery (SSRF) vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client (internal/sources/http/http.go) fails to safely regulate request redirection boundaries. Specifically, the client is initialized without a restrictive CheckRedirect policy hook and lacks target IP validation. An attacker or a malicious data-driven prompt can supply a crafted path parameter that triggers an open redirect or a direct destination swap on the target backend, coercing the mcp-toolbox into blindly following the redirection and making unauthorized requests to internal or arbitrary external endpoints. | ||||
| CVE-2026-14541 | 1 Google | 2 Mcp-toolbox, Mcp Toolbox For Databases | 2026-08-02 | 7.5 High |
| An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for opaque tokens skips audience validation entirely. As a result, the toolbox will accept any valid Google OAuth access token—even those minted for unrelated ecosystem applications—granting unauthorized clients access to protected tools and data backends. | ||||
| CVE-2026-6889 | 1 Advantech | 1 Ecu-1251d | 2026-08-02 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-6890 | 1 Advantech | 1 Ecu-1251d08.04 | 2026-08-02 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | ||||
| CVE-2026-18452 | 1 Rich Source | 1 Dms+ (non-mobile) | 2026-08-02 | 10 Critical |
| DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices. | ||||
| CVE-2026-65309 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 7.5 High |
| ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords. | ||||
| CVE-2026-65310 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 7.5 High |
| ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration. | ||||
| CVE-2026-65311 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 5.3 Medium |
| The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system. | ||||
| CVE-2026-65313 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 8.1 High |
| A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations. | ||||
| CVE-2026-18437 | 2 Mailerpress, Wordpress | 2 Mailerpress – Newsletter, Email Marketing & Ai Automation, Wordpress | 2026-08-02 | 5.3 Medium |
| The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the `mailerpress/v1/contact` endpoint in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to update contact details. | ||||
| CVE-2026-18436 | 2 Mailerpress, Wordpress | 2 Mailerpress – Newsletter, Email Marketing & Ai Automation, Wordpress | 2026-08-02 | 5.3 Medium |
| The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint (POST /wp-json/mailpress/v1/campaign/<id>/restore-revision/<revision_id>). The route in the vulnerable range was registered without a permissionCallback, allowing the restoreRevision() handler to run for unauthenticated requests and overwrite a campaign's content_html with any prior revision. This makes it possible for unauthenticated attackers to modify campaign content by restoring an arbitrary revision. | ||||
| CVE-2026-56567 | 1 Hcltech | 1 Icontrol | 2026-08-02 | 5.1 Medium |
| HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening. | ||||