Search
Search Results (327847 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-21287 | 3 Adobe, Apple, Microsoft | 3 Substance 3d Stager, Macos, Windows | 2026-01-15 | 7.8 High |
| Substance3D - Stager versions 3.1.5 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-23582 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23581 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23580 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23579 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23578 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23577 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23576 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23575 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2026-23574 | 2026-01-15 | N/A | ||
| Not used | ||||
| CVE-2025-48371 | 1 Openfga | 2 Helm Charts, Openfga | 2026-01-15 | 8.8 High |
| OpenFGA is an authorization/permission engine. OpenFGA versions 1.8.0 through 1.8.12 (corresponding to Helm chart openfga-0.2.16 through openfga-0.2.30 and docker 1.8.0 through 1.8.12) are vulnerable to authorization bypass when certain Check and ListObject calls are executed. Users are affected under four specific conditions: First, calling Check API or ListObjects with an authorization model that has a relationship directly assignable by both type bound public access and userset; second, there are check or list object queries with contextual tuples for the relationship that can be directly assignable by both type bound public access and userset; third, those contextual tuples’s user field is an userset; and finally, type bound public access tuples are not assigned to the relationship. Users should upgrade to version 1.8.13 to receive a patch. The upgrade is backwards compatible. | ||||
| CVE-2025-66877 | 1 Libming | 1 Libming | 2026-01-15 | 7.5 High |
| Buffer overflow vulnerability in function dcputchar in decompile.c in libming 0.4.8. | ||||
| CVE-2025-66869 | 1 Libming | 1 Libming | 2026-01-15 | 7.5 High |
| Buffer overflow vulnerability in function strcat in asan_interceptors.cpp in libming 0.4.8. | ||||
| CVE-2025-58318 | 1 Delta Electronics | 1 Diaview | 2026-01-15 | N/A |
| Delta Electronics DIAView has an authentication bypass vulnerability. | ||||
| CVE-2025-60935 | 1 Returnfi | 1 Blitz | 2026-01-15 | 6.5 Medium |
| An open redirect vulnerability in the login endpoint of Blitz Panel v1.17.0 allows attackers to redirect users to malicious domains via a crafted URL. This issue affects the next_url parameter in the login endpoint and could lead to phishing or token theft after successful authentication. | ||||
| CVE-2025-68706 | 1 Kuwfi | 3 Ac900, Ac900 Firmware, Ac900 Router | 2026-01-15 | 9.8 Critical |
| A stack-based buffer overflow exists in the GoAhead-Webs HTTP daemon on KuWFi 4G LTE AC900 devices with firmware 1.0.13. The /goform/formMultiApnSetting handler uses sprintf() to copy the user-supplied pincode parameter into a fixed 132-byte stack buffer with no bounds checks. This allows an attacker to corrupt adjacent stack memory, crash the web server, and (under certain conditions) may enable arbitrary code execution. | ||||
| CVE-2025-8679 | 2 Extreme Networks, Extremenetworks | 2 Extremeguest Essentials, Extremeguest Essentials | 2026-01-15 | 9.8 Critical |
| In ExtremeGuest Essentials before 25.5.0, captive-portal may permit unauthorized access via manual brute-force procedure. Under certain ExtremeGuest Essentials captive-portal SSID configurations, repeated manual login attempts may allow an unauthenticated device to be marked as authenticated and obtain network access. Client360 logs may display the client MAC as the username despite no MAC-authentication being enabled. | ||||
| CVE-2025-67255 | 1 Nagios | 2 Nagios Xi, Xi | 2026-01-15 | 8.8 High |
| In NagiosXI 2026R1.0.1 build 1762361101, Dashboard parameters lack proper filtering, allowing any authenticated user to exploit a SQL Injection vulnerability. | ||||
| CVE-2025-67254 | 1 Nagios | 2 Nagios Xi, Xi | 2026-01-15 | 7.5 High |
| NagiosXI 2026R1.0.1 build 1762361101 is vulnerable to Directory Traversal in /admin/coreconfigsnapshots.php. | ||||
| CVE-2025-11192 | 2 Extreme Networks, Extremenetworks | 2 Fabric Engine, Fabric Engine \(voss\) | 2026-01-15 | 8.6 High |
| A vulnerability in Extreme Networks’ Fabric Engine (VOSS) before 9.3 was discovered. When SD-WAN AutoSense is enabled on a port, it may automatically configure fabric connectivity without validating ISIS authentication settings. The SD-WAN AutoSense implementation may be exploited by malicious actors by allowing unauthorized access to network fabric and configuration data. | ||||