Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2026-71968 2026-08-10 MEDIUM 6.7 OP-TEE OS through 4.10.0, fixed in commit 8794043, contains a use-after-free vulnerability in the Trusted Application loader that allows attackers with the ability to load a signed Trusted…
CVE-2026-72575 2026-08-10 CRITICAL 9.1 An improper authorization vulnerability in daptin through v0.12.34 allows unauthenticated remote attackers to read, create, update, and delete usergroup records. The permission check functions (CanRead, CanPeek, CanCreate, CanUpdate,…
CVE-2026-72574 2026-08-10 MEDIUM 6.1 A host header injection vulnerability in picocms/Pico through 2.1.4 allows an unauthenticated remote attacker to control the origin of JavaScript and CSS assets loaded by the default theme.…
CVE-2026-72573 2026-08-10 HIGH 8.8 An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188…
CVE-2026-72572 2026-08-10 HIGH 7.5 A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338…
CVE-2026-71962 2026-08-10 HIGH 7.5 Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion…
CVE-2026-6791 2026-08-10 N/A 0.0 When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory. The implementation…
CVE-2026-6368 2026-08-10 N/A 0.0 Calling wordexp with WRDE_APPEND in the GNU C Library version 2.0 to version 2.43 can cause the interface to return invalid memory in the we_wordv member, which on subsequent…
CVE-2026-68871 2026-08-10 N/A 0.0 The Yandex Lockbox secrets backend in Apache Airflow's Yandex provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed. In a…
CVE-2026-68870 2026-08-10 N/A 0.0 The Azure Key Vault secrets backend in Apache Airflow's Microsoft Azure provider resolved a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed.…
CVE-2026-63105 2026-08-10 MEDIUM 5.4 ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by…
CVE-2026-47754 2026-08-10 CRITICAL 9.3 Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the…
CVE-2026-72862 2026-08-10 CRITICAL 9.9 Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the mariadb.ts, mongo.ts, mysql.ts, postgres.ts, redis.ts, and libsql.ts Dokploy database service deployment functions pass user-controlled…
CVE-2026-72737 2026-08-10 CRITICAL 9.6 Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/dokploy/server/api/routers/backup.ts accept a client-controlled destinationId and use the referenced…
CVE-2026-72736 2026-08-10 CRITICAL 9.9 Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy passes user-controlled values directly into shell commands via unquoted template literal interpolation in the…
CVE-2026-72751 2026-08-10 N/A 0.0 CTI-Transmute is affected by a stored cross-site scripting (XSS) vulnerability in the conversion graph used to visualise converted MISP and STIX content. Attacker-controlled values originating from converted CTI…
CVE-2026-72732 2026-08-10 MEDIUM 4.3 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names because DiscourseTemplates::TemplatesSerializer in plugins/discourse-templates/app/serializers/discourse_templates/templates_serializer.rb did not filter tags…
CVE-2026-72571 2026-08-10 HIGH 7.5 A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticated remote attacker to read arbitrary files from the server. The app.js handler at lines 151-153 passes the…
CVE-2026-72570 2026-08-10 MEDIUM 5.4 A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted…
CVE-2026-71394 2026-08-10 N/A 0.0 GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c. Due to an incorrect comparison variable in the read-length check, a crafted font file…
CVE-2026-71393 2026-08-10 N/A 0.0 GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c. The function computes an allocation size using a 32-bit length value from a TrueType…
CVE-2026-6374 2026-08-10 HIGH 7.3 Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601: through 20.07.2026.
CVE-2026-6373 2026-08-10 MEDIUM 6.5 Exposure of sensitive system information to an unauthorized control sphere vulnerability in Zyxel Networks WAH7601 allows Web Application Fingerprinting. This issue affects WAH7601: through 20072026.
CVE-2026-71392 2026-08-10 N/A 0.0 GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/sfnt.c. When processing a crafted TrueType font file, an unguarded addition in the…
CVE-2026-71391 2026-08-10 N/A 0.0 GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c. The shared-coordinate index boundary check in sfnt_vary_simple_glyph() and sfnt_vary_compound_glyph() uses a strict greater-than…
CVE-2026-66409 2026-08-10 MEDIUM 5.3 DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the…
CVE-2026-66408 2026-08-10 MEDIUM 4.6 The root accounts of DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords. Physical access to an affected product may allow to obtain the password…
CVE-2026-66407 2026-08-10 HIGH 8.1 DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle…
CVE-2026-66406 2026-08-10 MEDIUM 4.8 DEEBOT PRO M1 and DEEBOT PRO K1VAC use wget command with server certificate validation disabled. A man-in-the-middle attack may allow to obtain and/or alter communications of the affected…
CVE-2026-66405 2026-08-10 HIGH 8.8 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the telnet servers enabled. The telnet service may be leveraged to log in to the affected products.
CVE-2026-66404 2026-08-10 MEDIUM 6.5 DEEBOT PRO M1 and DEEBOT PRO K1VAC do not validate server certificates in MQTT communications. Operation logs and activity logs stored on the affected products may be retrieved.
CVE-2026-66403 2026-08-10 HIGH 7.5 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be…
CVE-2026-64940 2026-08-10 HIGH 8.6 Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected…
CVE-2026-59112 2026-08-10 N/A 0.0 Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on…
CVE-2026-59233 2026-08-10 N/A 0.0 Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set…
CVE-2026-57279 2026-08-10 MEDIUM 6.8 Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to…
CVE-2026-44630 2026-08-10 N/A 0.0 Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed…
CVE-2026-21084 2026-08-10 N/A 0.0 Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.
CVE-2026-21083 2026-08-10 N/A 0.0 Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
CVE-2026-21082 2026-08-10 N/A 0.0 Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21081 2026-08-10 N/A 0.0 Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
CVE-2026-21080 2026-08-10 N/A 0.0 Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
CVE-2026-21079 2026-08-10 N/A 0.0 Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
CVE-2026-21078 2026-08-10 N/A 0.0 Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.
CVE-2026-21077 2026-08-10 N/A 0.0 Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21076 2026-08-10 N/A 0.0 Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21075 2026-08-10 N/A 0.0 Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
CVE-2026-21073 2026-08-10 N/A 0.0 Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
CVE-2026-19433 2026-08-10 N/A 0.0 Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact…
CVE-2026-21072 2026-08-10 N/A 0.0 Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
« Anterior Página 70 de 4841 Siguiente »