Vulnerabilidades CVE

A continuación la lista de las últimas vulnerabilidades publicadas por el instituto NIST:

Borrar filtros
CVE ID Publicado Severidad CVSS Descripción
CVE-2026-66403 2026-08-10 HIGH 7.5 DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be…
CVE-2026-64940 2026-08-10 HIGH 8.6 Tegalog -Fumy Otegaru Memo Logger- provided by Nishishi Factory contains a vulnerability due to a permissive regular expression, which may allow an attacker who can access the affected…
CVE-2026-59112 2026-08-10 N/A 0.0 Improper verification of cryptographic signature and Improper Check for Unusual or Exceptional Conditions vulnerability in Estonian Information System Authority (RIA) libdigidocpp, DigiDoc4, DigiDoc on Android, and DigiDoc on…
CVE-2026-59233 2026-08-10 N/A 0.0 Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set…
CVE-2026-57279 2026-08-10 MEDIUM 6.8 Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to…
CVE-2026-44630 2026-08-10 N/A 0.0 Improper validation of length fields in the Apache IoTDB RPC service may allow a remote unauthenticated attacker to cause a denial of service. By sending a crafted malformed…
CVE-2026-21084 2026-08-10 N/A 0.0 Improper access control in SmartThings prior to version 1.8.47.24 allows local attackers to access sensitive information.
CVE-2026-21083 2026-08-10 N/A 0.0 Improper input validation in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
CVE-2026-21082 2026-08-10 N/A 0.0 Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21081 2026-08-10 N/A 0.0 Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows local attackers to access sensitive information. User interaction is required for triggering this vulnerability.
CVE-2026-21080 2026-08-10 N/A 0.0 Cleartext storage of sensitive information in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to access sensitive data.
CVE-2026-21079 2026-08-10 N/A 0.0 Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data.
CVE-2026-21078 2026-08-10 N/A 0.0 Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity.
CVE-2026-21077 2026-08-10 N/A 0.0 Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21076 2026-08-10 N/A 0.0 Incorrect authorization in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information.
CVE-2026-21075 2026-08-10 N/A 0.0 Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3 allows remote attackers to access sensitive information.
CVE-2026-21073 2026-08-10 N/A 0.0 Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch arbitrary activity.
CVE-2026-19433 2026-08-10 N/A 0.0 Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact…
CVE-2026-21072 2026-08-10 N/A 0.0 Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21071 2026-08-10 N/A 0.0 Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21070 2026-08-10 N/A 0.0 Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to access sensitive information.
CVE-2026-21069 2026-08-10 N/A 0.0 Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of-bounds memory.
CVE-2026-21058 2026-08-10 N/A 0.0 Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete file with Samsung Contacts' privilege.
CVE-2026-18503 2026-08-10 N/A 0.0 Attacker-controlled CSV samples can trigger super-linear regular-expression work during dialect sniffing and consume significant CPU when applications pass unbounded input to csv.Sniffer.sniff().
CVE-2026-19278 2026-08-10 MEDIUM 6.8 A flaw was found in StackRox/RHACS Central's Auth Machine-to-Machine (M2M) token exchange. When an administrator configures M2M role mappings, the system uses unanchored regular expressions for matching claim…
CVE-2026-19389 2026-08-10 HIGH 7.1 Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer (asfdemux) when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation…
CVE-2026-19381 2026-08-10 HIGH 7.8 A security flaw has been discovered in Kingston FURY CTRL RGB Control Software 2.0.65.0. The impacted element is an unknown function in the library NTIOLib_KSFX.sys of the component…
CVE-2026-19375 2026-08-10 MEDIUM 6.3 A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetch_article of the file news_scraper_mcp/server.py. The manipulation of the argument url results in server-side request…
CVE-2026-19370 2026-08-09 MEDIUM 5.3 A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes…
CVE-2026-19365 2026-08-09 MEDIUM 5.3 A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscale_images. Such manipulation of the argument…
CVE-2026-18478 2026-08-10 N/A 0.0 Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will…
CVE-2026-15060 2026-08-10 MEDIUM 4.7 When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged user logged in a desktop…
CVE-2026-18370 2026-08-10 N/A 0.0 entr is vulnerable to Heap-based buffer overflow in run_utility() function. The function allocates a fixed-size heap buffer using malloc(ARG_MAX) and copies command-line arguments into it. It advances the…
CVE-2026-15059 2026-08-10 MEDIUM 5.5 Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation.
CVE-2026-10754 2026-08-10 N/A 0.0 Pega Platform versions 8.5.0 through 25.1.2 are affected by an improper validation of cryptographic signatures that may allow an attacker to bypass security controls.
CVE-2026-13206 2026-08-10 CRITICAL 9.8 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Zyxel Networks WAH7601 allows OS Command Injection. This issue affects WAH7601: through 20072026.
CVE-2026-12984 2026-08-10 HIGH 8.2 Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601: through 20072026.
CVE-2026-13133 2026-08-10 N/A 0.0 A vulnerability has been identified in LineInst.exe (LINE for Windows) prior to version 26.4.0, where Msftedit.dll is loaded via a relative path without a secure DLL search path,…
CVE-2026-12570 2026-08-10 MEDIUM 5.5 A vulnerability in keras-team/keras versions
CVE-2026-72761 2026-08-10 N/A 0.0 The webhook URL validator in `website/notifications/webhooks.py` uses `ip.is_global` to reject non-public addresses after DNS resolution. IPv6 transition addresses (NAT64 `64:ff9b::/96`, 6to4 `2002::/16`, Teredo `2001:0000::/32`) are classified as globally…
CVE-2026-72731 2026-08-10 HIGH 7.1 Discourse is an open-source discussion platform. From 2026.1.0-latest until 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, anyone able to run a parameterized Data Explorer query, including non-staff members of a…
CVE-2026-72760 2026-08-10 N/A 0.0 Affected versions of MISP cti-transmute disclose users' email addresses through the account following-list endpoint. When an authenticated user follows another account, get_following() includes the followed user's email field…
CVE-2026-72759 2026-08-10 N/A 0.0 In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record references a deleted conversion, the associated conversion lookup returns…
CVE-2026-72727 2026-08-10 N/A 0.0 Discourse is an open-source discussion platform. Prior to 026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, a low-privileged user could place crafted content in the moderation review queue that executed stored…
CVE-2026-71576 2026-08-10 HIGH 8.5 A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed…
CVE-2026-72726 2026-08-10 MEDIUM 6.5 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, an authenticated user could eavesdrop on private AI bot conversations through the AI bot reply…
CVE-2026-72721 2026-08-10 MEDIUM 5.3 Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Onebox::DomainChecker.is_blocked? compares hostnames and SiteSetting.blocked_onebox_domains entries case-sensitively, allowing an attacker to bypass configured Onebox domain…
CVE-2026-72718 2026-08-10 N/A 0.0 goose is general-purpose AI agent that runs on your machine. Prior to 1.44.0, the `goose review` command runs the system `git` executable to gather the diff for review…
CVE-2026-56619 2026-08-10 MEDIUM 5.4 HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
CVE-2026-66738 2026-08-10 HIGH 8.8 SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user input, which bypasses input sanitization and allows the value…
« Anterior Página 71 de 4841 Siguiente »