Export limit exceeded: 410046 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (3735 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-1118 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-06-29 | 4.4 Medium |
| A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory. | ||||
| CVE-2026-57527 | 1 Zaproxy | 1 Zap-extensions | 2026-06-29 | 8.8 High |
| Zed Attack Proxy (ZAP) ViewState add-on before version 4 contains an insecure deserialization vulnerability that allows attackers who control a proxied web server to achieve arbitrary code execution by embedding a malicious serialized Java object in the javax.faces.ViewState HTTP response parameter. The JSFViewState.decode() method base64-decodes the ViewState value and passes it directly to ObjectInputStream.readObject() without a deserialization filter, allowlist, or type restriction, causing the malicious object to be deserialized within the ZAP JVM when the Desktop UI renders the ViewState panel. | ||||
| CVE-2026-56057 | 2 Uncannyowl, Wordpress | 2 Uncanny Automator, Wordpress | 2026-06-29 | 9.8 Critical |
| Subscriber PHP Object Injection in Uncanny Automator Pro <= 7.3.0.6 versions. | ||||
| CVE-2026-46386 | 1 Opf | 1 Openproject | 2026-06-29 | 9.9 Critical |
| OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERWRITE_ME as the default Rails master key. Combined with cookies_serializer = :marshal, this gives any logged-in user a deterministic Marshal-deserialization path reachable via the /my/two_factor_devices cookie reader This vulnerability is fixed in . | ||||
| CVE-2026-56031 | 2 Uncannyowl, Wordpress | 2 Uncanny Automator, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Uncanny Automator <= 7.3.1.2 versions. | ||||
| CVE-2026-56055 | 2 Inspirythemes, Wordpress | 2 Realhomes, Wordpress | 2026-06-26 | 8.8 High |
| Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions. | ||||
| CVE-2026-56032 | 2 Buddyboss, Wordpress | 2 Buddyboss Platform, Wordpress | 2026-06-26 | 9.8 Critical |
| Subscriber PHP Object Injection in Buddyboss Platform <= 3.0.4 versions. | ||||
| CVE-2026-53914 | 1 Jetbrains | 1 Kotlin | 2026-06-26 | 6.7 Medium |
| In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata | ||||
| CVE-2025-71340 | 2 Mmaitre314, Picklescan | 2 Picklescan, Picklescan | 2026-06-26 | 8.1 High |
| picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can embed undetected code in pickle files that executes arbitrary commands when the file is loaded via pickle.load(), enabling supply chain attacks on PyTorch models and saved Python objects. This is fixed in version 0.0.30. | ||||
| CVE-2026-39006 | 1 Agentpp | 1 Snmp4j-agent | 2026-06-26 | 9.8 Critical |
| An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component. | ||||
| CVE-2026-39478 | 2 Eli Scheetz, Wordpress | 2 Anti-malware Security And Brute-force Firewall, Wordpress | 2026-06-26 | 8.8 High |
| Contributor PHP Object Injection in Anti-Malware Security and Brute-Force Firewall <= 4.23.87 versions. | ||||
| CVE-2026-39554 | 2 Elated-themes, Wordpress | 2 Fidalgo, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions. | ||||
| CVE-2026-39567 | 2 Select-themes, Wordpress | 2 Santé, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions. | ||||
| CVE-2026-39577 | 2 Elated-themes, Wordpress | 2 Playroom, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions. | ||||
| CVE-2026-39578 | 2 Elated-themes, Wordpress | 2 Valiance, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Valiance <= 1.2 versions. | ||||
| CVE-2026-39580 | 2 Select-themes, Wordpress | 2 Micdrop, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions. | ||||
| CVE-2026-40751 | 2 Mikado-themes, Wordpress | 2 Ashtanga, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Ashtanga <= 1.2 versions. | ||||
| CVE-2026-40755 | 2 Mikado-themes, Wordpress | 2 Techlink, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in TechLink <= 1.3 versions. | ||||
| CVE-2026-40758 | 2 Elated-themes, Wordpress | 2 Léonie, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions. | ||||
| CVE-2026-40759 | 2 Mikado-themes, Wordpress | 2 Esmée, Wordpress | 2026-06-26 | 8.1 High |
| Unauthenticated PHP Object Injection in Esmée <= 1.4 versions. | ||||