Tagged “cve.org”
CVEs tagged cve.org, newest first.
48134 CVEsRSS
CVE-2026-43834High· 7.5A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code execution.
CVE-2026-43835High· 8.6A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentially compromising the device permanently.
CVE-2026-11959Medium· 6.9Multiple vulnerabilities in FacturaScripts
Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or sanitisation of user input in the ‘city’ and ‘province’ fields in the ‘ListAlmacen’ endpoint. Successful exploitation of thi…
CVE-2026-43837High· 7.5A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code execution.
CVE-2026-43836Critical· 9.3A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
CVE-2026-113465Medium· 6.6Possible DOM XSS in SNS Web Administration Portal
It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel. To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a spec…
CVE-2026-11960Medium· 6.9Multiple vulnerabilities in FacturaScripts
Enumeration of unauthenticated users in FacturaScripts, version 2025.61. The application returns different responses when attempting to log in with a valid username compared to an invalid one. An unauthenticated attacker could systematic…
CVE-2026-101201Medium· 5.5qt5-qtbase: qt6-qt5compat: qt: Denial of Service via out-of-bounds read in QBinaryJson (CVE-2026-101201)
A flaw was found in Qt. An out-of-bounds read vulnerability can occur when parsing a binary file with a malformed header in the QBinaryJson::fromBinaryData() function. An attacker could exploit this flaw by convincing a user or application…
CVE-2026-43854Medium· 6.3A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
CVE-2026-43840Medium· 6.9A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the on_disconnected callback function.
CVE-2026-43838Critical· 9.2A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
CVE-2026-43841Medium· 6.9A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function.
CVE-2026-43839High· 8.7A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
CVE-2026-113469High· 7.5Improper Signature Verification of Active Update Files
A failure has been identified in the SNS during dynamic data files signature check. A logic error in the signature verification routine resulting in acceptance of unauthenticated dynamic data update during Autoupdate routine.
CVE-2026-43845Critical· 9.2A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
CVE-2026-43842Medium· 6.9A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.
A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the rpc_rx_fsm function when msglen is set to 0.
CVE-2026-43846High· 8.6A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
CVE-2026-43844Critical· 9.3A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
CVE-2026-43843Medium· 6.9An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.
CVE-2026-43851High· 8.2A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
CVE-2026-43849Medium· 6.9A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
A heap memory read vulnerability could allow an attacker to exfiltrate sensitive data.
CVE-2026-43848Medium· 6.9A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.
CVE-2026-43847High· 8.2A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even when the SafeEnhancement feature is enabled.
CVE-2026-43853High· 8.2A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
CVE-2026-43852High· 8.2A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
CVE-2026-43850High· 8.6A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
CVE-2026-43856High· 8.6A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
CVE-2026-112069Medium· 6.3Broken Access Control in extension "FAL Protect" (fal_protect)
The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is o…
CVE-2026-85267High· 8.7Cross-Site WebSocket Hijacking in Google Cloud Shell
A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an unauthenticated attacker to hijack an active Cloud Shell session and exfiltrate the user's OAuth access token using a cr…
CVE-2026-43857High· 8.6A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.