Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

2.228 resultado(s)

Exportar esta busca: RSS · CSV · STIX

CVE-2026-34685 Baixa · 3.4 CWE-20 12/05/2026

Adobe Commerce | Improper Input Validation (CWE-20)

Adobe Commerce versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.

CVE-2026-34679 Média · 6.2 CWE-20 12/05/2026

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-34670 Média · 6.2 CWE-20 12/05/2026

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-34669 Média · 6.2 CWE-20 12/05/2026

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-34668 Média · 6.2 CWE-20 12/05/2026

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-34666 Média · 6.2 CWE-20 12/05/2026

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials versions c2pa-web@0.7.0, c2pa-v0.78.2 and earlier are affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue does not require user interaction.

CVE-2026-23825 Alta · 7.5 CWE-20 12/05/2026

Unauthenticated Denial-of-Service via Crafted Messages in a Network Protocol Handling Component

Vulnerabilities exist in a protocol-handling component of AOS-8 and AOS-10 Operating Systems. An unauthenticated attacker could exploit these vulnerabilities by sending specially crafted network messages to the affected service. Due to insufficient input validation, successful exploitation may terminate a critical system process, resulting in a denial-of-service condition.

CVE-2026-44343 Crítica · 9.8 Exploit público CWE-20 12/05/2026

WGDashboard: Acesso Crítico e não Autenticado ao Sistema de Arquivos do Host

WGDashboard é um painel para VPN WireGuard. Antes da versão 4.3.2, existem vulnerabilidades críticas que afetam o WGDashboard e que, se exploradas, poderiam permitir que partes não autorizadas acessem o sistema de arquivos do host sem autenticação. Esta vulnerabilidade é corrigida na versão 4.3.2.

CVE-2026-44204 Média · 6.5 CWE-20 12/05/2026

Shelf: SQL Injection via sortBy Parameter

Shelf is a platform for tracking physical assets. From 1.12 to before 1.20.1, a SQL injection vulnerability in the sortBy query parameter on the /assets route allows any authenticated user (any role) to execute arbitrary SQL and read data from any table in the database, including data belonging to other organizations. This vulnerability is fixed in 1.20.1.

CVE-2026-35433 Alta · 7.3 CWE-20 12/05/2026

.NET Elevation of Privilege Vulnerability

Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.

CVE-2026-32177 Alta · 7.3 CWE-20 12/05/2026

.NET Elevation of Privilege Vulnerability

Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally.

CVE-2026-20767 Alta · 7.8 CWE-20 12/05/2026

Improper Input Validation em Intel Quickassist Technology

Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2026-43989 Alta · 8.5 CWE-20 12/05/2026

JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm MCP tool accepted a filesystem path from the agent and uploaded whatever bytes the path resolved to, with no validation of location, symlink target, file size, or file format. This vulnerability is fixed in 0.x.y-security-1.

CVE-2026-20905 Média · 6.6 CWE-20 12/05/2026

Improper Input Validation em Intel Quickassist Technology

Improper input validation for some Intel(R) QAT software drivers for Windows before version 2.6 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2026-20717 Média · 6.6 CWE-20 12/05/2026

Improper Input Validation em Intel Quickassist Technology

Improper input validation for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2025-35990 Alta · 8.8 CWE-20 12/05/2026

Improper input validation for some Intel Endpoint Management Assistant (EMA) software before...

Improper input validation for some Intel Endpoint Management Assistant (EMA) software before version 1.14.5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.

CVE-2026-41293 Crítica · 9.8 CWE-20 12/05/2026

Apache Tomcat: cabeçalhos de requisições HTTP/2 sem validação (CVE-2026-41293)

Vulnerabilidade de Validação de Entrada Imprópria no Apache Tomcat. Este problema afeta o Apache Tomcat: da 11.0.0-M1 até a 11.0.21, da 10.1.0-M1 até a 10.1.54, da 9.0.0.M1 até a 9.0.117, da 10.0.0-M1 até a 10.0.27. Versões antigas, fora do suporte, também podem ser afetadas. Recomenda-se que os usuários atualizem para a versão [FIXED_VERSION], que corrige o problema.

CVE-2026-8391 Média · 5.3 CWE-20 12/05/2026

Other issue in the JavaScript Engine component

Other issue in the JavaScript Engine component. This vulnerability was fixed in Firefox 150.0.3, Firefox ESR 115.36, Firefox ESR 140.11, and Thunderbird 140.11.

CVE-2026-43899 Crítica · 9.6 CWE-20 11/05/2026

DeepChat: bypass em handler de pop-up do Electron permite execução arbitrária de protocolo

DeepChat é uma plataforma de agente de inteligência artificial de código aberto que unifica modelos, ferramentas e agentes. Antes da v1.0.4-beta.1, uma mitigação incompleta para o CVE-2025-55733 deixa o DeepChat vulnerável a um bypass de execução de protocolo arbitrário (RCE). Embora o patch tenha restringido corretamente api.openExternal() dentro do script preload/index.ts do renderer, ele deixou de sanitizar estruturalmente os manipuladores nativos de janelas pop-up do Electron. Um atacante ou um endpoint de IA comprometido que retorne um link Markdown pode acionar uma interceptação de janela nativa target="_blank" em tabPresenter.ts, que encaminha a URL maliciosa diretamente para shell.openExternal(url) e contorna completamente a fronteira de segurança isValidExternalUrl. Esta vulnerabilidade está corrigida na v1.0.4-beta.1.

CVE-2026-28936 Alta · 7.5 CWE-20 11/05/2026

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9...

The issue was addressed with improved checks. This issue is fixed in iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Sequoia 15.7.8, macOS Sonoma 14.8.7, macOS Sonoma 14.8.8, macOS Tahoe 26.5, visionOS 26.5. Processing a maliciously crafted file may lead to unexpected app termination.

CVE-2026-28917 Média · 4.3 CWE-20 11/05/2026

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and...

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may lead to an unexpected process crash.

CVE-2026-28907 Alta · 8.1 CWE-20 11/05/2026

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.9 and...

The issue was addressed with improved input validation. This issue is fixed in Safari 26.5, iOS 18.7.9 and iPadOS 18.7.9, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, watchOS 26.5. Processing maliciously crafted web content may prevent Content Security Policy from being enforced.

CVE-2026-28860 Alta · 7.5 CWE-20 11/05/2026

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and...

The issue was addressed with improved input validation. This issue is fixed in iOS 18.7.7 and iPadOS 18.7.7, iOS 26.4 and iPadOS 26.4, macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4, tvOS 26.4, visionOS 26.4, watchOS 26.4. A local attacker may be able to modify the state of the Keychain.

CVE-2026-44658 Baixa · 2.4 CWE-20 11/05/2026

Zen Browser: RSS Live-Folder Item URLs Are Not Scheme-Restricted Before Trusted Tab Creation

Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, but item links inside the feed are not subject to the same restriction. The provider maps each RSS/Atom item link into item.url, filters only for presence and date, and returns the item list. The live-folder manager later creates pinned lazy tabs from these values with gBrowser.addTrustedTab(item.url, ...). This vulnerability is fixed in 1.19.12b.

CVE-2026-43895 Média · 4.4 CWE-20 11/05/2026

jq: Embedded NUL in jq import paths causes local redaction-policy bypass and preserves sensitive fields in published artifacts

jq is a command-line JSON processor. In 1.8.1 and earlier, jq accepts embedded NUL bytes in import paths at the jq-language level, but later resolves those paths through C string operations during module and data-file lookup. This creates a mismatch between the logical import string that policy or audit code may validate and the on-disk path that jq actually opens.