Export limit exceeded: 408713 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408713 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-55562 | 1 Jhuckaby | 1 Cronicle | 2026-10-13 | 9 Critical |
| Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.full_name value into HTML without applying encode_entities and inserts the result through this.div.html. The bundled pixl-server-user input filter can be bypassed by a tag containing a line break because its regular expression does not match newlines. An authenticated non-administrator can update the attacker's own name through /api/user/update using a valid session and current password; when free_accounts is enabled, an anonymous attacker can instead plant the name during self-registration. The stored name executes script in an administrator's session when the Activity Log is opened, enabling administrator takeover and subsequent command execution through privileged Cronicle features. This issue is fixed in version 0.9.119. | ||||
| CVE-2026-96594 | 1 Gitea | 1 Gitea | 2026-10-13 | 6.1 Medium |
| The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by the browser on the Gitea origin. A user who can push to a repository could run JavaScript in the session of a victim who opens the media URL and act with the victim's permissions. | ||||
| CVE-2026-97208 | 1 Gitea | 1 Gitea | 2026-10-13 | 4.9 Medium |
| The Gitea API endpoint for creating push mirrors (`POST /api/v1/repos/{owner}/{repo}/push_mirrors`) checked only whether mirroring was enabled and not the `[mirror] DISABLE_NEW_PUSH` setting that the web interface enforces. A repository administrator could therefore create new push mirrors on instances where the site administrator had disabled them. A push mirror pushes all refs of the repository to a remote chosen by the caller, on each commit or on a schedule. | ||||
| CVE-2026-92892 | 2026-10-13 | 9 Critical | ||
| Potential arbitrary code execution, under specific configurations. | ||||
| CVE-2026-53420 | 1 Zoom Communications | 1 Zoom Workplace | 2026-10-13 | 8 High |
| Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via network access. | ||||
| CVE-2026-77362 | 1 The-40-thieves | 1 Obsidian-tc | 2026-10-13 | 4.3 Medium |
| obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived from denied notes, makemd_query passes unfiltered sibling result fields through, and list_templates exposes template paths and parsed user-function bodies without a read-whitelist check. An authenticated caller can consequently infer or read data from notes outside the caller's read ACL. Version 1.3.1 fixes the vulnerability by filtering path-attributable fields and applying the read whitelist to list_templates. | ||||
| CVE-2026-108381 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.44.0 through 0.70.5, the Pydantic and AvroDantic model generators insert a schema field's pydantic-class value after pydantic. in a generated field annotation without safely restricting the expression. Because annotations are evaluated when the generated module is imported, a crafted value can execute arbitrary Python code. Version 0.70.6 fixes the vulnerability by restricting the value to a bare name or a call to a bare name with literal arguments. | ||||
| CVE-2026-108379 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_fixed inserts a fixed type's namespace value between quotes inside a generated types.confixed annotation without escaping or validating it. A crafted quote can terminate the namespace string and alter the surrounding annotation expression, which Python evaluates when the generated class is defined, allowing arbitrary code execution. Version 0.70.6 fixes the vulnerability by requiring the namespace to be a dot-separated sequence of valid Avro names. | ||||
| CVE-2026-16516 | 2 Wolfssh, Wolfssl | 2 Wolfssh, Wolfssh | 2026-10-13 | 7.4 High |
| wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to derive the curve via NameToId/wcPrimeForId without checking against the negotiated ssh->handshake->pubKeyId, and the RFC 5656 curve identifier string is discarded via GetSkip() rather than compared. An active network man-in-the-middle attacker can substitute a host key blob containing a different ECDSA curve, causing the client to import the key on the wrong curve. Because the attacker controls the private key for the substituted curve, signature verification passes. Exploitation requires an active MitM position and a lax public key check callback (e.g., TOFU, algorithm-name-only check, or fingerprint match against the parsed key). | ||||
| CVE-2020-9287 | 1 Fortinet | 2 Forticlient Emergency Management Server, Forticlientems | 2026-10-13 | 7.5 High |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2020-9290 | 1 Fortinet | 3 Forticlient, Forticlient Virtual Private Network, Forticlientwindows | 2026-10-13 | 7.1 High |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2019-5589 | 1 Fortinet | 2 Forticlient, Forticlientwindows | 2026-10-13 | 8.6 High |
| A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2020-12811 | 1 Fortinet | 2 Fortianalyzer, Fortimanager | 2026-10-13 | 4.9 Medium |
| A improper neutralization of script-related html tags in a web page (basic xss) vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable | ||||
| CVE-2026-81535 | 2 Wolfssh, Wolfssl | 2 Wolfssh, Wolfssh | 2026-10-13 | 9.1 Critical |
| In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward. | ||||
| CVE-2026-105445 | 2026-10-13 | N/A | ||
| An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories. | ||||
| CVE-2026-83540 | 2 Wolfssh, Wolfssl | 2 Wolfssh, Wolfssh | 2026-10-13 | 8.8 High |
| When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected. | ||||
| CVE-2026-11731 | 1 Netgear | 3 Rax28, Rax29, Rax30 | 2026-10-13 | 8.8 High |
| An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions. | ||||
| CVE-2026-11732 | 1 Netgear | 4 Cax30, Rax30, Rax5 and 1 more | 2026-10-13 | 8.8 High |
| An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on. | ||||
| CVE-2026-107917 | 1 Netgear | 1 R7300dst | 2026-10-13 | 4.5 Medium |
| Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices. | ||||
| CVE-2026-108184 | 1 Zoom Communications | 1 Zoom Clients | 2026-10-13 | 7.4 High |
| Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access. | ||||