Export limit exceeded: 408575 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408575 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-85963 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 7.5 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 include deprecated OpsDirector functionality with weaknesses that could allow an unauthenticated remote attacker to make unauthorized requests to internal services or forge trusted requests, potentially resulting in unauthorized access to protected information. | ||||
| CVE-2026-85964 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 7.7 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow an authenticated Query Console user to supply unsafe path values to a privileged filesystem helper, which could result in disclosure of arbitrary server files. | ||||
| CVE-2026-85966 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 7.7 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently restrict access to certain security-sensitive information. A remote authenticated attacker with limited management permissions could obtain this information, which could result in unauthorized access to protected resources. | ||||
| CVE-2026-85967 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 6.1 Medium |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that could allow a remote attacker to execute script in the context of an authenticated user's browser session, which could result in unauthorized actions or disclosure of information accessible to that user. | ||||
| CVE-2026-85968 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 7.1 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or disclose limited information from process memory. | ||||
| CVE-2026-85970 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 7.1 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in multiple server paths, which could allow crafted XML to cause server-side requests or disclosure of local files. | ||||
| CVE-2026-16678 | 1 Ibm | 2 Virtualization Management Interface, Virtualization Manager | 2026-10-13 | 4.5 Medium |
| IBM Power Systems Firmware FW1110.00 through FW1110.31, FW1120.00 through FW1120.01, and FW1060.00 through FW1060.81 could allow a remote authenticated attacker to cause a denial of service by exhausting connection resources due to improper resource management. | ||||
| CVE-2026-108961 | 1 Paddlepaddle | 2 Paddle, Paddlex | 2026-10-13 | 6.3 Medium |
| A flaw has been found in PaddlePaddle PaddleX up to 3.7.2. Affected by this vulnerability is the function NormalizeImage.__init__ of the file paddlex/inference/models/text_detection/processors.py of the component Preprocessor. This manipulation of the argument scale causes code injection. It is possible to initiate the attack remotely. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-85957 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-13 | 7.5 High |
| Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, which could result in unintended network access or information disclosure. | ||||
| CVE-2026-109246 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 6.5 Medium |
| FreeRDP before 3.32.0 contains a divide-by-zero vulnerability in the freerdp-shadow-cli shadow server: the frame id in a client's Frame Acknowledge PDU is stored without a range check, so the in-flight frame count in shadow_encoder_inflight_frames() can underflow. An authenticated client can acknowledge a frame id one greater than the last frame sent, causing shadow_encoder_create_frame_id() to divide by zero (SIGFPE) and terminate the process, disconnecting all viewers. | ||||
| CVE-2026-108974 | 1 Sourcecodester | 1 E-learning System | 2026-10-13 | 7.3 High |
| A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-66651 | 2 Multivendorx, Wordpress | 2 Multivendorx, Wordpress | 2026-10-13 | 6.5 Medium |
| Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20. | ||||
| CVE-2026-42696 | 2026-10-13 | 10 Critical | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in Royal Plugins SiteVault – Backup, Restore, Migration & Cloning sitevault-backup-restore-migration allows Remote Code Inclusion.This issue affects SiteVault – Backup, Restore, Migration & Cloning: from n/a through 1.5.19. | ||||
| CVE-2026-42697 | 2026-10-13 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inisev Social Share Icons & Social Share Buttons ultimate-social-media-plus allows Reflected XSS.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.7.5. | ||||
| CVE-2026-109291 | 2 Open-webui, Openwebui | 2 Open-webui, Open Webui | 2026-10-13 | 7.3 High |
| Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to window.open, letting them steal localStorage.token and act as the victim. | ||||
| CVE-2026-108970 | 1 Itsmeravitejak | 1 Online-examination-system | 2026-10-13 | 7.3 High |
| A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-108933 | 1 Edimax | 2 Br-6208ac, Br-6208ac Firmware | 2026-10-13 | 2.4 Low |
| A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108966 | 1 Sourcecodester | 1 Performance Indicator System | 2026-10-13 | 7.3 High |
| A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-109786 | 1 Fail2ban | 1 Fail2ban | 2026-10-13 | 5.3 Medium |
| In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on <token>" suffix after the host address. Because OpenSSH logs the offered username verbatim, a remote unauthenticated attacker can use a username such as "x VICTIM-SOURCE-IP-ADDRESS on" to make fail2ban associate failed login attempts with an arbitrary source IP address and ban it (e.g., to block logins from a legitimate user). The default filter mode is affected. | ||||
| CVE-2026-108962 | 1 Storyicon | 1 Comfyui Segment Anything | 2026-10-13 | 6.3 Medium |
| A vulnerability has been found in storyicon comfyui_segment_anything up to ab6395596399d5048639cdab7e44ec9fae857a93. Affected by this issue is the function SLConfig._file2dict of the file local_groundingdino/util/slconfig.py of the component GroundingDINO Model Loading. Such manipulation of the argument config leads to code injection. It is possible to launch the attack remotely. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet. | ||||