Export limit exceeded: 408713 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408713 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-7425 | 1 Redhat | 17 Cert Manager, Discovery, Enterprise Linux and 14 more | 2026-10-12 | 7.8 High |
| A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attributes. As a result, the system may access freed memory, causing crashes or enabling attackers to trigger heap corruption. | ||||
| CVE-2026-85969 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-12 | 7.1 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certain language-processing functionality. A remote authenticated attacker could exploit this vulnerability to cause server instability or limited modification of data. | ||||
| CVE-2026-95166 | 2026-10-12 | 5.4 Medium | ||
| In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field allows for a Cross Site Scripting (XSS) payload. | ||||
| CVE-2026-95165 | 2026-10-12 | 6.1 Medium | ||
| Bacularis 5.4.0 - 6.5.1 is vulnerable to Cross Site Scripting (XSS) in the Organization name field. | ||||
| CVE-2026-85949 | 1 Progress Software Corporation | 1 Marklogic Server | 2026-10-12 | 8.1 High |
| Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnostic logs under certain configurations. An attacker with access to the affected logs could use this information to obtain unauthorized access to protected resources. | ||||
| CVE-2026-109164 | 1 Tduckcloud | 1 Tduck-survey-form | 2026-10-12 | 7.1 High |
| TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' form submissions by supplying arbitrary submission ids. Attackers can place their own formKey in the path and iterate sequential submission ids in the request body to permanently delete submissions platform-wide. | ||||
| CVE-2026-96280 | 2 Flatpak, Redhat | 2 Flatpak, Enterprise Linux | 2026-10-12 | 7.5 High |
| The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer overflows. An attacker controlling an OCI registry can craft a delta stream that triggers this during flatpak install/update, potentially achieving code execution on 32-bit systems. | ||||
| CVE-2026-96275 | 2 Flatpak, Redhat | 2 Flatpak, Enterprise Linux | 2026-10-12 | 8.8 High |
| A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via extract_extra_data(). On system installs, the write happens as root. Two issues combine: `files/extra` is resolved via path operations that follow symlinks, and blob names from `xa.extra-data-sources` are not sanitized against `..` traversal. | ||||
| CVE-2026-93879 | 2026-10-12 | 7.5 High | ||
| A flaw was found in Hibernate Validator starting with version 5.4.1. This vulnerability allows an unauthenticated remote attacker to cause a Denial of Service (DoS) by submitting specially crafted input containing unescaped message parameters. Improper escaping allows user-supplied data to be re-evaluated during Expression Language (EL) processing, leading to excessive resource consumption and application unresponsiveness. | ||||
| CVE-2026-35273 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-12 | 9.8 Critical |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-93695 | 1 Progress | 1 Sharefile Storage Zones Controller | 2026-10-12 | 7.4 High |
| In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the service account. This can result in remote code execution when an executable IIS-served directory is writable. | ||||
| CVE-2026-109361 | 1 Project-monai | 1 Monai | 2026-10-12 | 7.3 High |
| MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a malicious pickle elsewhere on the filesystem to execute code when predict_ensemble_postprocessing runs. | ||||
| CVE-2026-109356 | 1 Librenms | 1 Librenms | 2026-10-12 | 4.3 Medium |
| LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase every deleted port on all visible devices. | ||||
| CVE-2026-109346 | 1 Better-auth | 1 Better Auth | 2026-10-12 | 8.1 High |
| better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting client_id and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then redeem it at /device/token for a live session token. | ||||
| CVE-2026-109341 | 1 Surrealdb | 1 Surrealdb | 2026-10-12 | 7.1 High |
| SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-restricted fields by resolving JSON Patch pointers against the unreduced record. Attackers can use PATCH copy or move operations to copy hidden fields into readable destinations, or abuse test mismatch errors as a disclosure oracle. | ||||
| CVE-2026-109336 | 1 Surrealdb | 1 Surrealdb | 2026-10-12 | 4.3 Medium |
| SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT permissions through LIVE SELECT projections. Attackers can project restricted fields from the unreduced $after or $before parameters under an alias to receive exact stored values in CREATE, UPDATE, and DELETE notifications. | ||||
| CVE-2026-109331 | 1 Network-ai | 1 Network-ai | 2026-10-12 | 7.4 High |
| Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches deny patterns only against the first present candidate field. A prompt-injected agent can place dangerous payloads in fields like Write content or an MCP script parameter beside a benign file_path or command, evading denyPatterns to write web shells or execute scripts. | ||||
| CVE-2026-109326 | 1 Getgrav | 1 Grav | 2026-10-12 | 7.5 High |
| Grav before 2.1.7 contains an information disclosure vulnerability because bundled nginx, lighttpd, IIS, and Caddy 2 configurations block .git only at document root. Unauthenticated attackers can request nested repositories such as user/.git to retrieve Git config, refs, and objects, reconstructing unpublished history or committed secrets. | ||||
| CVE-2026-109311 | 1 Vllm | 1 Vllm | 2026-10-12 | 6.5 Medium |
| vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser heap overflow. Authenticated remote attackers can repeatedly upload malformed IAMF containers to /v1/audio/transcriptions, corrupting the heap and crashing the API process. | ||||
| CVE-2026-109306 | 1 Craftcms | 1 Craft Cms | 2026-10-12 | 5.9 Medium |
| Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the action route when the licensed edition mismatches to persistently downgrade the site edition in project config, which admins cannot reverse from the control panel. | ||||