Export limit exceeded: 399617 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 399617 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (399617 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-102004 | 1 Windriver | 1 Vxworks | 2026-09-29 | 7.8 High |
| Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem. Fixed in Version 26.09 | ||||
| CVE-2026-101041 | 1 Circl | 1 Vulnerability-lookup | 2026-09-29 | N/A |
| The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOCTOU) race condition in the consumption of single-use recovery tokens. The original implementation verified the token nonce against the stored digest and then consumed (cleared) it in separate database operations. Two concurrent HTTP requests presenting the same valid recovery token could both pass the verification check before either transaction committed, allowing both to set their own password on the target account. The last transaction to commit overwrites the first, enabling an attacker who possesses a valid recovery token to replace the legitimate user's password with one of their choosing. A secondary defect in the same endpoint (confirm_account) allowed a valid recovery link to be used to set an empty or trivially short password (e.g., three characters). The view handler performed only a manual equality comparison between the two password fields and never invoked the form's validation logic, bypassing the intended minimum-length and complexity constraints. The affected component is the user account recovery endpoint (/user/confirm_account/<token>) and the associated token verification and consumption logic in the User model (website/models/user.py) and the view layer (website/web/views/user.py). | ||||
| CVE-2026-88027 | 1 Mongodb | 2 Laravel Mongodb, Laravel Mongodb (php) | 2026-09-29 | 7.1 High |
| Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for Laravel can cause a caller-supplied embedded record identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence such an identifier may delete all embedded documents in a targeted record or overwrite an embedded document other than the intended target. | ||||
| CVE-2026-100790 | 1 Mozilla | 1 Firefox | 2026-09-29 | 8.8 High |
| Use-after-free in the XSLT component. This vulnerability was fixed in Firefox ESR 153.4, Firefox 157, Firefox ESR 115.42, and Firefox ESR 140.17. | ||||
| CVE-2026-100795 | 1 Mozilla | 1 Firefox | 2026-09-29 | 6.5 Medium |
| Denial-of-service in the Networking component. This vulnerability was fixed in Firefox 157. | ||||
| CVE-2026-100796 | 1 Mozilla | 1 Firefox | 2026-09-29 | 8.8 High |
| Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox 157. | ||||
| CVE-2026-100804 | 1 Mozilla | 1 Firefox | 2026-09-29 | 9.6 Critical |
| Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Firefox 157. | ||||
| CVE-2026-100805 | 1 Mozilla | 1 Firefox | 2026-09-29 | 7.5 High |
| Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 157. | ||||
| CVE-2026-100238 | 2026-09-29 | N/A | ||
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Flow Extension allows Stored XSS. This issue affects Mediawiki - Flow Extension: from * before 1.46.1, 1.45.5, 1.43.10. | ||||
| CVE-2026-102557 | 1 Redhat | 1 Enterprise Linux | 2026-09-29 | 8.6 High |
| A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation while the implementation still used the full length, leading to heap corruption or a crash. | ||||
| CVE-2026-88028 | 1 Mongodb | 2 Laravel Mongodb, Laravel Mongodb (php) | 2026-09-29 | 6.5 Medium |
| Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel can cause a caller-supplied relation identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence a stored relation identifier may cause an affected application to return a document other than the intended relation target. | ||||
| CVE-2026-68881 | 1 Microsoft | 20 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 17 more | 2026-09-29 | 5.5 Medium |
| Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-88029 | 1 Mongodb | 1 Python Driver | 2026-09-29 | 8.3 High |
| Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. The affected rename operation may also rename a stored file other than the intended target. | ||||
| CVE-2026-68885 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-09-29 | 7.8 High |
| Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88030 | 1 Mongodb | 1 Ruby Driver | 2026-09-29 | 8.3 High |
| Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may obtain stored file content beyond the intended target or cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. | ||||
| CVE-2026-87902 | 1 Wordpress | 1 Wordpress | 2026-09-29 | 8.1 High |
| An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE. | ||||
| CVE-2026-102473 | 2 Dash, Redhat | 2 Dash, Enterprise Linux | 2026-09-29 | 5.5 Medium |
| A flaw was found in dash. When built without libc fnmatch, the internal pmatch() matcher implements * by unbounded recursion over candidate positions. A local user who can plant filenames, or otherwise feed that matcher, can make a short multi-star pattern such as *.*.*.*.*.tar.gz consume excessive CPU. | ||||
| CVE-2026-95387 | 1 Wireshark | 1 Wireshark | 2026-09-29 | 8.1 High |
| SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-95395 | 1 Wireshark | 1 Wireshark | 2026-09-29 | 5.5 Medium |
| IEEE C37.118 Synchrophasor protocol dissector memory leak in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service | ||||
| CVE-2026-88031 | 1 Mongodb | 1 Go Driver | 2026-09-29 | 8.1 High |
| Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied structured file identifier to be interpreted as a query condition rather than as a literal identifier. An authenticated user who can influence the identifier passed by an affected application may cause all GridFS file chunks in the affected bucket to be removed, rendering stored file content unreadable. | ||||