Export limit exceeded: 400646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 400646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (400646 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103262 | 1 Tornadoweb | 1 Tornado | 2026-10-01 | 7.5 High |
| Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decompression bomb that accumulates in memory without size limits, causing the application process to be killed by out-of-memory conditions. | ||||
| CVE-2026-103489 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 2 Low |
| In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | ||||
| CVE-2026-102584 | 1 Moodle | 1 Moodle | 2026-10-01 | 4.3 Medium |
| A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade penalties without holding the required permissions. This issue allows unauthorized users to modify grade penalty records, potentially altering student assessment scores. | ||||
| CVE-2026-102585 | 1 Moodle | 1 Moodle | 2026-10-01 | 4.3 Medium |
| A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the selected group actually belongs to that course. An authenticated user with teacher privileges could exploit this flaw to add users to groups within courses they do not have authorization to access. | ||||
| CVE-2026-102578 | 1 Moodle | 1 Moodle | 2026-10-01 | 5.5 Medium |
| A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vulnerability. This issue could allow an attacker to view, alter, or delete sensitive data stored in the underlying database. | ||||
| CVE-2026-102580 | 1 Moodle | 1 Moodle | 2026-10-01 | 2.2 Low |
| A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component, allowing arbitrary class instantiation. This vulnerability enables the unauthorized creation of internal program objects, which may result in unexpected application behavior. | ||||
| CVE-2026-103347 | 2026-10-01 | 5.3 Medium | ||
| Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions. | ||||
| CVE-2026-100514 | 2026-10-01 | 7.5 High | ||
| Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions. | ||||
| CVE-2026-97277 | 2026-10-01 | 7.6 High | ||
| Subscriber Broken Access Control in Social Boost <= 3.6.2 versions. | ||||
| CVE-2026-97258 | 2026-10-01 | 6.5 Medium | ||
| Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. | ||||
| CVE-2026-47512 | 1 Nvidia | 5 Geforce, Nvs, Quadro and 2 more | 2026-10-01 | 7.8 High |
| NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could cause an out-of-bounds read leading to kernel information disclosure. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering. | ||||
| CVE-2026-102587 | 1 Moodle | 1 Moodle | 2026-10-01 | 2.7 Low |
| A flaw was found in Moodle. User list filters do not properly enforce visibility restrictions on user profile fields. An authorized user with manager privileges can filter user lists using profile attributes they are not permitted to view directly, resulting in unauthorized information disclosure by inferring hidden user data. | ||||
| CVE-2026-103491 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.19422 iDOR in the issue activities API allowed reading restricted issues | ||||
| CVE-2026-103497 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 5.5 Medium |
| In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration | ||||
| CVE-2026-103496 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 5.4 Medium |
| In JetBrains YouTrack before 2026.2.19422 iDOR in inbox threads allowed reading other users' notifications | ||||
| CVE-2026-103495 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 4.3 Medium |
| In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | ||||
| CVE-2026-103494 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 6.6 Medium |
| In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group membership changes | ||||
| CVE-2026-95366 | 1 Google | 1 Chrome | 2026-10-01 | 6.5 Medium |
| Use of released resource in Core in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-102579 | 1 Moodle | 1 Moodle | 2026-10-01 | 4.3 Medium |
| A flaw was found in Moodle. An incorrect capability check in the grade web service allows an authenticated student to access profile information of other students enrolled in the same course that they should not have permission to view. This issue leads to unauthorized information disclosure. | ||||
| CVE-2026-103492 | 1 Jetbrains | 1 Youtrack | 2026-10-01 | 6.5 Medium |
| In JetBrains YouTrack before 2026.2.19422 doS attack was possible via crafted PSD attachments | ||||