Export limit exceeded: 425758 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425758 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103645 | 1 Qt | 4 Qt, Qt5compat, Qt Framework and 1 more | 2026-11-13 | N/A |
| An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt Core module (Qt 5). Only builds where Qt is compiled with ICU support are affected. | ||||
| CVE-2026-86353 | 1 Dell | 12 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 9 more | 2026-11-13 | 5 Medium |
| Dell PowerStore contains a use of a weak cryptographic algorithm vulnerability that could allow an attacker with existing privileged access to the appliance to recover stored credentials. | ||||
| CVE-2026-2950 | 1 Lodash | 5 Lodash, Lodash-amd, Lodash-es and 2 more | 2026-11-13 | 6.5 Medium |
| The _.unset and _.omit functions in Lodash are vulnerable to prototype pollution. The fix for CVE-2025-13465 only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype. The issue permits deletion of prototype properties but does not allow overwriting their original behavior. The issue is patched from 4.18.0 to 4.18.1 depending on the package: lodash, lodash-es, and lodash-amd in 4.18.1, and the standalone lodash.unset and lodash.omit packages in 4.18.0. | ||||
| CVE-2026-68551 | 2026-11-13 | N/A | ||
| Budget Board is an app for tracking monthly spending and working towards financial goals. Prior to version 3.6.2, Budget Board's OIDC login flow finds and signs into an existing local account purely by matching the email address asserted in the identity provider's token - it never checks the standard email_verified claim. If the configured OIDC provider ever allows a user to register or display an email address without proving they own it , an attacker can register there using a victim's email and get signed into the victim's existing Budget Board account - including all their linked bank data. This issue has been patched in version 3.6.2. | ||||
| CVE-2026-128088 | 2026-11-13 | 2.2 Low | ||
| russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to version 0.65.1, try_sign() captures an Arc<PrivateKey> before awaiting Agent::confirm() and does not revalidate the shared lock state or key presence after the await. This is a distinct residual defect in the remediation for CVE-2026-116794. A peer, including a remote SSH server using agent forwarding, can begin a confirmation-constrained signature request while the agent is unlocked and receive the signature after another connection locks the agent if the stale confirmation returns true. New post-lock requests are rejected and private key material is not disclosed, but the pending operation bypasses the current lock state. This issue is fixed in version 0.65.1. | ||||
| CVE-2026-129217 | 2026-11-13 | N/A | ||
| In FRRouting (FRR) 8.3 through 10.5.1, bgp_notify_decapsulate_hard_reset() in bgpd/bgp_packet.c does not validate the length of the data field of a received BGP NOTIFICATION Cease/Hard Reset message (RFC 8538). When the data field is exactly one byte long, the function reads one byte past the end of a heap buffer and the 16-bit length of the encapsulated data underflows to 65535, causing a 65535-byte out-of-bounds heap read followed by an assertion failure. A remote BGP peer that has established a session and negotiated the Graceful Restart capability with the Notification (N) bit can send such a message to crash the bgpd daemon, terminating all BGP sessions (denial of service). This is fixed in 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2 and 10.6.0. | ||||
| CVE-2026-68541 | 2026-11-13 | N/A | ||
| PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive content is disclosed via CSS-only web redaction and insecure starter workflow defaults. This issue has been patched in version 1.4.1. | ||||
| CVE-2026-128087 | 2026-11-13 | 3.7 Low | ||
| russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From version 0.55.0 until version 0.65.1, the initial key exchange invokes client::Handler::kex_done() with the raw shared secret before check_server_key() accepts the server host key or certificate. A malicious SSH server can therefore trigger application-defined secondary-channel initialization or early data handling even when the server identity is subsequently rejected. Ordinary clients that keep the callback's no-op default or independently defer callback-derived actions until trust is confirmed are not affected. This issue is fixed in version 0.65.1. | ||||
| CVE-2026-121528 | 1 Fortinet | 1 Fortios | 2026-11-13 | 7.7 High |
| A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13, FortiOS 7.0 all versions, FortiOS 6.4 all versions may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website. | ||||
| CVE-2026-43626 | 2026-11-13 | N/A | ||
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority, replacedby CVE-2026-70640. | ||||
| CVE-2026-67444 | 2026-11-13 | N/A | ||
| Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can upload a file with an arbitrary extension as their dashboard "background image," and the server will later serve that file back with a Content-Type derived straight from the attacker's chosen extension - so uploading an .html file gets it served as text/html. Because the endpoint that serves it returns a manually-constructed response rather than going through SvelteKit's normal page-rendering pipeline, the app's configured Content-Security-Policy never gets attached to it either, so a script embedded in the upload runs unrestricted. This issue has been patched in version 0.5.2. | ||||
| CVE-2026-126443 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows authenticated users without patients/demo permission to query patient demographics. Attackers can supply arbitrary patient_data columns via the sColumns parameter to enumerate names, dates of birth, contact details, and Social Security numbers across the practice. | ||||
| CVE-2026-126441 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 5.3 Medium |
| OpenEMR before 8.5.0 contains an insecure direct object reference vulnerability in the CAMOS rx_print.php printer that allows authenticated users to read other patients' prescriptions. Attackers can submit forged chrx_ parameters with global prescription IDs to disclose drug names, dosages, directions, and refill counts without medication permissions. | ||||
| CVE-2026-126439 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 5.3 Medium |
| OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to enforce the patients/pat_rep permission, accepting any authenticated core session. Authenticated users without patient-report permission can request the report_ccd_view action to retrieve the selected patient's C-CDA clinical summary, including diagnoses, medications, laboratory results, and identifiers. | ||||
| CVE-2026-126437 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 6.5 Medium |
| OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any authenticated core user to render documents for arbitrary patients by setting isModule. Attackers can submit arbitrary pid and template_id values to disclose patient names, birth dates, chart IDs, addresses, allergies, medications, and problem lists despite ACL and squad restrictions. | ||||
| CVE-2026-126436 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-13 | 7.5 High |
| OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered grant types because oauth_clients.grant_types is never enforced. Attackers can request tokens with grant_type=password to bypass the user consent screen, and disabled clients can redeem authorization codes using JWT client assertions. | ||||
| CVE-2026-123283 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 6.8 Medium |
| In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account | ||||
| CVE-2026-123282 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 7.4 High |
| In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session | ||||
| CVE-2026-68510 | 2026-11-13 | N/A | ||
| bit-vec is a compact vector of bits. Prior to version 0.10.0, there is undefined behavior if a user performs deserialize from an untrusted source and unsafe get_unchecked. A user of this library may be impacted by incorrect behavior if they perform deserialize from an untrusted source and run operations on the deserialized BitVec. This issue has been patched in version 0.10.0. | ||||
| CVE-2026-123281 | 1 Jetbrains | 1 Datalore | 2026-11-13 | 7.5 High |
| In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker | ||||