Export limit exceeded: 21437 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11196 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 23829 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (23829 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-25269 | 1 Qualcomm | 313 Cologne, Cologne Firmware, Cq2390m and 310 more | 2026-10-09 | 6.7 Medium |
| Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size. | ||||
| CVE-2026-25263 | 1 Qualcomm | 333 5g Fixed Wireless Access Platform, 5g Fixed Wireless Access Platform Firmware, 9205 Lte Modem and 330 more | 2026-10-09 | 6.6 Medium |
| Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters. | ||||
| CVE-2026-76459 | 2026-10-09 | 9.8 Critical | ||
| As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76459 are related to out-of-bounds write issues that are grouped under the Common Weakness Enumeration (CWE) CWE-787. | ||||
| CVE-2026-105841 | 2 Lrzsz Project, Uwe Ohse | 2 Lrzsz, Lrzsz | 2026-10-09 | 7.5 High |
| lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name such as lrztar, procheader() in src/lrz.c passes the unescaped ZMODEM/YMODEM filename to popen(), so shell metacharacters execute as the receiving user. | ||||
| CVE-2026-91140 | 1 Progress Software | 1 Autonomous Rest Connector Genai Agents | 2026-10-09 | 9.6 Critical |
| An OS command injection vulnerability in the shell-based temporary-file cleanup instructions in Progress Software Autonomous REST Connector GenAI Agents ARCGenAI-Generator version 2.0 allows an attacker who supplies a crafted Swagger/OpenAPI document to execute arbitrary commands on a developer's machine when a user invokes the generator. | ||||
| CVE-2026-85523 | 1 Felisify Information Technologies Industry And Trade | 1 Sambabox | 2026-10-09 | 8.8 High |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1. | ||||
| CVE-2026-101207 | 1 Dell | 1 Openmanage Integration | 2026-10-09 | 8.8 High |
| Dell OpenManage Integration with Microsoft Windows Admin Center, versions prior to 3.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | ||||
| CVE-2026-102160 | 1 Arista | 1 Cloudvision Cue | 2026-10-09 | 7.2 High |
| An operating system (OS) command injection vulnerability in CloudVision CUE backup management may allow an authenticated Super User to submit a crafted backup request and execute arbitrary commands with the privileges of the affected service. | ||||
| CVE-2026-102163 | 1 Arista | 1 Wi-fi Access Points | 2026-10-09 | 8.8 High |
| On affected Arista access points with Wireless Intrusion Prevention System (WIPS) active, an unauthenticated attacker within radio frequency (RF) proximity can send a crafted frame to crash the sensor service, disabling WIPS monitoring on the access point, or potentially achieve remote code execution. No wireless association or authentication is required. | ||||
| CVE-2026-76437 | 1 Cisco | 1 Cisco License On-prem | 2026-10-09 | 4.9 Medium |
| A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper validation of user-supplied content within configurations that are submitted to the web-based management interface. An attacker could exploit this vulnerability by updating configurations within the web-based management interface. A successful exploit could allow the attacker to execute arbitrary commands on the underlying operating system with root privileges. To exploit this vulnerability, the attacker must have valid administrative credentials. Because only an attacker who already holds system administrator privileges can exploit the vulnerability, the only additional privileges gained include the ability to turn off the system, which an administrative user could not normally do. | ||||
| CVE-2026-56851 | 1 Golang | 1 Text | 2026-10-09 | 7.5 High |
| The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. | ||||
| CVE-2026-87726 | 1 Nxp | 1 Nxpnfcrdlib | 2026-10-09 | 3.9 Low |
| Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem. | ||||
| CVE-2026-107459 | 1 Openfind | 1 Secushare Pro | 2026-10-09 | 9.8 Critical |
| The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server. | ||||
| CVE-2026-105110 | 1 Iskratel | 1 Innbox | 2026-10-09 | 9.8 Critical |
| OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands as root via the CLI parameter. | ||||
| CVE-2026-107703 | 1 Enmaso | 1 Node-convert | 2026-10-09 | 9.8 Critical |
| @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell commands via unsanitized filepath and convertTo arguments. Attackers can inject shell metacharacters or a single quote into the ImageMagick command run by child_process.exec() to execute operating system commands with Node.js process privileges. | ||||
| CVE-2026-106126 | 1 Tenable | 1 Identity Exposure | 2026-10-09 | 9.9 Critical |
| A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe. | ||||
| CVE-2026-106547 | 1 Hdfgroup | 1 Hdf5 | 2026-10-09 | 7.8 High |
| A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0 lets a remote attacker cause an application crash and possibly execute arbitrary code with a crafted HDF5 file. When a dataset's unallocated chunks are read, H5D__fill_init() fills the fill-value buffer from datatype and dataspace metadata in the file. If that metadata is inconsistent with the buffer's allocated size, the write goes past the end of the buffer. The attacker can control the content written through the fill value stored in the file. | ||||
| CVE-2026-103416 | 1 Eclipse | 1 Threadx Netx Duo | 2026-10-09 | N/A |
| Out-of-bounds write via the TLS 1.3 handshake message cache in NetX Duo in Eclipse ThreadX NetX Duo 6.5.1.202602 allows a handshake message larger than the cache writes past it and on into the rest of the session control block, which holds pointers. A malicious or compromised server can make a TLS 1.3 client produce such a message before certificate authentication completes, so no server certificate is needed to reach it. | ||||
| CVE-2026-107510 | 1 Infoblox | 1 Nios | 2026-10-09 | 9.1 Critical |
| An authenticated high privilege user can inject arguments in troubleshooting commands resulting in privilege escalation. | ||||
| CVE-2026-98184 | 1 Linux | 1 Linux Kernel | 2026-10-09 | 7.0 High |
| In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: prevent authentication frame length truncation mwifiex_cfg80211_authenticate() derives the authentication frame length from req->ie_len and req->auth_data_len, both of type size_t, but stores it in a u16. NL80211_ATTR_AUTH_DATA only has a minimum length policy. Since nla_len is a u16, a single attribute can carry up to 65531 bytes of payload, so the sum can exceed U16_MAX before it is assigned to pkt_len. The truncated pkt_len determines the skb frame area, while the copy length remains req->auth_data_len - 4, resulting in a heap buffer overflow. For example, with auth_data_len equal to 65510 and no IEs, the sum is 65546. It is truncated to 10 and then reduced by four to 6. The driver appends only six bytes to the skb with skb_put(), but then copies 65506 user-provided bytes into the authentication body. Reaching this path requires CAP_NET_ADMIN in the user namespace owning the network namespace, an up station netdev, and a suitable BSS/SAE authentication request. Compute the length in size_t, reject values that cannot be represented by the firmware's u16 frame length field, and only then assign it to pkt_len. | ||||