Export limit exceeded: 415509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 415509 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415516 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110127 | 1 Wayn111 | 1 Waynboot-mall | 2026-10-26 | 4.3 Medium |
| waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum, and DELETE /cart/{cartId} to change quantities, selection state, or remove items. | ||||
| CVE-2026-110110 | 1 Jetlinks | 1 Jetlinks Community | 2026-10-26 | 4.3 Medium |
| JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annotation, attackers can toggle alarms by id to silence alerts for monitored devices. | ||||
| CVE-2026-110105 | 1 B3log | 1 Symphony | 2026-10-26 | 5.3 Medium |
| B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/ignore/{reportId}, /admin/tags/remove-unused, or /admin/user/{userId}/init-point to ignore reports, delete unused tags, or grant points without audit logging. | ||||
| CVE-2026-110100 | 1 Jorani | 1 Jorani | 2026-10-26 | 5.4 Medium |
| Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-working-day calendars and abuse get_headers() and fopen() for server-side request forgery against internal hosts. | ||||
| CVE-2026-109966 | 1 Marcopiovanello | 1 Yt-dlp-web-ui | 2026-10-26 | 5.3 Medium |
| yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp options by supplying a dash-prefixed url parameter to the Service.Formats JSON-RPC method. Attackers can send values like --load-info-json via /rpc/http or /rpc/ws to make yt-dlp load attacker-chosen JSON files from the server filesystem, with contents reflected in responses. | ||||
| CVE-2026-109961 | 1 Froxlor | 1 Froxlor | 2026-10-26 | 8.5 High |
| Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation. | ||||
| CVE-2026-109956 | 1 Nltk | 1 Nltk | 2026-10-26 | 7 High |
| NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the model_filename or model argument can make the weka JVM write files via -d or probe files via -l outside allowed data roots. | ||||
| CVE-2026-109774 | 1 Mozilla | 1 Firefox | 2026-10-26 | 9.8 Critical |
| Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | ||||
| CVE-2026-105626 | 1 Hashicorp | 2 Consul, Consul Enterprise | 2026-10-26 | 7.5 High |
| HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an unauthenticated attacker to exhaust memory on a Consul agent. This vulnerability (CVE-2026-105626) is fixed in Consul Community Edition 2.1.0 and Consul Enterprise 2.1.0 and 1.21.19. | ||||
| CVE-2026-101429 | 1 Oracle | 1 Peoplesoft Enterprise Peopletools | 2026-10-26 | 7 High |
| Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: SQR). Supported versions that are affected are 8.61-8.63. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where PeopleSoft Enterprise PeopleTools executes to compromise PeopleSoft Enterprise PeopleTools. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 7.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-69850 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-26 | 7.8 High |
| Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2025-52097 | 1 Instantasp | 1 Instantforum | 2026-10-26 | N/A |
| Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding | ||||
| CVE-2026-69856 | 1 Microsoft | 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more | 2026-10-26 | 7 High |
| Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69884 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 7.8 High |
| Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-63885 | 1 Linux | 1 Linux Kernel | 2026-10-26 | 8.8 High |
| In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between change_handle and handle_delete drm_gem_change_handle_ioctl leaves the old handle live in the IDR during the window between spin_unlock(table_lock) and the final spin_lock(table_lock). A concurrent drm_gem_handle_delete on the old handle succeeds in this window, decrements handle_count to 0, and frees the GEM object while the new handle's IDR entry still references it. NULL the old handle's IDR entry before dropping table_lock so that any concurrent GEM_CLOSE on the old handle sees NULL and returns -EINVAL. Restore the old entry on the prime-bookkeeping error path. | ||||
| CVE-2026-108457 | 1 Microsoft | 9 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 6 more | 2026-10-26 | 8.1 High |
| Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-108460 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-26 | 8.1 High |
| Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-52167 | 2026-10-26 | 6.2 Medium | ||
| A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying a crafted .PSB subtitle file. | ||||
| CVE-2026-116538 | 2 Htmlsanitizer Project, Mganss | 2 Htmlsanitizer, Htmlsanitizer | 2026-10-26 | 4.7 Medium |
| HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability because SanitizeDom(string) never sanitizes attributes on the html and body wrapper elements. Attackers can supply input with a second body or html tag carrying event handlers like onload, executing script when applications render serialized document or body outer HTML. | ||||
| CVE-2026-116502 | 1 Turboderp-org | 1 Exllamav2 | 2026-10-26 | 4.4 Medium |
| A flaw has been found in turboderp-org ExLlamaV2 up to 0.3.2. The impacted element is the function QMatrix::make_sequential of the file exllamav2/exllamav2_ext/cuda/q_matrix.cu of the component GPTQ Index Handler. Executing a manipulation of the argument g_idx can lead to out-of-bounds write. The attack needs to be launched locally. The project was informed of the problem early through an issue report but has not responded yet. | ||||