Export limit exceeded: 422312 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422312 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-90591 | 1 Zephyrproject | 1 Zephyr | 2026-11-09 | 7.5 High |
| The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos hands each processed descriptor back to the DMA by writing desc->read.control = rx_desc_refresh_flags, which sets OWN_FLAG and BUF1_ADDR_VALID_FLAG. RDES0 of a receive descriptor is the DMA buffer address in read format, but the hardware write-back aliases that word with the VLAN tag fields (or, for a context descriptor, the timestamp low word), so it is destroyed on every completion. The success path rewrites desc->read.buf1_addr before re-arming; the four drop paths — errored or non-first descriptor, net_pkt_rx_alloc() failure, invalid descriptor length, and net_pkt_get_frag() failure — did not, re-arming the ring slot with the write-back residue as its DMA target address. The drop paths are driven entirely by received traffic and need no privilege or special configuration. With the defaults for this driver (CONFIG_NET_BUF_DATA_SIZE of 128 and 16 receive descriptors) a single full-size frame consumes twelve ring slots and twelve K_NO_WAIT fragment allocations, so a short burst of frames sent to the device exhausts the receive pools and reaches the allocation-failure paths; a frame with a receive error, or any frame whose first descriptor was already dropped, reaches the non-first-descriptor path. Once a slot has been poisoned, the DMA writes the next frame received in that slot to an address derived from the frame's VLAN tag fields rather than to a receive buffer. On the supported MCX SoCs that address falls in flash or reserved space, so the transfer raises a fatal bus error that the driver only logs — there is no reset or recovery path — and reception stops permanently until the device is rebooted; where the write is silently discarded instead, the untouched buffer is later handed to the network stack with a length, delivering stale buffer contents as if they were a received frame. A single triggering event is enough to make the condition persistent, so an attacker able to send traffic to the device can permanently disable its network interface. | ||||
| CVE-2026-125405 | 1 Ettercap-project | 1 Ettercap | 2026-11-09 | 8.1 High |
| Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c due to unvalidated NTLM message offsets. Attackers can send a crafted HTTP Authorization header observed by Ettercap to read beyond the buffer, disclosing memory or crashing the process. | ||||
| CVE-2026-125403 | 1 Ettercap-project | 1 Ettercap | 2026-11-09 | 8.1 High |
| Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in src/ec_sslwrap.c, caused by a stale length and an unchecked memmem() result when stripping Strict-Transport-Security headers. A malicious HTTPS server whose response passes through Ettercap's SSL interception can trigger out-of-bounds reads and memory corruption in the Ettercap process, which normally runs as root. | ||||
| CVE-2026-125402 | 1 Ettercap-project | 1 Ettercap | 2026-11-09 | 8.1 High |
| Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in src/ec_sslwrap.c that trusts the unchecked 16-bit SNI length field. Network-adjacent attackers can send crafted TLS ClientHello messages during SSL interception to leak up to 64 KB of heap memory upstream or crash Ettercap. | ||||
| CVE-2026-125396 | 1 Artifex | 1 Ghostscript | 2026-11-09 | 7.8 High |
| Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code. | ||||
| CVE-2026-125395 | 1 Ampache | 1 Ampache | 2026-11-09 | 5.4 Medium |
| Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to inject script through unescaped song lyrics in LyricsView.php getLyrics() and show_lyrics.inc.php. Attackers can upload a song whose lyrics ID3 tag contains HTML and script to execute code in the browser of any user viewing the lyrics. | ||||
| CVE-2026-125394 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 5.4 Medium |
| FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and update_gdi_mem3blt() that retain stale brush cache pointers. A malicious RDP server can resend CACHE_BRUSH to the same slot then send PATBLT, causing clients to read freed heap memory, disclosing data or crashing. | ||||
| CVE-2026-125393 | 2026-11-09 | 6.5 Medium | ||
| MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that allows authenticated users to overflow a fixed 0x400-byte heap buffer. Attackers can supply an X-FB-USER address longer than about 1016 bytes, which is formatted without a length check, to crash the IMAP service and cause denial of service. | ||||
| CVE-2026-125392 | 1 Webmin | 1 Webmin | 2026-11-09 | 5.4 Medium |
| Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS record values without HTML escaping in ALL view mode. Delegated zone users such as Virtualmin domain owners can store record values containing script that executes in an administrator's browser when viewing zone records. | ||||
| CVE-2026-125391 | 1 Webmin | 1 Webmin | 2026-11-09 | 7.2 High |
| Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated Samba user maintainers to inject commands via unvalidated opts parameter. Attackers can embed shell metacharacters in account option flags passed by create_user and modify_user to backquote_logged, executing commands as root. | ||||
| CVE-2026-125390 | 1 Intermesh | 1 Group-office | 2026-11-09 | 6.5 Medium |
| Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in FolderController::actionProcessUploadQueue that allows authenticated users to read server files by supplying absolute paths in the blobs parameter. Attackers can have files hard-linked or copied into their own folder and downloaded, exposing other users' stored files and config.php database credentials. | ||||
| CVE-2026-125389 | 1 Intermesh | 1 Group-office | 2026-11-09 | 6.1 Medium |
| Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened. | ||||
| CVE-2026-125388 | 1 Intermesh | 1 Group-office | 2026-11-09 | 6.5 Medium |
| Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows authenticated users to download form reports via api/download.php without permission checks. Attackers can request the business/forms/report blob with a form ID to export every submission as an XLSX file, disclosing submissions they are not permitted to see. | ||||
| CVE-2026-125379 | 1 Movim | 1 Movim | 2026-11-09 | 3.1 Low |
| Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated users to read restricted posts by supplying server, node and nodeid values. Attackers who know item identifiers can retrieve cached community or contact-only posts from the pod-wide cache before the XMPP authorization check runs. | ||||
| CVE-2026-125378 | 2026-11-09 | 4.3 Medium | ||
| PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for /admin/template/<template>/apply that lets any authenticated User-role account modify shared zone templates. Attackers can replace a template's record set by name, injecting attacker-chosen NS, MX, A or CNAME records into every zone later created from it. | ||||
| CVE-2026-125375 | 1 Mrdoc | 1 Mrdoc | 2026-11-09 | 5.4 Medium |
| MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort handlers that allows registered users to modify other users' documents by supplying arbitrary document IDs in sort_data. Attackers owning any project can reparent and reorder documents by sequential ID and set their status to draft or removed, hiding published documents. | ||||
| CVE-2026-125372 | 1 Getrebuild | 1 Rebuild | 2026-11-09 | 4.3 Medium |
| REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and fetchComments that skips privilege filtering and FeedsHelper.checkReadable checks. Authenticated attackers can enumerate sequential IDs via the feeds-details and comments-list endpoints to read private or team-scoped feed content, images, attachments and comments. | ||||
| CVE-2026-125371 | 1 Tinyproxy Project | 1 Tinyproxy | 2026-11-09 | 4.8 Medium |
| Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that compares only trailing hostname characters without checking DNS label boundaries. Attackers controlling the PTR record for their source IP, such as untrusted.net, can satisfy an 'Allow trusted.net' entry to use the proxy despite deny-by-default ACLs. | ||||
| CVE-2026-125367 | 2026-11-09 | 5.4 Medium | ||
| Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up users to make the server fetch arbitrary URLs via the run SSH command. Attackers can upload a feeds digest post listing internal URLs and trigger immediate fetching through Fetcher.ParseURL to reach loopback, RFC1918, and cloud metadata endpoints. | ||||
| CVE-2026-125357 | 1 Munin-monitoring | 1 Munin | 2026-11-09 | 5.3 Medium |
| Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials. | ||||