Export limit exceeded: 421276 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 109251 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (109251 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121580 | 1 Devolutions | 1 Server | 2026-11-06 | 8.1 High |
| Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request. | ||||
| CVE-2026-120733 | 1 Devolutions | 1 Server | 2026-11-06 | 7.5 High |
| Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user. | ||||
| CVE-2026-12080 | 2 Qemu, Redhat | 5 Qemu, Enterprise Linux, Enterprise Linux Nvidia and 2 more | 2026-11-06 | 7.3 High |
| A flaw was found in the QEMU Guest Agent (qga). A local unprivileged user can exploit a vulnerability in the guest-ssh-add-authorized-keys command handler by manipulating symbolic links. This can occur either through a deterministic directory-symlink bypass or a Time-of-Check to Time-of-Use (TOCTOU) file-symlink race. Successful exploitation allows the attacker to gain ownership of arbitrary root-owned files or directories, leading to root access. This vulnerability requires an external management layer (e.g., libvirt) to trigger the affected code path. | ||||
| CVE-2026-101551 | 1 Oracle | 1 Applications Manager | 2026-11-06 | 7.5 High |
| Vulnerability in the Oracle Applications Manager product of Oracle E-Business Suite (component: Oracle Diagnostics Interfaces). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Applications Manager. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Applications Manager accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). | ||||
| CVE-2026-65059 | 1 Tokuhirom | 1 Furl | 2026-11-06 | 7.5 High |
| Furl versions through 3.15 for Perl allow memory exhaustion via unbounded decompression of HTTP responses. Furl inflates a response body sent with a gzip, x-gzip or deflate Content-Encoding and appends the output to the response string with no size limit. It does this whether or not the request asked for compression, and no option caps the decompressed size. Responses read with write_file or write_code are streamed rather than held in memory. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust the client's memory and end the process. | ||||
| CVE-2026-50240 | 1 Redhat | 5 Openshift Builds, Openshift Devspaces, Openshift Pipelines and 2 more | 2026-11-06 | 8.8 High |
| A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces. | ||||
| CVE-2026-123791 | 1 Openbmb | 1 Internet Of Agents | 2026-11-06 | 7.3 High |
| A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function _primary_field_query of the file common/utils/milvus_utils.py of the component Agent Registry. The manipulation of the argument key results in improper neutralization of special elements in data query logic. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-101585 | 1 Oracle | 1 Helidon | 2026-11-06 | 7.2 High |
| Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-cors). Supported versions that are affected are 3.0.0-3.2.21. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. While the vulnerability is in Helidon, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Helidon accessible data as well as unauthorized read access to a subset of Helidon accessible data. CVSS 3.1 Base Score 7.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). | ||||
| CVE-2026-112541 | 1 Apple | 1 Macos | 2026-11-06 | 7.8 High |
| A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to gain root privileges. | ||||
| CVE-2026-112502 | 1 Apple | 1 Macos | 2026-11-06 | 7.5 High |
| A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause a denial-of-service. | ||||
| CVE-2026-117068 | 1 Openairinterface | 1 Oai-cn5g-amf | 2026-11-06 | 7.5 High |
| An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash. | ||||
| CVE-2026-120627 | 1 Private Internet Access | 1 Firefox Extension | 2026-11-06 | 7.5 High |
| The Private Internet Access Extension for Firefox contains an unguarded onAuthRequired authentication handler, leading to leakage of PIA proxy credentials when a user visits any malicious website that issues a Basic auth challenge. This issue was fixed in version 3.2.5, but reintroduced in later versions. | ||||
| CVE-2026-58968 | 1 Google | 1 Android | 2026-11-06 | 8.4 High |
| In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. | ||||
| CVE-2026-16305 | 1 Infinitt Healthcare | 1 System Manager | 2026-11-06 | 7.8 High |
| Local privilege escalation in `SmartUpdate.exe` and `SmartExecute.exe` in INFINITT Healthcare Co., Ltd. INFINITT PACS allows a local low-privileged attacker to execute arbitrary commands with administrator privileges via modification of a world-writable `execlist.txt` command manifest that is processed during application updates. | ||||
| CVE-2026-89295 | 2026-11-06 | 7.5 High | ||
| In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the client-supplied count parameter of the GET /api/v1/IdGenerator/submodelIds/{count} and GET /api/v2/IdGenerator/submodelIds/{count} endpoints is not enforced. The service generates and retains identifiers in memory before returning a response. A remote unauthenticated attacker can submit a large count to cause excessive memory consumption, potentially resulting in denial of service. Exploitation requires network access to the endpoint and successful retrieval of the ID-generation configuration from the configured backend repository. | ||||
| CVE-2026-82308 | 1 Sonicwall | 1 Sonicos | 2026-11-06 | 7.5 High |
| A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service. | ||||
| CVE-2026-65960 | 1 Cilium | 1 Tetragon | 2026-11-06 | 8.8 High |
| Tetragon is an eBPF-based security observability and runtime enforcement project. Versions before 1.7.0 can use a Helm default that exposes the privileged Tetragon gRPC API through an unauthenticated TCP listener on localhost:54321. An attacker who can run or compromise same-node hostNetwork pods can reach the listener and invoke privileged methods without authentication. These methods can add, delete, or reconfigure tracing policies and change debug settings, potentially resulting in privilege escalation or container escape. Version 1.7.0 changes the default endpoint to a Unix-domain socket. Deployments that do not expose an unauthenticated TCP listener are not affected. | ||||
| CVE-2026-102344 | 1 Kunchenguid | 1 Lavish-axi | 2026-11-06 | 8.1 High |
| Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43. | ||||
| CVE-2026-123993 | 1 Hisense | 1 Vidaa | 2026-11-06 | 8.8 High |
| Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability where a QA build of the Google Cobalt browser engine exposes the WebDriver automation server on TCP port 4444 across all network interfaces without any authentication or pairing requirement. A LAN-adjacent attacker can connect to the exposed WebDriver service to execute arbitrary JavaScript, read and exfiltrate sensitive localStorage data including ACR telemetry, MAC addresses, ad-service credentials, and location data, inject persistent content onto the display, and access the window.hisense native bridge to perform filesystem read/write and system-state operations. | ||||
| CVE-2026-121451 | 1 Amir1376 | 1 Ab-download-manager | 2026-11-06 | 8.8 High |
| AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login. | ||||