Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423918 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423918 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123961 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-09 | 9.9 Critical |
| A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2026-123957 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-09 | 9.9 Critical |
| A vulnerability was determined in TOTOLINK CA300-PoE 6.2c.884. Impacted is the function setIpQosRules of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument ipStart causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-123614 | 2 Evilmartians, Imgproxy | 2 Imgproxy, Imgproxy | 2026-11-09 | 9.8 Critical |
| imgproxy from 4.0.0 before 4.0.16 contains an integer overflow in the ICO loader that allows remote attackers to trigger a heap buffer overflow via a crafted data_size value. Attackers can submit a crafted ICO image whose data_size wraps the allocation in vips/icoload.c, corrupting heap memory to crash the process or achieve code execution. | ||||
| CVE-2026-123566 | 1 Svelte | 1 Devalue | 2026-11-09 | 7.5 High |
| Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop. | ||||
| CVE-2026-123562 | 1 Svelte | 1 Devalue | 2026-11-09 | 7.5 High |
| devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process. | ||||
| CVE-2026-123558 | 1 Zfnd | 1 Zebra | 2026-11-09 | 7.5 High |
| Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifier rejecting honest blocks until restart. | ||||
| CVE-2026-123554 | 1 Zfnd | 1 Zebra | 2026-11-09 | 7.5 High |
| Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because Transaction::coinbase_spend_restriction() rebuilds the transaction's output list once per spent outpoint. Any connected peer can repeatedly send unsigned transactions with many transparent inputs and outputs, which are rejected without a misbehavior score, to pin verification threads. | ||||
| CVE-2026-123550 | 1 Openidentityplatform | 1 Openam | 2026-11-09 | 9.8 Critical |
| OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP (PAOS) and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions as any mapped user, including administrators, and hijack single sign-on to dependent applications. | ||||
| CVE-2026-123546 | 1 Openidentityplatform | 1 Openam | 2026-11-09 | 6.1 Medium |
| OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to control post-login and logout destinations via the goto and gotoOnFail parameters. Attackers can craft OpenAM login or logout links that redirect victims to phishing sites or run script in the XUI to steal session cookies. | ||||
| CVE-2026-123542 | 1 Openidentityplatform | 1 Openam | 2026-11-09 | 6.8 Medium |
| OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code verifier when device codes are exchanged for tokens. Attackers who obtain an approved device code from client logs or shared device storage can redeem it for access and ID tokens to impersonate the user. | ||||
| CVE-2026-123538 | 1 Openidentityplatform | 1 Openam | 2026-11-09 | 6.6 Medium |
| OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as its issuer, accepting a signature from any certificate in OpenAM's keystore. An attacker holding such a private key, such as a trusted SAML 1.x partner, can forge assertions claiming another partner's issuer and sign in as that partner's users, including privileged ones. | ||||
| CVE-2026-123534 | 1 Tornadoweb | 1 Tornado | 2026-11-09 | 6.5 Medium |
| Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows attackers to hash files outside static_path using ../ sequences. Attackers controlling input passed to static_url() can obtain SHA-512 hashes of readable files to confirm their existence, or reference /dev/zero to block the event loop indefinitely. | ||||
| CVE-2026-123526 | 1 Vikunja | 1 Vikunja | 2026-11-09 | 5.4 Medium |
| Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login. | ||||
| CVE-2026-123522 | 1 Vikunja | 1 Vikunja | 2026-11-09 | 7.1 High |
| Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications. | ||||
| CVE-2026-123518 | 2 Go-vikunja, Vikunja | 2 Vikunja, Vikunja | 2026-11-09 | 4.3 Medium |
| Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users with write access to two projects can move a task into another project's kanban bucket. This persists cross-project task_buckets rows that count toward bucket limits and, for done buckets, toggle the task's done state. | ||||
| CVE-2026-123514 | 1 Vikunja | 1 Vikunja | 2026-11-09 | 4.3 Medium |
| Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely. | ||||
| CVE-2026-123510 | 1 Vikunja | 1 Vikunja | 2026-11-09 | 3.3 Low |
| Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log. | ||||
| CVE-2026-123506 | 1 Vikunja | 1 Vikunja | 2026-11-09 | 5.4 Medium |
| Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks. | ||||
| CVE-2026-123502 | 1 Vikunja | 1 Vikunja | 2026-11-09 | 5.2 Medium |
| Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission. | ||||
| CVE-2026-123498 | 1 Vikunja | 1 Vikunja | 2026-11-09 | 3.7 Low |
| Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands. | ||||