Export limit exceeded: 424760 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424760 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424760 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-125383 | 1 Go2ismail | 1 Asp.net-core-inventory-order-management-system | 2026-11-10 | 9.8 Critical |
| INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass vulnerability caused by a hard-coded JWT signing key, issuer and audience in appsettings.json. Unauthenticated remote attackers can forge tokens for any user ID and role that the Tokens/DI.cs validator trusts, gaining administrator access to the entire API. | ||||
| CVE-2026-125385 | 1 Go2ismail | 1 Asp.net-core-inventory-order-management-system | 2026-11-10 | 6.5 Medium |
| INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json. | ||||
| CVE-2026-125397 | 1 Nocobase | 1 Nocobase | 2026-11-10 | 7.1 High |
| NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee() that lets authenticated users access unassigned AI employees by overriding the role-derived filter with a supplied username. Attackers can use the dispatch-sub-agent-task tool to run ungranted AI employees with their tools and permissions, and get-ai-employee to read their prompts and tool configuration. | ||||
| CVE-2026-125087 | 1 Michael-a-kuykendall | 1 Shimmy | 2026-11-10 | 7.3 High |
| A vulnerability was found in Michael-A-Kuykendall Shimmy up to 2.6.4. The affected element is an unknown function of the file src/server.rs of the component Inference API. Performing a manipulation results in missing authentication. The attack is possible to be carried out remotely. Upgrading to version 2.6.5 is sufficient to fix this issue. The patch is named 3f2ee748c02eeb229987913fe289a2ed9a24595d. You should upgrade the affected component. | ||||
| CVE-2026-123439 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123438 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123437 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123435 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123432 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123431 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123430 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123429 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123427 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123426 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123425 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-123424 | 2026-11-10 | N/A | ||
| This CVE ID has been rejected as a duplicate. | ||||
| CVE-2026-125086 | 1 D-link | 1 M60 | 2026-11-10 | 10 Critical |
| A vulnerability has been found in D-Link M60 1.12.B01. Impacted is the function system of the file /etc/emDaemon/mosquitto.conf of the component emDaemon MQTT Broker. Such manipulation leads to hard-coded credentials. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-125205 | 1 Ffmpeg | 1 Ffmpeg | 2026-11-10 | 5.5 Medium |
| FFmpeg through 9.0.2 contains an unbounded memory allocation vulnerability in the av1_frame_merge bitstream filter that allows attackers to exhaust memory by never sending a temporal delimiter OBU. Attackers can supply a crafted .obu file opened by the AV1 OBU or Annex B demuxers, forcing unlimited OBU buffering per temporal unit and causing denial of service. | ||||
| CVE-2026-113960 | 1 Apple | 4 Ios And Ipados, Macos, Visionos and 1 more | 2026-11-10 | N/A |
| This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 26.7.3 and iPadOS 26.7.3, iOS 27.2.1 and iPadOS 27.2.1, macOS Golden Gate 27.2.1, macOS Sequoia 15.8.3, macOS Tahoe 26.7.3, visionOS 27.2.1, watchOS 27.2.1. A user added to an iMessage group may be able to access messages sent before they joined. | ||||
| CVE-2026-89119 | 2026-11-10 | 9.6 Critical | ||
| SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a full compromise of the underlying operating system, resulting in a high impact on confidentiality, integrity, and availability. | ||||