Export limit exceeded: 420306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420306 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107903 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-11-05 | 8.3 High |
| Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0 | ||||
| CVE-2026-94395 | 1 Thalesgroup | 1 Safenet Authentication Client Sis Token Engine | 2026-11-05 | 6.8 Medium |
| A stack-based buffer overflow in Thales SafeNet Authentication Client (SAC) SIS token engine processing can be triggered by a malicious physical or software-emulated smart card. The issue can occur before authentication or PIN entry and may cause a denial of service or potentially arbitrary code execution with the privileges of the affected process. Affected releases start with SAC 10.8 R7 and include SAC 10.9 R3 GA (build 10.9.7449). | ||||
| CVE-2026-61649 | 1 Suitecrm | 1 Suitecrm | 2026-11-05 | 7.7 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the SSRF protection added in 7.15.1 uses a substring comparison in isSelfRequest() rather than hostname equality. The affected flow begins at validate_external_host() and uses isSelfRequest(), and stripos() to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated attacker can place the server hostname in a URL path to bypass IP validation and direct server-side requests to internal services. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-123200 | 2026-11-05 | 7.5 High | ||
| VRPN through 07.36 contains an out-of-bounds stack write vulnerability in vrpn_Endpoint::handle_sender_message() and handle_type_message() that allows unauthenticated remote peers to write outside a stack buffer via an unchecked length index. Attackers can connect, complete the version-cookie exchange, and send a SENDER_DESCRIPTION or TYPE_DESCRIPTION message with an out-of-range or negative index to crash the process. | ||||
| CVE-2026-69137 | 1 Suitecrm | 1 Suitecrm | 2026-11-05 | 7.7 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the CalendarAccount testConnection action passes an authenticated caller's server_url directly to curl without host, address, or scheme validation. The affected flow begins at CalendarAccount::action_testConnection and uses server_url, CalDAVProvider::makeCalDAVRequest(), and PROPFIND to carry attacker-controlled data or authorization state into the security-sensitive operation. The server sends a PROPFIND request from its network context and returns non-success response bodies, enabling internal-service access, partial response disclosure, service enumeration, and possible cloud metadata access. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-100364 | 1 Suitecrm | 1 Suitecrm | 2026-11-05 | 7.1 High |
| SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Prior to 7.15.2 and 8.10.2, the V8 JSON:API update path fails to remove the id attribute before assigning user-supplied attributes to a SugarBean. The affected flow begins at updateRecord() and uses processAttributes(), id, and ACL_ALLOW_OWNER to carry attacker-controlled data or authorization state into the security-sensitive operation. An authenticated user can substitute a victim record identifier, bypass owner-only authorization, overwrite another record, and hijack record ownership. This issue is fixed in versions 7.15.2 and 8.10.2. | ||||
| CVE-2026-123273 | 1 Imagemagick | 1 Imagemagick | 2026-11-05 | 6.5 Medium |
| ImageMagick before 7.1.2-35 and 6.9.13-60 contains an infinite loop vulnerability in the SVG decoder because QueueAuthenticPixelCacheNexus in MagickCore/cache.c fails to validate requested region width and height. Attackers can supply a crafted SVG image that repeatedly requests a non-advancing pixel region, consuming CPU and hanging the decoding worker. | ||||
| CVE-2026-112441 | 1 Apple | 1 Macos | 2026-11-05 | 3.3 Low |
| This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to access sensitive user data. | ||||
| CVE-2026-112442 | 1 Apple | 1 Macos | 2026-11-05 | 4.7 Medium |
| A race condition was addressed with additional validation. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system. | ||||
| CVE-2026-116668 | 1 Tanium | 1 Discover | 2026-11-05 | 4.3 Medium |
| Tanium addressed an uncontrolled resource consumption vulnerability in Discover. | ||||
| CVE-2026-116666 | 1 Tanium | 1 Discover | 2026-11-05 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Discover. | ||||
| CVE-2026-116664 | 1 Tanium | 1 Discover | 2026-11-05 | 3.1 Low |
| Tanium addressed an improper access controls vulnerability in Discover. | ||||
| CVE-2026-116669 | 1 Tanium | 1 Discover | 2026-11-05 | 6.5 Medium |
| Tanium addressed an improper access controls vulnerability in Discover. | ||||
| CVE-2026-116667 | 1 Tanium | 1 Discover | 2026-11-05 | 4.2 Medium |
| Tanium addressed an improper access controls vulnerability in Discover. | ||||
| CVE-2026-116665 | 1 Tanium | 1 Discover | 2026-11-05 | 4.3 Medium |
| Tanium addressed an information disclosure vulnerability in Discover. | ||||
| CVE-2026-116648 | 1 Tanium | 1 Discover | 2026-11-05 | 4.1 Medium |
| Tanium addressed an improper output sanitization vulnerability in Discover. | ||||
| CVE-2026-42169 | 2 Gimp, Redhat | 6 Gimp, Enterprise Linux, Enterprise Linux Eus and 3 more | 2026-11-05 | 7.3 High |
| A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the `fcTL` width exceeds the `IHDR` width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the `load_layer()` function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution. | ||||
| CVE-2026-4271 | 2 Gnome, Redhat | 4 Libsoup, Enterprise Linux, Enterprise Linux Eus and 1 more | 2026-11-05 | 5.3 Medium |
| A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS). | ||||
| CVE-2026-101446 | 1 Oracle | 2 Siebel Crm, Siebel Crm Cloud Applications | 2026-11-05 | 9.9 Critical |
| Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Siebel CRM Cloud Applications. While the vulnerability is in Siebel CRM Cloud Applications, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Siebel CRM Cloud Applications. CVSS 3.1 Base Score 9.9 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). | ||||
| CVE-2026-101274 | 1 Pretix | 1 Pretix | 2026-11-05 | N/A |
| When pretix is used as the identity provider in a Single-Sign-On (SSO) setup for customer accounts, the system did not properly validate the `response_type` requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to only allow the `code` response type, which requires knowledge of the client secret to use and would wrongfully send a response type like `id_token`, it would receive back a valid token. Exploiting this requires the attacker to run JavaScript on the page specified by `redirect_uri`, which must be from a list specified in the client configuration. | ||||