Export limit exceeded: 417050 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 107555 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (107555 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119129 | 1 Zitadel | 1 Zitadel | 2026-10-29 | 8.1 High |
| ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's user code to obtain the victim's tokens, and can bypass project access settings via the OIDC device authorization API. | ||||
| CVE-2026-119052 | 2 Ggml, Ggml-org | 2 Llama.cpp, Llama.cpp | 2026-10-29 | 7.5 High |
| llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows unauthenticated remote attackers to crash the rpc-server by sending oversized message lengths. After the HELLO handshake, attackers can send a command such as SET_TENSOR with a length above std::vector::max_size(), triggering an uncaught std::length_error that aborts the process and denies service to all clients. | ||||
| CVE-2026-119027 | 2026-10-29 | 7.5 High | ||
| oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying a crafted servers[].x-go-name value emitted unescaped by the server-urls template. Attackers who control an OpenAPI document can define an injected func init() that executes when the victim builds and imports the generated package. | ||||
| CVE-2026-118804 | 2026-10-29 | 7.5 High | ||
| Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted post content by submitting crafted post_status and post_type values in the originalQueryVars parameter to the POST /wp-json/bricks/v1/query_result REST endpoint using a publicly obtainable nonce. Attackers can set post_status to draft or private, or post_type to shop_coupon, to disclose unpublished posts, private content, and WooCommerce coupon data that is otherwise blocked by the standard WordPress REST API routes. | ||||
| CVE-2026-83647 | 1 Microsoft | 27 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 24 more | 2026-10-29 | 7.5 High |
| Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-118755 | 2 Personal-management-system, Volmarg | 2 Personal Management System, Personal Management System | 2026-10-29 | 7.2 High |
| Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute shell commands via unescaped folder paths in the storage module's tree command. Attackers can create a directory under upload/files containing shell metacharacters such as $(...) and then move or copy it, running commands as the web server user. | ||||
| CVE-2026-118694 | 1 Python-markdown2 Project | 1 Python-markdown2 | 2026-10-29 | 7.5 High |
| python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown with unclosed inline link destinations. Attackers can submit repeated '[a](' or '![a](' sequences, causing _find_balanced to rescan the remaining document for each link and consume quadratic CPU time. | ||||
| CVE-2026-118660 | 1 Capricorn86 | 1 Happy-dom | 2026-10-29 | 8.6 High |
| Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. Prior to 21.0.0, Happy DOM loads iframe src URLs and link rel="stylesheet" href URLs by default while parsing untrusted HTML on the server because disableIframePageLoading and disableCSSFileLoading default to false. An attacker who controls parsed HTML can therefore cause server-side requests to arbitrary internal or cloud endpoints without an application opt-in and may expose confidential responses or credentials returned by those endpoints. This issue is fixed in version 21.0.0. | ||||
| CVE-2026-118080 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | ||||
| CVE-2026-118075 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | ||||
| CVE-2026-116867 | 2026-10-29 | 8.8 High | ||
| Contributor PHP Object Injection in Dynamic QR Code – generator <= 1.0.1 versions. | ||||
| CVE-2026-114621 | 1 Baserproject | 1 Basercms | 2026-10-29 | 8.8 High |
| baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths. Setting USE_CORE_ADMIN_API to false does not prevent access through an authenticated browser session. This issue has been patched in versions 5.3.2 and 5.4.2. | ||||
| CVE-2026-110688 | 1 Rurban | 1 Cpanel::json::xs | 2026-10-29 | 7.5 High |
| Cpanel::JSON::XS versions from 4.51 before 4.80 for Perl allow quadratic CPU use by revalidating the remaining buffer per value in incr_parse. At the first non-ASCII byte in a string, the decoder validates UTF-8 from there to the end of its input. incr_parse decodes each buffered value with a fresh decoder, so every value revalidates the rest of the buffer, and doubling the input quadruples the work. A peer that sends about a megabyte of ordinary non-ASCII JSON in one read ties up the process for seconds of CPU time. | ||||
| CVE-2026-110687 | 1 Rurban | 1 Cpanel::json::xs | 2026-10-29 | 7.5 High |
| Cpanel::JSON::XS versions from 4.43 before 4.80 for Perl misorder byte-string keys during canonical encoding in utf16_cmp. canonical sorts keys by UTF-16 code units. When any key in a hash is UTF-8 flagged, every key is decoded as UTF-8 for the comparison, including byte-string keys that the encoder writes out as Latin-1 characters. A byte-string key whose bytes are valid UTF-8 is sorted out of order, and two keys that encode differently can compare equal and are left in hash order. The same data can encode to different canonical documents across processes. | ||||
| CVE-2026-110244 | 1 Ibm | 1 Langflow Oss | 2026-10-29 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-108088 | 1 Apache | 1 Cocoon | 2026-10-29 | 7.5 High |
| ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-104328 | 1 Ibm | 1 Langflow Oss | 2026-10-29 | 8.8 High |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-103092 | 1 Ibm | 1 Langflow Oss | 2026-10-29 | 8.5 High |
| IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to execute arbitrary SQL commands due to improper access control. | ||||
| CVE-2026-83918 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7.8 High |
| Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83919 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7.8 High |
| Heap-based buffer overflow in Microsoft Internet Messaging API allows an authorized attacker to execute code locally. | ||||