Export limit exceeded: 418297 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 418297 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (418297 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118251 | 1 Highcharts | 1 Highcharts | 2026-11-02 | 5.4 Medium |
| Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0. | ||||
| CVE-2026-118247 | 1 Highcharts | 3 Dashboards, Grid-pro, Highcharts | 2026-11-02 | N/A |
| Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can therefore write integer-indexed values onto Object.prototype or the Object constructor. In Dashboards releases with column aliases, a literal __proto__ ID is redirected by the alias map, while an alias targeting __proto__ reaches the unsafe write; later releases without aliases accept the unsafe ID directly. Those inherited values affect array and object reads and for-in enumeration throughout the page, which can alter application control flow or disrupt rendering. Exploitation requires control of the table or component column ID and a cell, point, or API write. This issue is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0. | ||||
| CVE-2026-118243 | 1 Highcharts | 1 Highcharts | 2026-11-02 | N/A |
| Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2. | ||||
| CVE-2026-116795 | 1 Le0pard | 1 Re2js | 2026-11-02 | 7.5 High |
| RE2JS is the JavaScript port of RE2, a regular expression engine that provides linear time matching. From 2.2.0 until 2.8.7, enabling LOOKBEHINDS and using repeated matching through matcher().find(), matchAll(), split(), or matcher().replaceAll() can cause quadratic total work. Machine.match restarts lookbehind scanning from offset zero for each requested start position, while Matcher-based APIs request capture slots that prevent the early exit used for captureless matching. Dense matches therefore repeatedly rescan the input, allowing attacker-influenced text to monopolize a single-threaded worker and deny service. This issue is fixed in version 2.8.7. | ||||
| CVE-2026-114488 | 2 Redhat, Wildfly | 8 Fuse 7, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 5 more | 2026-11-02 | 7.4 High |
| A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a pre-auth attacker on the port 3528 to impersonate any principal on every IIOP-exposed @Remote EJB. | ||||
| CVE-2026-113687 | 1 Apache | 1 Syncope | 2026-11-02 | N/A |
| Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue. | ||||
| CVE-2026-113511 | 1 Apache | 1 Syncope | 2026-11-02 | N/A |
| Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue. | ||||
| CVE-2026-110535 | 1 Apache | 1 Syncope | 2026-11-02 | N/A |
| Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue. | ||||
| CVE-2026-109083 | 1 Apache | 1 Syncope | 2026-11-02 | N/A |
| Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes. | ||||
| CVE-2026-69964 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-02 | 7 High |
| Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-51863 | 1 Eosphoros-ai | 1 Db-gpt | 2026-11-02 | 9.1 Critical |
| DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:129). A remote attacker can use the validated exploitation path to write files outside the intended workspace or storage boundary. | ||||
| CVE-2026-120066 | 1 Postgresql | 1 Psqlodbc | 2026-11-02 | 5.3 Medium |
| On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected. | ||||
| CVE-2026-69963 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-02 | 7.8 High |
| Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69867 | 2 Microsoft, Sqlite | 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more | 2026-11-02 | 7.8 High |
| Out-of-bounds read in SQLite allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69736 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-02 | 7 High |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69721 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-02 | 5.5 Medium |
| Out-of-bounds read in Windows iSCSI allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-69705 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-02 | 9.8 Critical |
| Out-of-bounds write in Windows iSCSI allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69675 | 1 Microsoft | 12 Windows Server 2012, Windows Server 2012 (server Core Installation), Windows Server 2012 R2 and 9 more | 2026-11-02 | 5.5 Medium |
| Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-115424 | 1 Redhat | 2 Openshift, Openshift Container Platform | 2026-11-02 | 5.5 Medium |
| A flaw was found in the OpenShift client oc. When extracting container image layers with oc image extract, the application fails to properly sanitize symbolic and hard link targets pointing to absolute paths or to sibling directories of the extraction destination. An attacker who supplies a malicious container image can exploit this vulnerability by embedding links, and a chained file entry, that reference locations outside the intended extraction directory. This allows the attacker to write attacker-controlled content to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially leading to file modification outside the destination directory. | ||||
| CVE-2026-118752 | 2 Danoli3, Freeimage Project | 2 Freeimage, Freeimage | 2026-11-02 | 7.8 High |
| FreeImage through 3.18.0 and the danoli3 FreeImage fork before 3.19.22 contain a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bounds checks on ByteRun1 runs. Attackers can supply a crafted IFF/LBM PBM file with runs straddling scanline ends to write up to 127 controlled bytes past the heap-allocated bitmap. | ||||