Export limit exceeded: 416426 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 107334 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (107334 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103401 | 1 Juniper | 2 Session Smart Conductor, Session Smart Router | 2026-10-28 | 8.8 High |
| An Improper Link Resolution Before File Access ('Link Following') vulnerability in the unauthenticated web server handlers in Juniper Networks Session Smart Router and Session Smart Conductor allows a local unprivileged user to overwrite arbitrary files as root via unauthenticated API endpoints. This vulnerability can be exploited on Mist-managed routers and on unmanaged Routers that have not yet been onboarded to a Conductor. Routers already managed by Conductor are not affected. | ||||
| CVE-2026-103402 | 1 Juniper | 2 Session Smart Conductor, Session Smart Router | 2026-10-28 | 8.8 High |
| An Insufficient Verification of Data Authenticity vulnerability in PCLI in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with write access to the model cache directory to execute arbitrary code and escalate privileges via the processing of unverified cache files. | ||||
| CVE-2026-103403 | 1 Juniper | 2 Session Smart Conductor, Session Smart Router | 2026-10-28 | 8.8 High |
| An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker to perform arbitrary file deletion and arbitrary command execution via the deletion of an audit rule. | ||||
| CVE-2026-103407 | 1 Juniper | 2 Session Smart Conductor, Session Smart Router | 2026-10-28 | 8.8 High |
| An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an authenticated REST user to read, overwrite, or delete arbitrary certificate and key files on the host filesystem via the certificate and private-key REST API. | ||||
| CVE-2026-103408 | 1 Juniper | 1 Session Smart Router | 2026-10-28 | 8.8 High |
| A Stack Buffer Overflow vulnerability in the DHCP client in Juniper Networks Session Smart Router allows an unauthenticated attacker on the local network to achieve remote code execution via a malicious DHCP reply. | ||||
| CVE-2026-103411 | 1 Juniper | 1 Session Smart Router | 2026-10-28 | 7.1 High |
| An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker with local network access to cause information disclosure and a denial of service via a malicious DHCP reply. | ||||
| CVE-2026-106079 | 1 Juniper | 2 Session Smart Conductor, Session Smart Router | 2026-10-28 | 8.8 High |
| An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in AccessManager in Juniper Networks Session Smart Router and Session Smart Conductor allows an attacker with config-write privileges to achieve arbitrary command execution as root in the YANG configuration. | ||||
| CVE-2026-114596 | 1 The Epics Community | 1 Epics Base | 2026-10-28 | 8.2 High |
| In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service. | ||||
| CVE-2026-114597 | 1 The Epics Community | 1 Epics Base | 2026-10-28 | 7.5 High |
| In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. | ||||
| CVE-2026-114598 | 1 The Epics Community | 1 Epics Base | 2026-10-28 | 7.5 High |
| In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents. | ||||
| CVE-2026-108307 | 1 Tanium | 2 Endpoint Configuration Toolset Solution, Index-cx | 2026-10-28 | 7.8 High |
| Tanium addressed a heap-based buffer overflow vulnerability in Index. | ||||
| CVE-2026-87086 | 1 Tanium | 1 Provision | 2026-10-28 | 7.5 High |
| Tanium addressed a denial of service vulnerability in Provision. | ||||
| CVE-2026-108303 | 1 Tanium | 1 Certificate Manager | 2026-10-28 | 8.8 High |
| Tanium addressed an unauthorized code execution vulnerability in Certificate Manager. | ||||
| CVE-2026-112350 | 1 Sunhillo | 1 Sureline | 2026-10-28 | 7.5 High |
| Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers can use directory traversal sequences to access sensitive files such as /etc/shadow, the web user database, the root SSH private key, and the device's TLS private key, leading to full system compromise. | ||||
| CVE-2026-112351 | 1 Sunhillo | 1 Sureline | 2026-10-28 | 8.8 High |
| Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers can bypass the incomplete character denylist from the prior CVE-2021-36380 fix using URL-encoded newline (%0a) or ampersand (%26) sequences that act as command separators after decoding in the ping, nslookup, or traceroute diagnostic modes, leading to full system compromise. | ||||
| CVE-2026-58205 | 1 Jeromedevome | 1 Grr | 2026-10-28 | 8.1 High |
| GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it. This reflected cross-site scripting can enable phishing, redirection to malicious sites, cookie theft and session hijacking because the authentication cookie is not `HttpOnly`. This issue is fixed in version 4.5.0. | ||||
| CVE-2026-58257 | 1 Jeromedevome | 1 Grr | 2026-10-28 | 7.2 High |
| GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges. The advisory reports this issue as fixed in version 4.5.0. | ||||
| CVE-2026-59158 | 1 Thoda-dev | 1 Nuxt-ollama | 2026-10-28 | 7.5 High |
| Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client that fetches a page. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests. Following the documented cloud configuration is sufficient; the visible application template need not make an Ollama request for the secret to leak. A stolen key permits unauthorized cloud API requests at the operator's expense, quota or rate-limit exhaustion, and access to stored models or conversations if the key grants those permissions. This issue is fixed in version 1.3.1. | ||||
| CVE-2014-125138 | 1 C97 | 3 Cart Engine, Kemana Directory, Qengine Cms | 2026-10-28 | 8.8 High |
| C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerability in administrative image fields. Editor-role users can upload PHP scripts via the page_image or cat_image parameters to the web-accessible /public/image directory and request them to execute code on the server. | ||||
| CVE-2026-118377 | 1 Mewebstudio | 1 Pos | 2026-10-28 | 7.5 High |
| mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash(), letting attackers post tampered status, amount or order ID fields to complete orders without paying. | ||||