Export limit exceeded: 419069 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419069 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118624 | 2026-11-03 | N/A | ||
| MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of MLflow. Authentication is required to exploit this vulnerability. The specific flaw exists within the _find_validator function. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this vulnerability to disclose information in the context of the service account. Was ZDI-CAN-31894. | ||||
| CVE-2026-118623 | 2026-11-03 | N/A | ||
| MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MLflow. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of pickle files. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29513. | ||||
| CVE-2026-121589 | 1 Spatie | 1 Url-signer | 2026-11-03 | 5.3 Medium |
| A weakness has been identified in spatie url-signer up to 2.1.3. Affected is the function AbstractUrlSigner::validate of the file AbstractUrlSigner.php of the component URL Validation. This manipulation of the argument expires causes incorrect type conversion. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.1.4 is able to address this issue. Patch name: 86af3355388210668f6bfbe9007bd6545d4942ad. It is recommended to upgrade the affected component. | ||||
| CVE-2026-95764 | 2026-11-03 | 5.7 Medium | ||
| An improper certificate validation vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated adjacent attacker to access sensitive information. | ||||
| CVE-2026-95766 | 2026-11-03 | 5.3 Medium | ||
| Sensitive information disclosure vulnerabilities in HPE Networking Fabric Composer could allow an authenticated attacker with low privileges to access sensitive information. Successful exploitation could allow an attacker to disclose sensitive information. | ||||
| CVE-2026-95767 | 2026-11-03 | 5.3 Medium | ||
| An unauthenticated information disclosure vulnerability exists in the API of HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information about the affected system. | ||||
| CVE-2026-95768 | 2026-11-03 | 5.3 Medium | ||
| A privilege escalation vulnerability exists in the API of HPE Networking Fabric Composer if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an authenticated low-privileged remote attacker to obtain sensitive information from the affected system. | ||||
| CVE-2026-95770 | 2026-11-03 | 4.7 Medium | ||
| A sensitive information disclosure vulnerability in the underlying operating system of HPE Networking Fabric Composer could allow an authenticated low-privileged user with local access to view sensitive information, if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to obtain sensitive information from the affected system. | ||||
| CVE-2026-95773 | 2026-11-03 | 3.8 Low | ||
| A denial-of-service vulnerability has been identified in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a low-privileged local attacker to cause a partial denial-of-service condition affecting other workloads on the same host. | ||||
| CVE-2026-95774 | 2026-11-03 | 3.7 Low | ||
| A sensitive information disclosure vulnerability exists in HPE Networking Fabric Composer. Successful exploitation could allow an unauthenticated remote attacker to obtain sensitive information from the affected system. | ||||
| CVE-2026-95775 | 2026-11-03 | 3.3 Low | ||
| A local information disclosure vulnerability exists in the underlying operating system of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged local attacker to read certain files on the underlying operating system. | ||||
| CVE-2026-95776 | 2026-11-03 | 3.1 Low | ||
| An authenticated path traversal vulnerability exists in the API of HPE Networking Fabric Composer, which could be exploited by an authenticated low-privileged user if certain preconditions outside of the attacker's control are met. Successful exploitation could allow an attacker to read certain files on the underlying operating system. | ||||
| CVE-2026-95777 | 2026-11-03 | 3.1 Low | ||
| A sensitive information disclosure vulnerability exists in the management interface of HPE Networking Fabric Composer. Successful exploitation could allow a low-privileged attacker to obtain certain sensitive information stored on the affected system. | ||||
| CVE-2026-95722 | 2026-11-03 | 8.8 High | ||
| A local privilege escalation vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a local attacker with low privileges to execute arbitrary commands with elevated privileges on the underlying operating system. | ||||
| CVE-2026-95723 | 2026-11-03 | 8.4 High | ||
| A missing integrity verification vulnerability has been discovered in the Virtual Intranet Access (VIA) client. Successful exploitation of this vulnerability could allow a low-privileged local attacker to execute arbitrary code with elevated privileges on the underlying operating system. | ||||
| CVE-2026-95724 | 2026-11-03 | 8.1 High | ||
| An improper certificate validation vulnerability exists in HPE Networking Virtual Intranet Access (VIA). Successful exploitation could allow an unauthenticated remote attacker to bypass authentication mechanisms, leading to the possible disclosure of sensitive information. | ||||
| CVE-2026-95725 | 2026-11-03 | 7.8 High | ||
| A command injection vulnerability exists in the VIA client for Linux. Successful exploitation could allow a low-privileged local attacker to execute arbitrary commands with elevated privileges on the affected system. | ||||
| CVE-2026-95726 | 2026-11-03 | 7.5 High | ||
| A buffer overflow vulnerability in HPE Networking VIA could allow an unauthenticated remote attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to interrupt the normal operation of the affected client. | ||||
| CVE-2026-95728 | 2026-11-03 | 7.1 High | ||
| An arbitrary file write vulnerability exists in the Virtual Intranet Access (VIA) client. Successful exploitation could allow a local attacker with low privileges to escalate privileges on the affected system. | ||||
| CVE-2026-121232 | 1 Google | 1 Chrome | 2026-11-03 | N/A |
| Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. (Chromium security severity: Low) | ||||