Export limit exceeded: 414012 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (414012 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-94200 | 1 Erlang | 2 Erlang/otp, Erlang\/otp | 2026-10-24 | 5.9 Medium |
| Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node. This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8. | ||||
| CVE-2026-86566 | 3 Dpdk, Red Hat, Redhat | 6 Dpdk, Enterprise Linux, Enterprise Linux and 3 more | 2026-10-24 | 6.5 Medium |
| A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. | ||||
| CVE-2026-114194 | 2 Igorfuna, Wordpress-extensions | 2 Ad Inserter, Ad Inserter | 2026-10-24 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18. | ||||
| CVE-2026-116008 | 2 Bottelet, Daybydaycrm | 2 Daybydaycrm, Daybyday Crm | 2026-10-24 | 4.3 Medium |
| DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that allows any authenticated user to reassign projects without the can-assign-new-user-to-project permission. Low-privileged employees can send PATCH or POST requests to /projects/updateassign/{external_id} with a chosen user_assigned_id to redirect project ownership and notifications. | ||||
| CVE-2026-116015 | 1 Yunaiv | 1 Yudao-cloud | 2026-10-24 | 4.3 Medium |
| yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated members to read other members' after-sale operation logs by supplying arbitrary afterSaleId values. Attackers can enumerate sequential after-sale IDs against GET /app-api/trade/after-sale-log/list to expose refund amounts, status transitions and timestamps belonging to other members. | ||||
| CVE-2026-116016 | 1 Yunaiv | 1 Yudao-cloud | 2026-10-24 | 7.1 High |
| yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope restrictions by sending a data-permission-enable header set to false. Attackers can add this header to /admin-api requests, which DataPermissionRpcWebFilter trusts, to read or modify other departments' and users' records within the same tenant. | ||||
| CVE-2026-115932 | 2026-10-24 | 9.6 Critical | ||
| When a post is published, Postiz treats a media path that is not a web address as a file on the server's disk, but it does not check that the file lies inside the upload directory. A registered user can store a crafted media path with a post, get it past the checks that normally restrict it, and have the publishing worker read an arbitrary file and send it as an attachment to a Discord server the user controls. The same unconfined reads can be reached through two further routes. One tells the caller whether a file exists and can exhaust the backend's memory, the other delivers the file the same way as the main route. Self-registration is open by default, so the attacker needs no existing account. | ||||
| CVE-2026-96300 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-24 | 5.9 Medium |
| Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-102194 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-24 | 7 High |
| Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-94512 | 1 Microsoft | 12 Microsoft Sql Server 2017 (gdr), Microsoft Sql Server 2017 For X64-based Systems \(cu31\), Microsoft Sql Server 2019 (gdr) and 9 more | 2026-10-24 | 8.8 High |
| Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-108436 | 1 Microsoft | 11 365 Apps, Microsoft 365, Microsoft Office Ltsc 2021 and 8 more | 2026-10-24 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-116020 | 1 Bookstackapp | 1 Bookstack | 2026-10-24 | 5.4 Medium |
| BookStack before 26.09.2 contains an incorrect authorization vulnerability in AttachmentController that allows authenticated users to access other users' draft page attachments by ID. Attackers with attachment permissions can enumerate sequential attachment IDs to download, rename, relink, or replace files on another user's unpublished draft pages. | ||||
| CVE-2026-116019 | 1 Getgrav | 1 Grav | 2026-10-24 | 8.8 High |
| Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree. | ||||
| CVE-2026-116018 | 2026-10-24 | 4.3 Medium | ||
| ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices. | ||||
| CVE-2026-116017 | 2026-10-24 | 4.3 Medium | ||
| Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs. | ||||
| CVE-2026-116014 | 1 Open62541 | 1 Open62541 | 2026-10-24 | 8.1 High |
| open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the 16-bit memSize field for large custom structure definitions. A malicious OPC UA server can supply DataType definitions via UA_Client_getRemoteDataTypes(), causing decodeBinaryStructure() to overflow the heap, crashing clients or enabling code execution. | ||||
| CVE-2026-116013 | 2026-10-24 | 3.7 Low | ||
| OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and _decode_name() that fails to check resource record lengths against the received message. Attackers controlling or spoofing a queried nameserver can send truncated record headers or RDATA, raising uncaught Lua exceptions in resolver:query() that abort requests and break name resolution. | ||||
| CVE-2026-116012 | 1 Nsa | 1 Ghidra | 2026-10-24 | 3.6 Low |
| Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and skipAttributeRemaining in marshal.cc that stores 64-bit string lengths in 32-bit variables. Attackers can supply a crafted packed stream, such as a malicious .sla file, to inject attributes into the decompiler's input or crash the decompiler process. | ||||
| CVE-2026-116011 | 1 Crowcpp | 1 Crow | 2026-10-24 | 7.5 High |
| Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote unauthenticated attackers to crash the server by sending deeply nested JSON. Attackers can send a request body with thousands of nested objects to exhaust the worker thread stack, terminating the process and dropping all connections. | ||||
| CVE-2026-116010 | 1 Rosariosis | 1 Rosariosis | 2026-10-24 | 4.3 Medium |
| RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students outside their course period by supplying arbitrary student IDs. Attackers can modify the st_arr, values, or attendance POST arrays in MakeReferral.php, EnterEligibility.php, InputFinalGrades.php, and TakeAttendance.php to create referrals, eligibility codes, attendance and final grades for any student in the school. | ||||