Export limit exceeded: 410942 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410942 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410942 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-103850 | 1 Adobe | 1 Substance 3d Stager | 2026-10-19 | 5.5 Medium |
| Substance3D - Stager is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103852 | 1 Adobe | 1 Substance 3d Stager | 2026-10-19 | 5.5 Medium |
| Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-76519 | 1 Cisco | 8 Asyncos, Secure Email, Secure Email Gateway C195 and 5 more | 2026-10-19 | 9.8 Critical |
| A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system. This vulnerability is due to improper handling of email attachments when the file reputation service is enabled. An attacker could exploit this vulnerability by sending an email that contains a crafted attachment through an affected device. A successful exploit could allow the attacker to write arbitrary files and execute commands with root privileges on the underlying operating system. | ||||
| CVE-2026-77564 | 1 Siderolabs | 1 Talos Linux | 2026-10-19 | 3.3 Low |
| Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field from resources/registryconfigs.cri.talos.dev.yaml and sensitive content from etcfilespecs.files.talos.dev.yaml in generated support bundles instead of marking or redacting those resources. An operator who shares a bundle with an unintended party can therefore disclose private registry authentication parameters, with impact depending on the registry's network exposure and credential privileges. Talos 1.14 and later encrypt support bundles by default, which reduces but does not replace the need for redaction. This issue is fixed in versions 1.12.9 and 1.13.3. | ||||
| CVE-2026-39993 | 1 Qnap | 1 Download Station | 2026-10-19 | N/A |
| A relative path traversal vulnerability has been reported to affect Download Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Download Station 5.10.2.313 and later Download Station 5.11.3.322 and later | ||||
| CVE-2026-41544 | 1 Qnap Systems | 1 Qcalagent | 2026-10-19 | N/A |
| A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later | ||||
| CVE-2026-76182 | 1 Eclipse | 1 Jetty | 2026-10-19 | 5.3 Medium |
| In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`. | ||||
| CVE-2026-76184 | 1 Eclipse | 1 Jetty | 2026-10-19 | 5.9 Medium |
| In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an evil application deployed on the same domain as the target. | ||||
| CVE-2026-77711 | 1 Eclipse | 1 Jetty | 2026-10-19 | 7.5 High |
| When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials. | ||||
| CVE-2026-110924 | 2 Openssh, Redhat | 6 Openssh, Enterprise Linux, Hardened Images and 3 more | 2026-10-19 | 4.8 Medium |
| A flaw was found in OpenSSH. With GSSAPI authentication enabled, a failed GSSAPI attempt can leave delegated credentials stored for the connection even though user authorization did not succeed. A later successful login on that connection is not authorized by the leftover state. | ||||
| CVE-2026-84020 | 1 Microsoft | 16 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 13 more | 2026-10-19 | 7 High |
| Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-103508 | 1 Perforce | 1 Helix Core | 2026-10-19 | N/A |
| P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier. Perforce resolved it in 2026.4.3. | ||||
| CVE-2026-106150 | 1 Progress | 1 Kendo Ui For Jquery | 2026-10-19 | 5.4 Medium |
| In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data. | ||||
| CVE-2026-92707 | 1 Messagepack | 1 Messagepack-csharp | 2026-10-19 | 5.3 Medium |
| MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9. | ||||
| CVE-2026-104828 | 1 Htmlunit | 1 Htmlunit-neko | 2026-10-19 | 7.2 High |
| HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable raw-text elements are decoded by the parser and then emitted as raw markup by printCharacters(), changing the document's semantics. Applications that use htmlunit-neko in an HTML sanitizer, content filter, or other parse-transform-serialize pipeline can therefore turn attacker-controlled encoded text into executable markup when the output is rendered by a browser. This issue is fixed in version 5.4.0. | ||||
| CVE-2026-111234 | 1 Simplepie | 1 Simplepie | 2026-10-19 | 5.9 Medium |
| SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process. | ||||
| CVE-2026-110253 | 2 Boldgrid, Wordpress-extensions | 2 Weforms, Weforms | 2026-10-19 | 5.4 Medium |
| The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering. | ||||
| CVE-2026-110889 | 2 Gantry, Wordpress-extensions | 2 Gantry 5 Framework, Gantry 5 Framework | 2026-10-19 | 7.5 High |
| Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows Retrieve Embedded Sensitive Data.This issue affects Gantry 5 Framework: from n/a through 5.6.4. | ||||
| CVE-2026-87844 | 2 Pickplugins, Wordpress-extensions | 2 Product Designer For Woocommerce, Product Designer | 2026-10-19 | 5.3 Medium |
| The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones, and it does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site. | ||||
| CVE-2026-98826 | 1 Linux | 1 Linux Kernel | 2026-10-19 | 4.7 Medium |
| In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100_rtc_register_clks() registers the RTC-32k clock with clk_hw_register_fixed_rate() and the clock provider with of_clk_add_hw_provider(). Neither is device managed, and both are released only from ac100_rtc_remove(). The driver core does not call remove() when probe() fails: really_probe() reaches probe_failed below the device_remove() call and goes straight to releasing the device's managed resources. ac100_rtc_probe() ends with return devm_rtc_register_device(chip->rtc); so if that fails after the clocks have been registered, the provider is left on the global of_clk_providers list holding chip->clk_data, which was allocated with devm_kzalloc() and is freed while probe() unwinds. A later lookup on this device tree node then reads freed memory in of_clk_hw_onecell_get(). Consumers that do exactly that exist in tree: the wifi power sequence nodes on sun8i-a83t-bananapi-m3 and sun8i-a83t-cubietruck-plus take <&ac100_rtc 1>, and the sun9i-a80 boards route osc32k through <&ac100_rtc 0>. The window is narrow, as devm_rtc_register_device() can only fail with -ENOMEM here, but the provider is left dangling whenever it does. The RTC-32k clock is leaked on the same path. Since clk_core_lookup() searches a global list that is not scoped per device, __clk_register() rejects the duplicate name with -EEXIST, so the leak also makes a later probe of the same device fail. The error path that returns -EINVAL when the ADDA 4M parent clock cannot be found leaks the RTC-32k clock in the same way. No provider has been registered at that point, so that one is a leak rather than a use-after-free. Register both with devm_clk_hw_register_fixed_rate() and devm_of_clk_add_hw_provider() so that they are released whenever the device goes away, on a failed probe as well as on unbind. Devres releases in reverse order of acquisition, so the provider is removed before chip->clk_data is freed, and the clkout children are now unregistered before their parent rather than after it. ac100_rtc_unregister_clks() and the remove callback then have nothing left to do and are removed. | ||||