Export limit exceeded: 413256 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (92871 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2020-8659 | 3 Debian, Envoyproxy, Redhat | 4 Debian Linux, Envoy, Openshift Service Mesh and 1 more | 2026-10-02 | 7.5 High |
| CNCF Envoy through 1.13.0 may consume excessive amounts of memory when proxying HTTP/1.1 requests or responses with many small (i.e. 1 byte) chunks. | ||||
| CVE-2026-56153 | 2 Apache, Redhat | 2 Http Server, Hummingbird | 2026-10-02 | 7.5 High |
| Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.68. | ||||
| CVE-2026-100263 | 1 Jetbrains | 1 Youtrack | 2026-10-02 | 4.7 Medium |
| In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible | ||||
| CVE-2026-71454 | 1 Cwe-79 - Cross-site Scripting | 1 Capec-63 | 2026-10-02 | N/A |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting (XSS). This issue affects CAPEC-63: before 3.0b63. | ||||
| CVE-2026-71453 | 1 Johnson Controls | 1 Easyio Fs32 | 2026-10-02 | N/A |
| - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-103097 | 2 Geovision, Geovision Inc. | 2 Gv-eye, Gv-eye | 2026-10-02 | 7.5 High |
| An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||
| CVE-2026-103096 | 2 Geovision, Geovision Inc. | 2 Gv-eye, Gv-eye | 2026-10-02 | 7.5 High |
| API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive API credentials directly in the client application may allow unauthorized users to extract and misuse the key. | ||||
| CVE-2026-63133 | 1 Cisagov | 1 Malcolm | 2026-10-02 | 6.5 Medium |
| Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` extracts uploaded archives with no limit on entry count, directory depth, total entries, or output size. A small malicious archive containing a large number of directory or file entries causes the filebeat processing container to create an unbounded number of filesystem objects, exhausting inodes or filesystem metadata and denying service to the processing pipeline and any service sharing the same mount. Version 26.07.0 fixes the issue. | ||||
| CVE-2026-95275 | 1 Google | 1 Chrome | 2026-10-02 | 6.5 Medium |
| Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-97286 | 2026-10-02 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11. | ||||
| CVE-2026-71486 | 2 Vllm, Vllm-project | 2 Vllm, Vllm | 2026-10-02 | 4.3 Medium |
| vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the /v1/completions/derender and /v1/chat/completions/derender endpoints accept caller-supplied GenerateResponse objects whose generate_responses, choices, token_ids, prompt_logprobs, logprobs.content, top_logprobs, and routed_experts structures are processed by OnlineDerenderer and tokenizer.decode before max_model_len, max_tokens, max_num_seqs, or response-size limits are enforced, allowing an authenticated API client to consume excessive CPU and memory and produce oversized responses. This issue is fixed in version 0.26.0. | ||||
| CVE-2026-93698 | 1 Webpros | 2 Cpanel, Wp Squared | 2026-10-02 | N/A |
| Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | ||||
| CVE-2026-93697 | 1 Webpros | 2 Cpanel, Wp Squared | 2026-10-02 | N/A |
| There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. | ||||
| CVE-2026-71452 | 1 Johnson Controls | 1 Easyio Fs32 | 2026-10-02 | N/A |
| - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-71451 | 1 Johnson Controls | 1 Easyio Fs32 | 2026-10-02 | N/A |
| - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-27874 | 1 Johnson Controls | 1 Easyio Fs32 | 2026-10-02 | N/A |
| : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. This issue affects EasyIO FS32: before 3.0b63. | ||||
| CVE-2026-27873 | 1 Johnson Controls | 2 Easy Io Fg, Easyio Fg | 2026-10-02 | N/A |
| - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before 2.0b52. | ||||
| CVE-2026-104123 | 1 Sourcecodester | 1 Online Reviewer Management System | 2026-10-02 | 7.3 High |
| A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /reviewer_0/admins/assessments/activities/btn_functions.php?action=activity. The manipulation of the argument Title results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-104053 | 2 Itsourcecode, Sourcecodester | 2 Pet Shop Management System, Petshop Management System | 2026-10-02 | 6.3 Medium |
| A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin_reservefilter.php. Such manipulation of the argument filter leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. | ||||
| CVE-2026-102626 | 1 Limesurvey | 1 Limesurvey | 2026-10-02 | N/A |
| An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in the date_min attribute of a Date/Time question. When another user renders the affected question, LimeSurvey inserts the stored value into a single-quoted inline JavaScript literal without JavaScript-context encoding. | ||||