Export limit exceeded: 410259 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 410259 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410259 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-10572 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 8.8 High |
| IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT operations with malformed message options. | ||||
| CVE-2026-10574 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 8.8 High |
| IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overflow when processing MQPUT or MQPUT1 operations with malformed message handle properties. | ||||
| CVE-2026-10743 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 8.8 High |
| IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations. | ||||
| CVE-2026-11828 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 5.9 Medium |
| IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values. | ||||
| CVE-2026-11829 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 6.5 Medium |
| IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. | ||||
| CVE-2026-11831 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 5.4 Medium |
| IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request. | ||||
| CVE-2026-12148 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 7.5 High |
| IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. | ||||
| CVE-2026-12155 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 6.5 Medium |
| IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. | ||||
| CVE-2026-12343 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 6.5 Medium |
| IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations. | ||||
| CVE-2026-12350 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 6.5 Medium |
| IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. | ||||
| CVE-2025-10149 | 1 Wso2 | 5 Wso2 Carbon Scim 2.0 Common Component, Wso2 Carbon Scim Common Component, Wso2 Identity Server and 2 more | 2026-10-19 | 8.2 High |
| The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against the local user store. This occurs when a local and a federated user share the same username, allowing a federated user to perform actions intended for a local user, including arbitrary operations. A malicious actor authenticated as a federated user may perform arbitrary operations on local user accounts via the SCIM 2.0 or SCIM 1.1 endpoints when local and federated users share the same username. This could lead to user account takeover. Deployments that do not support user self-registration are considered medium severity. | ||||
| CVE-2026-12660 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 2.7 Low |
| IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. | ||||
| CVE-2026-12665 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 8.1 High |
| IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. | ||||
| CVE-2026-12669 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 3.1 Low |
| IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected. | ||||
| CVE-2026-12727 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 4.3 Medium |
| IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names. | ||||
| CVE-2026-12670 | 1 Ibm | 2 Mq Advanced Container Images, Mq Operator | 2026-10-19 | 5.3 Medium |
| IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion. | ||||
| CVE-2026-107082 | 2026-10-19 | N/A | ||
| Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and promoted GET parameters of admin/modules/bibliography/index.php, because escape_string() is applied but the values are concatenated into an unquoted numeric SQL context, leading to error-based information disclosure and arbitrary data extraction. | ||||
| CVE-2025-7203 | 1 Wso2 | 8 Wso2 Api Control Plane, Wso2 Api Manager, Wso2 Carbon Identity Api Server Configs V1 and 5 more | 2026-10-19 | 4.9 Medium |
| The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled. An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server. | ||||
| CVE-2026-107188 | 2026-10-19 | 9.6 Critical | ||
| A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the file extension, and anyone can browse to the uploaded file, leading to command execution. The authentication bypass vulnerability can be chained with this vulnerability to run code on the server without authentication. | ||||
| CVE-2026-111862 | 2026-10-19 | 9.8 Critical | ||
| Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement. | ||||