Export limit exceeded: 20927 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 405615 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405615 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-81535 | 2 Wolfssh, Wolfssl | 2 Wolfssh, Wolfssh | 2026-10-13 | 9.1 Critical |
| In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization check and are not capped in number, allowing a malicious SSH peer to make an endpoint allocate unbounded per-channel buffers for forwarding channels the application never authorized. A client also does not check a forwarded-tcpip open against the forwards it registered with a tcpip-forward request, as RFC 4254 section 7.2 requires, so a malicious server can open forwarding channels for addresses and ports the client never asked it to forward. | ||||
| CVE-2026-83540 | 2 Wolfssh, Wolfssl | 2 Wolfssh, Wolfssh | 2026-10-13 | 8.8 High |
| When password or public key authentication is used with the Windows port of wolfSSHd, the Windows logon token acquired for one authenticated connection is not released before a token is acquired for a subsequent connection, resulting in user login poisoning between connections. A less privileged user with a valid account on the server can exploit this to force a login as a more privileged user. The vulnerability was introduced with the initial Windows port of wolfSSHd in wolfSSH version 1.4.15 and affects all versions through 1.5.0. Non-Windows builds of wolfSSHd are not affected. | ||||
| CVE-2026-108377 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.62.3 through 0.70.5, ClassRepresentation.render_metaclass inserts a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body, which execute when the generated module is imported. Version 0.70.6 fixes the vulnerability by escaping schema values rendered into generated string literals. | ||||
| CVE-2026-109714 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158. | ||||
| CVE-2026-109736 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Frame poisoning in the Layout component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109739 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158. | ||||
| CVE-2026-109743 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109744 | 1 Mozilla | 1 Firefox | 2026-10-13 | N/A |
| Other issue in the DOM: File component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109754 | 2026-10-13 | N/A | ||
| Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-109760 | 2026-10-13 | N/A | ||
| Mitigation bypass in the Networking: HTTP component. This vulnerability was fixed in Firefox 158 and Firefox ESR 153.5. | ||||
| CVE-2026-11731 | 1 Netgear | 3 Rax28, Rax29, Rax30 | 2026-10-13 | 8.8 High |
| An authentication bypass vulnerability in the listed NETGEAR RAX series models allows an unauthenticated attacker with adjacent access to the affected device’s management service to access certain device information or modify administrative settings. This vulnerability may impact the confidentiality and integrity of management data and the availability of device-management functions. | ||||
| CVE-2026-11732 | 1 Netgear | 4 Cax30, Rax30, Rax5 and 1 more | 2026-10-13 | 8.8 High |
| An insufficient input validation vulnerability in the website blocking feature (Block Sites) of the listed NETGEAR router models allows a network-adjacent attacker having network access (such as WiFi credentials) to run unauthorized commands on the router. This vulnerability could affect the confidentiality, integrity, and availability of the affected router. It applies only when the Block Sites feature is turned on. | ||||
| CVE-2026-107917 | 1 Netgear | 1 R7300dst | 2026-10-13 | 4.5 Medium |
| Insufficient input validation vulnerability in the PPPoE Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router. This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices. | ||||
| CVE-2026-81507 | 1 Espressif | 1 Esp-idf | 2026-10-13 | 6.5 Medium |
| ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. Prior to 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1, ESP-IDF BlueDroid L2CAP configuration-option processing in l2c_main.c and l2c_utils.c does not consistently validate option lengths against the remaining received packet bytes. A remote unauthenticated BR/EDR peer within radio range can send a malformed L2CAP configuration request that causes an out-of-bounds read, and under some runtime conditions limited adjacent Bluetooth stack memory can be included in an outbound L2CAP Configuration Response. The issue affects ESP32-class products using the BlueDroid host stack with Classic Bluetooth enabled. This issue is fixed in 5.2.8, 5.3.6, 5.5.5, 6.0.3, and 6.1-rc1. | ||||
| CVE-2026-108184 | 1 Zoom Communications | 1 Zoom Clients | 2026-10-13 | 7.4 High |
| Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure via network access. | ||||
| CVE-2026-9218 | 1 Netgear | 4 Cbr40, R7000, R7000p and 1 more | 2026-10-13 | 4.5 Medium |
| Insufficient input validation vulnerability in time server (NTP) setting of the listed NETGEAR models allows an attacker who is connected to the router’s local network and has the router’s administrator credentials to run unauthorized commands on the router. This vulnerability could impact the integrity of the affected router. There is no impact on confidentiality or availability of the affected router. | ||||
| CVE-2026-11730 | 1 Netgear | 2 Ex3700, Ex6120 | 2026-10-13 | 5.4 Medium |
| Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access (such as WiFi credentials) to predict valid session identifiers and hijack an authenticated administrator session on the web management portal. | ||||
| CVE-2026-107918 | 1 Netgear | 1 R7300dst | 2026-10-13 | 4.5 Medium |
| Insufficient input validation vulnerability in the LAN Setup feature of NETGEAR R7300 router allows authenticated administrators connected to the local network to perform unauthorized actions on the router.This issue was identified through testing in a controlled research environment using a simulated version of the router's software and has not been confirmed on physical production devices. | ||||
| CVE-2026-103028 | 1 Drakkan | 1 Sftpgo | 2026-10-13 | 4.3 Medium |
| SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a source file denied by denied_patterns or outside allowed_patterns to an allowed destination name because file-pattern filters are evaluated only on the destination. The user can then read the denied file contents. Recursive directory copies can reproduce restricted contents under an allowed path, and the hide policy is bypassed because files that appear missing to stat and directory listings can still be copied. Home-directory boundaries, virtual-folder layout, per-directory permissions, access to other accounts, and administrative authorization remain enforced. This issue is fixed in 2.7.6. | ||||
| CVE-2026-37107 | 2026-10-13 | N/A | ||
| An issue in HTMLy v.3.1.1 allows a remote attacker to escalate privileges via the get_feed function in the admin.php component | ||||