Export limit exceeded: 413187 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413187 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413187 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413187 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413187 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-96362 | 1 Drupal | 1 Webform | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | ||||
| CVE-2026-96359 | 1 Drupal | 1 Webform | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | ||||
| CVE-2026-96358 | 1 Drupal | 1 Webform | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | ||||
| CVE-2026-96361 | 1 Drupal | 1 Webform | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | ||||
| CVE-2026-96360 | 1 Drupal | 1 Webform | 2026-10-22 | N/A |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform allows Cross-Site Scripting (XSS). This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1. | ||||
| CVE-2026-84918 | 1 Drupal | 1 Monobank Payment Api | 2026-10-22 | N/A |
| Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof. This issue affects Monobank payment API versions: from 0.0.0 to 1.0.3. | ||||
| CVE-2026-110354 | 1 Haproxy | 4 Haproxy, Haproxy Enterprise, Kubernetes Ingress Controller and 1 more | 2026-10-22 | 7.5 High |
| HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via an HTTP/1.1 chunked request. Although the H1 multiplexer drains the request before closing the stream, the parser repeatedly re-processes the same bytes without making progress. The affected thread stays busy at 100% CPU after timeouts expire and after the client disconnects, and repeated requests can consume all worker threads until the process is restarted. | ||||
| CVE-2026-110353 | 1 Haproxy | 4 Haproxy, Haproxy Enterprise, Kubernetes Ingress Controller and 1 more | 2026-10-22 | 7.5 High |
| HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncated HTTP/2 PING frame. h2c_handle_ping in src/mux_h2.c does not check for a short read, unlike the other H2 frame handlers. Because the incomplete frame cannot be processed, its data is never consumed, and the H2 multiplexer tasklet is repeatedly woken by that pending data without making progress. The CPU spins until timeout http-request closes the connection, and an attacker opening many such connections can sustain high CPU usage. | ||||
| CVE-2026-114219 | 1 Newtype Infortech | 1 Nt Oneapp | 2026-10-22 | 7.4 High |
| NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information. | ||||
| CVE-2026-114220 | 1 Newtype Infortech | 1 Nt Oneapp | 2026-10-22 | 9.1 Critical |
| NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certificate and the hostname, thereby intercepting or modifying communications between the application and the server. | ||||
| CVE-2026-114221 | 1 Newtype Infortech | 1 Nt Oneapp | 2026-10-22 | 7.4 High |
| NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under specific conditions, thereby obtaining the NUP Portal passcode of a logged-in user. | ||||
| CVE-2026-114222 | 1 Newtype Infortech | 1 Nt Oneapp | 2026-10-22 | 6.2 Medium |
| NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN lock mechanism via a Deep Link, thereby accessing protected resources of a logged-in user. | ||||
| CVE-2026-114223 | 1 Newtype Infortech | 1 Nt Oneapp | 2026-10-22 | 5.5 Medium |
| NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract plaintext usernames and passwords from backup data after obtaining ADB backup access authorization and user confirmation of the backup, resulting in sensitive information disclosure. | ||||
| CVE-2026-21812 | 1 Hcltech | 1 Appscan Integration With Azure Boards For Asoc & A360 | 2026-10-22 | 2.2 Low |
| HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when configured to communicate with the AppScan server over HTTP. This could allow an attacker to intercept credentials or authentication tokens during transmission. The plugin has been updated to display a warning when HTTP is used and recommend HTTPS for secure communication. | ||||
| CVE-2026-112996 | 1 Google | 1 Chrome | 2026-10-22 | 8.8 High |
| Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113122 | 1 Google | 1 Chrome | 2026-10-22 | 6.5 Medium |
| Memory corruption in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113227 | 1 Google | 1 Chrome | 2026-10-22 | 8.8 High |
| Use after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113013 | 1 Google | 1 Chrome | 2026-10-22 | 8.8 High |
| Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-113125 | 1 Google | 1 Chrome | 2026-10-22 | 8.8 High |
| Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-101359 | 1 Oracle | 1 Rest Data Services | 2026-10-22 | 5.3 Medium |
| Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle REST Data Services. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle REST Data Services accessible data. CVSS 3.1 Base Score 5.3 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). | ||||