Export limit exceeded: 413496 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413496 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413496 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413496 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112398 | 1 Python-pillow | 1 Pillow | 2026-10-22 | N/A |
| Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode can be decoded as JCS_UNKNOWN with four components, causing ImagingJpegDecode to write four-component scanlines into the two-byte tile buffer. An attacker can supply a crafted OLE2 FlashPix file to an application with the optional olefile dependency installed that opens or thumbnails untrusted input. This can corrupt heap memory and may allow arbitrary code execution. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-112394 | 1 Python-pillow | 1 Pillow | 2026-10-22 | 6.5 Medium |
| Pillow is a Python imaging library. Prior to 13.0.0, Pillow's P;2L and P;4L raw decoders can read past the end of an input buffer. ImagingRawDecode calculates a packed-pixel row size, while the unpackers read separately padded bit planes. A caller can supply a buffer and image dimensions whose accepted size is smaller than the unpacker's actual footprint. This can disclose up to three adjacent heap bytes in output pixels or crash the process. This issue is fixed in version 13.0.0. | ||||
| CVE-2026-112302 | 1 Kiwilan | 1 Php-archive | 2026-10-22 | 6.3 Medium |
| A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/ArchiveZip.php of the component Extraction. This manipulation causes path traversal. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-112297 | 1 Ptbsare | 1 Anx-calibre-manager | 2026-10-22 | 4.3 Medium |
| A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprints/api/llm.py of the component LLM Configuration Handler. This manipulation of the argument base_url causes server-side request forgery. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-112259 | 2 Gimp, Redhat | 2 Gimp, Enterprise Linux | 2026-10-22 | 5.5 Medium |
| A flaw was found in GIMP. Importing a crafted SBZ palette without a color-model attribute can cause a NULL pointer dereference during string comparison, resulting in denial of service of the GIMP application. | ||||
| CVE-2026-112249 | 1 Grandnode | 1 Grandnode2 | 2026-10-22 | 2.4 Low |
| A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Product/Product.Layout.Simple.cshtml of the component Product Description Handler. The manipulation results in cross site scripting. The attack can be launched remotely. Upgrading to version 2.4.0-beta and 2.4.0 is able to address this issue. The patch is identified as 41a8e349eab8d9641cf6ea800d738f2d8991ca22. Upgrading the affected component is recommended. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-112193 | 1 Webkul | 1 Aureus Erp | 2026-10-22 | 3.7 Low |
| A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filament/Resources/UserResource/Schemas/UserForm.php. Performing a manipulation of the argument Password results in weak password requirements. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-111749 | 1 Aio-libs | 1 Aiohttp | 2026-10-22 | 4.2 Medium |
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domain cookie can be removed by a subdomain. A user who accesses an untrusted subdomain can consequently have host-only protections stripped from cookies, although impact is limited when applications do not reflect those cookies to a browser. This issue is fixed in version 3.14.4. | ||||
| CVE-2026-111063 | 1 Aio-libs | 1 Aiohttp | 2026-10-22 | 3.7 Low |
| AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is not enforced. An attacker can consequently cause a shared cookie marked Secure to be sent with an unencrypted request. This issue is fixed in version 3.14.4. | ||||
| CVE-2025-71438 | 1 Gpac | 1 Mp4box | 2026-10-22 | N/A |
| An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | ||||
| CVE-2025-60496 | 2026-10-22 | N/A | ||
| A Floating-Point Exception (FPE) in the reframer_send_packet function (/filters/reframer.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | ||||
| CVE-2025-60479 | 1 Gpac | 1 Mp4box | 2026-10-22 | N/A |
| A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-4 file. | ||||
| CVE-2025-60478 | 1 Gpac | 1 Mp4box | 2026-10-22 | N/A |
| A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG-2 file. | ||||
| CVE-2025-60476 | 1 Gpac | 1 Mp4box | 2026-10-22 | N/A |
| A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | ||||
| CVE-2025-60469 | 2026-10-22 | N/A | ||
| A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | ||||
| CVE-2025-11395 | 1 Redhat | 4 Enterprise Linux, Hummingbird, Openshift and 1 more | 2026-10-22 | 5.5 Medium |
| A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman. | ||||
| CVE-2026-98657 | 1 Linux | 1 Linux Kernel | 2026-10-22 | 7.0 High |
| In the Linux kernel, the following vulnerability has been resolved: iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure pm_runtime_set_active() failing in probe() jumps to error_unreg_buffer, which only calls iio_triggered_buffer_cleanup() -- it does not undo the iio_device_register() that already succeeded a few lines above. probe() then returns the error, the devm-managed indio_dev is freed, but the iio core still has it registered: the sysfs/chardev nodes stay live and point at freed memory. Add an error_unreg_dev label that unregisters the iio device before falling through to the existing buffer cleanup, mirroring the teardown order already used in lidar_remove(). | ||||
| CVE-2026-98659 | 1 Linux | 1 Linux Kernel | 2026-10-22 | 2.5 Low |
| In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read failed and data is garbage. | ||||
| CVE-2026-98692 | 1 Linux | 1 Linux Kernel | 2026-10-22 | 2.3 Low |
| In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Make the DP tunnel activation callback mandatory tb_tunnel_alloc_dp() takes an optional callback which is run from dprx_work once the DPRX capabilities read has completed. Without that callback tb_dp_dprx_start() reads the capabilities synchronously and never queues the work. It however always takes a tunnel reference which is only dropped by dprx_work itself or by tb_dp_dprx_stop() when cancel_delayed_work() actually canceled that work. That reference is thus leaked for every tunnel without a callback. The only tunnels without one are those from tb_tunnel_discover_dp(), which are activated again when restoring from hibernation. Pass the callback to tb_tunnel_discover_dp() as well and drop the synchronous path such that the DPRX capabilities are always read from dprx_work. Hibernation restore then also no longer blocks for up to 12 seconds while waiting for that read to complete. Also fix up the KUnit tests. | ||||
| CVE-2026-98697 | 1 Linux | 1 Linux Kernel | 2026-10-22 | 1.9 Low |
| In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new_id" attribute to avoid leaking any id added by a racing write to the attribute. | ||||