Export limit exceeded: 412903 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 412903 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (412903 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112281 | 1 Nkoriyama | 1 Aribb24 | 2026-10-21 | 6.1 Medium |
| libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows attackers to write past a fixed 256-entry array by supplying unbounded CSI parameter bytes. Attackers can embed a caption statement with a CSI introducer and over 256 parameter bytes in media files or broadcast streams to crash FFmpeg or VLC or corrupt the return address. | ||||
| CVE-2026-112284 | 1 Xqq | 1 Libaribcaption | 2026-10-21 | 3.3 Low |
| libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpecialTable without an upper bound check. Attackers can supply crafted captions designating the Latin special set with ESC 28 4C followed by bytes 0x6F-0x7E to leak adjacent read-only data or crash decoding. | ||||
| CVE-2026-112289 | 1 Koalixswitzerland | 1 Koalixcrm | 2026-10-21 | 5.4 Medium |
| Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious task titles rendered unescaped by Task.link_to_task(). Attackers can embed HTML or script that executes when administrators open the task changelist or change form, enabling actions like creating a superuser. | ||||
| CVE-2026-112290 | 1 Mi6 | 1 Intelligence Community Ui Kit Canary Web Components | 2026-10-21 | 4.7 Medium |
| Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting vulnerability in ic-tree-item that re-parses router-item slot text as HTML. When tree item truncation is enabled, attackers who influence a tree item label can have escaped markup decoded by truncateTreeItemLabel() and executed as JavaScript in visitors' browsers. | ||||
| CVE-2026-112291 | 1 Flarum | 1 Extension Manager | 2026-10-21 | 5.3 Medium |
| Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing unauthenticated information disclosure. Remote attackers can send GET requests to /api/extension-manager-tasks to read task output revealing filesystem paths, installed extensions, versions, and PHP version. | ||||
| CVE-2026-112292 | 1 Operacle | 1 Checkcle | 2026-10-21 | 9.8 Critical |
| CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data. | ||||
| CVE-2026-112293 | 1 Boxyhq | 1 Saas-starter-kit | 2026-10-21 | 5.4 Medium |
| BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage billing because payment routes skip the team_payments permission check. Authenticated MEMBER or ADMIN users can call create-portal-link, create-checkout-session, and products to open Stripe billing portals, view invoices, change payment methods, or alter subscriptions. | ||||
| CVE-2026-112328 | 2 Automattic, Wordpress-extensions | 2 Sensei Lms, Sensei Lms | 2026-10-21 | 4.3 Medium |
| The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that allows authenticated Teacher-role attackers to assign module taxonomy terms to arbitrary courses by supplying a crafted course_id, since the handler validates only a generic nonce and checks manage_options solely for slug prefixing rather than verifying course edit permissions. Attackers can reuse a nonce obtained from their own course metabox to call wp_set_object_terms against courses owned by other teachers or administrators, enabling unauthorized modification of course content they do not own. | ||||
| CVE-2026-112329 | 2 Automattic, Wordpress-extensions | 2 Sensei Lms, Sensei Lms | 2026-10-21 | 4.3 Medium |
| The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked on the init action, which validates only a generic nonce without verifying course enrollment or restricting post_id to valid post types. Authenticated attackers, including unprivileged Subscribers, can supply an arbitrary post_id for any course, lesson, or quiz to create a private message addressed to that post's author, bypassing the enrollment checks enforced by the newer REST send-message controller. | ||||
| CVE-2026-86375 | 1 Dell | 1 Application Installer | 2026-10-21 | 6.2 Medium |
| Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access. | ||||
| CVE-2026-112303 | 1 Gdevelop | 1 Gdevelop | 2026-10-21 | 4.3 Medium |
| GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile() to send the cookie to their server and expose private cloud project resources. | ||||
| CVE-2026-112304 | 1 Mindee | 1 Doctr | 2026-10-21 | 7.5 High |
| docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load without weights_only=True. Attackers who control a local or URL-supplied checkpoint can embed a malicious pickle payload to execute Python code with the loading process's privileges on torch releases before 2.6. | ||||
| CVE-2026-112308 | 2 Crewai, Crewaiinc | 2 Crewai, Crewai-tools | 2026-10-21 | 7.4 High |
| crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validate_url private-address check. Attackers influencing agent tool input through prompt injection can direct headless Chrome to loopback, RFC1918, or cloud metadata addresses to disclose internal data and cloud credentials. | ||||
| CVE-2026-112309 | 1 Airjp73 | 1 Rvf | 2026-10-21 | 7.5 High |
| @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite properties of shared built-in functions via inherited Object.prototype methods. Attackers can submit a form field named hasOwnProperty.call through @rvf/core form parsing to replace the shared function property, causing process-wide denial of service until restart. | ||||
| CVE-2026-12254 | 1 Netskope | 1 Netskope Client | 2026-10-21 | N/A |
| Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via the Captive Portal using a rogue access point to either access malicious sites or exfiltrate data.The issue impacts all versions prior to R142 | ||||
| CVE-2026-111045 | 1 Anshupriyan | 1 Cli-bridge | 2026-10-21 | 7.5 High |
| CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path as safe, so write_file follows the link and can write arbitrary files outside the workspace root. This issue is fixed in version 0.0.2. | ||||
| CVE-2026-111057 | 1 Mljar | 1 Mercury | 2026-10-21 | 10 Critical |
| Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefore bypass the anonymous endpoint blocklist and reach Jupyter Server's terminal API. An unauthenticated attacker can use the resulting interactive operating-system shell to execute commands and access data available to the Mercury process. This issue is fixed in version 3.2.4. | ||||
| CVE-2026-111058 | 1 Mljar | 1 Mercury | 2026-10-21 | 9.8 Critical |
| Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send execute_request messages containing arbitrary Python. The endpoint blocklist does not cover /api/kernels, and the websocket wrapper previously tracked idle activity without authorizing executable messages. This issue is fixed in version 3.2.6. | ||||
| CVE-2026-111059 | 1 Mljar | 1 Mercury | 2026-10-21 | 6.1 Medium |
| Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML before assigning it to an ipywidgets.HTML sink. Event-handler attributes and other active HTML can therefore reach the DOM and execute when another user views the application. This issue is fixed in version 3.2.11. | ||||
| CVE-2026-112377 | 1 Ccc-attestation | 1 Attested-tls-poc | 2026-10-21 | 7.4 High |
| CCC Attestation SIG attested-tls-poc through commit 731ca82 fails to bind early attestation Evidence to the TLS connection, allowing attackers to relay valid Evidence from a genuine attester. Attackers holding an extracted attested TLS private key can forward the relying party's nonce to a genuine attester and replay its Evidence to impersonate the attested workload and intercept data. | ||||