Export limit exceeded: 409228 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (409228 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111234 | 2026-10-16 | 5.9 Medium | ||
| SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process. | ||||
| CVE-2026-111229 | 1 Netgate | 1 Pfsense | 2026-10-16 | 7.2 High |
| pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command. | ||||
| CVE-2026-111224 | 1 Netgate | 1 Pfsense | 2026-10-16 | 7.5 High |
| pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect. | ||||
| CVE-2026-111219 | 1 Netgate | 1 Pfsense | 2026-10-16 | 6.6 Medium |
| Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates. | ||||
| CVE-2026-111214 | 1 Netgate | 1 Pfsense | 2026-10-16 | 7.2 High |
| Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with QinQ edit privilege to run commands by storing an unvalidated parent interface name. Attackers can save a crafted 'if' value, then edit the QinQ entry so it is interpolated into ifconfig shell commands, executing commands as root. | ||||
| CVE-2026-111210 | 1 Bitcoinj | 1 Bitcoinj | 2026-10-16 | 7.3 High |
| A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the component Payment Request Handler. Executing a manipulation of the argument pki_type can lead to server-side request forgery. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-111172 | 2026-10-16 | 5.3 Medium | ||
| @casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process. | ||||
| CVE-2026-111167 | 1 Gnu | 1 Libredwg | 2026-10-16 | 6.1 Medium |
| GNU LibreDWG through 0.14.8612 contains a global out-of-bounds read vulnerability in the AcDs decoder acds_private() that allows attackers to read beyond a static table via an unchecked schema property type index. Attackers can supply a crafted R2004 or R2010+ DWG file with a large 'schdat' property type value to crash dwgread, dwg2dxf, or any application using LibreDWG. | ||||
| CVE-2026-111162 | 1 Mindwerks | 1 Wildmidi | 2026-10-16 | 6.1 Medium |
| WildMIDI through 0.5.0 contains a heap out-of-bounds read vulnerability in the HMP parser _WM_ParseNewHmp() that allows attackers to read beyond buffers via underflowed chunk lengths. Attackers can supply a crafted .hmp file with a chunk length of 0-12 that wraps to roughly 4 GB, crashing applications or exposing heap bytes through WildMidi_GetInfo(). | ||||
| CVE-2026-111157 | 2026-10-16 | 6.1 Medium | ||
| SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd samplesPerBlock value in the WAV fmt chunk. Attackers can supply a crafted MS ADPCM WAV file to sox or any libsox consumer to write a partially controlled 16-bit sample past the heap buffer allocated by wav_ms_adpcm_fmt(). | ||||
| CVE-2026-111152 | 1 Game-music-emu Project | 1 Game-music-emu | 2026-10-16 | 5.5 Medium |
| Game Music Emu (libgme) through 0.6.5 contains a heap out-of-bounds read vulnerability in the AY loader get_data function caused by an integer underflow in the track-table bounds check. Attackers can supply a crafted ZXAYEMUL file with an oversized track table to read past the file buffer via gme_track_info or gme_start_track, crashing libgme consumers. | ||||
| CVE-2026-111147 | 2026-10-16 | 6.1 Medium | ||
| Libyal libesedb through 20260704 contains a heap out-of-bounds read vulnerability in libesedb_record_get_multi_value() that allows attackers to read past buffers via unbounded multi-value offset tables. Attackers can supply a crafted ESE/EDB database processed by esedbexport to crash the application or expose up to about 32 KiB of adjacent heap memory. | ||||
| CVE-2026-111142 | 1 Gdraheim | 1 Zziplib | 2026-10-16 | 5.5 Medium |
| Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a crafted ZIP central directory. Attackers can craft an end-of-central-directory record placing the first entry near the buffer end, causing zzip_disk_entry_strdup_name to read past the buffer and crash the application. | ||||
| CVE-2026-111137 | 2026-10-16 | 6.1 Medium | ||
| libsmi through 0.5.0 contains an out-of-bounds write vulnerability in smiValueAsString() in lib/smi.c that allows attackers to overflow a fixed 1024-byte static buffer through hex rendering of OCTET STRING values. Attackers can supply a crafted MIB with an OCTET STRING DEFVAL of 512 or more octets and a leading 0x00 byte to corrupt adjacent library globals and crash smidump or other consumers. | ||||
| CVE-2026-111132 | 1 Gnome | 1 Libgxps | 2026-10-16 | 6.1 Medium |
| GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output. | ||||
| CVE-2026-111127 | 1 Fossies | 1 Catdoc | 2026-10-16 | 6.1 Medium |
| catdoc through 0.95 contains an out-of-bounds read vulnerability in copy_unicode_string() in src/xlsparse.c that allows attackers to read past buffers via an unchecked string character count. Attackers can supply a crafted .xls file declaring 0xFFFF two-byte characters in LABEL, STRING, or SST records to disclose adjacent memory through xls2csv output or crash the process. | ||||
| CVE-2026-110888 | 2026-10-16 | 4.3 Medium | ||
| Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3. | ||||
| CVE-2026-110878 | 2026-10-16 | 5.4 Medium | ||
| Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type and Location names in RuleForm.php and RuleInfolist.php. Attackers can store HTML/JavaScript payloads in names that execute when warehouse managers or administrators view or edit Inventory Rules, performing actions in their session context. | ||||
| CVE-2026-110873 | 2026-10-16 | 7.1 High | ||
| Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's error_workflow_id because the field is missing from OWNER_ONLY_EXECUTION_FIELDS. Attackers can point the error workflow to their own workflow with an HTTP node, and when the parent workflow errors the owner's decrypted credentials are injected and exfiltrated. | ||||
| CVE-2026-110868 | 2026-10-16 | 8.5 High | ||
| Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitrary internal URLs via extends presets or customDatasources. Attackers can point a preset at an instance metadata service endpoint to obtain AWS credentials or leak sensitive information through Renovate logs. | ||||