Export limit exceeded: 405467 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 405467 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405467 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-76975 | 1 Sap Se | 1 Sapui5 (support Assistant Overlay) | 2026-10-13 | 6.1 Medium |
| Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected. | ||||
| CVE-2026-76972 | 1 Sap | 1 Manufacturing Integration And Intelligence | 2026-10-13 | 6.5 Medium |
| Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim's use of the application, resulting in a low impact on confidentiality, integrity and availability. | ||||
| CVE-2026-75881 | 1 Ibm | 1 Maximo Application Suite Iot Component | 2026-10-13 | 7.5 High |
| IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to an infinite parsing loop when processing certain inputs. | ||||
| CVE-2026-75621 | 1 Ibm | 1 Aspera Enterprise Webapps | 2026-10-13 | 6.2 Medium |
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a local attacker to obtain sensitive information due to excessive permissions assigned to a service account. | ||||
| CVE-2026-75095 | 1 Ibm | 1 Aspera Enterprise Webapps | 2026-10-13 | 7.5 High |
| IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | ||||
| CVE-2026-75063 | 1 Ibm | 1 Planning Analytics | 2026-10-13 | 5.4 Medium |
| IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encoding. | ||||
| CVE-2026-75061 | 1 Ibm | 1 Planning Analytics | 2026-10-13 | 7.5 High |
| IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to write arbitrary files on the system. | ||||
| CVE-2026-74045 | 1 Wazuh | 1 Wazuh | 2026-10-13 | 7.1 High |
| Wazuh from 3.12.0 before 4.14.8 contains a heap buffer overflow in fim_generate_alert() where full_log is sized from input but written bounded by OS_MAXSTR. An enrolled agent can send a crafted FIM syscheck event to corrupt manager heap memory and deterministically crash wazuh-analysisd, causing a fleet-wide detection outage. | ||||
| CVE-2026-74036 | 1 Wazuh | 1 Wazuh | 2026-10-13 | 7.2 High |
| Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute command checks as root on agents. | ||||
| CVE-2026-74031 | 1 Wazuh | 1 Wazuh | 2026-10-13 | 6.5 Medium |
| Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the delete_rule_file and delete_decoder_file helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through DistributedAPI with traversal sequences to delete ossec.conf, client.keys, or rules as the wazuh user. | ||||
| CVE-2026-73642 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4. | ||||
| CVE-2026-73641 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4. | ||||
| CVE-2026-73640 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based Blind SQL Injection. This issue was fixed in version V3. | ||||
| CVE-2026-6567 | 1 Gitlab | 1 Gitlab | 2026-10-13 | 4.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.8 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticated user with reporter role to access restricted CI artifact report content they were not authorized to, due to missing authorization checks. | ||||
| CVE-2026-5954 | 1 Gitlab | 1 Gitlab | 2026-10-13 | 4.2 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed a user to download package files from a public project due to improper authorization checks. | ||||
| CVE-2026-58249 | 1 Sap Se | 1 Sap Netweaver And Sap Web Dispatcher (internet Communication Manager) | 2026-10-13 | 7.5 High |
| SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application. | ||||
| CVE-2026-58242 | 1 Sap | 1 Cloud Connector | 2026-10-13 | 3.5 Low |
| SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information about internal systems, resulting in low impact on confidentiality. There is no impact on integrity and availability. | ||||
| CVE-2026-54459 | 1 Error311 | 1 Filerise | 2026-10-13 | 4.3 Medium |
| FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authenticates requests to the file creation and share-link creation handlers but does not enforce the server-side CSRF token check used by adjacent state-changing operations. The POST endpoints /api/file/createFile.php and /api/file/createShareLink.php invoke FileController::createFile and FileController::createShareLink without rejecting a missing or invalid X-CSRF-Token header. A request issued with a logged-in user's session can create an empty file or create a share link with that user's permissions, although the default SameSite=Lax session cookie reduces ordinary cross-site POST reachability. This issue is fixed in version 3.14.0. | ||||
| CVE-2026-22314 | 1 Mesalvo | 2 Meona Client Launcher Component, Meona Server Component | 2026-10-13 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority based on the reported functionality projecting intended administrative functionality. | ||||
| CVE-2026-19627 | 1 Ibm | 1 Planning Analytics | 2026-10-13 | 8.2 High |
| IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due to improper validation of file paths. | ||||