Export limit exceeded: 92261 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (92261 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-109264 | 1 Imagemagick | 1 Imagemagick | 2026-10-13 | 3.7 Low |
| ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in the MVG decoder that can exhaust the program stack. An attacker who controls a file name processed by ImageMagick can trigger a stack overflow that crashes the process, causing a denial of service. | ||||
| CVE-2026-109225 | 2 Lmsys, Sgl-project | 2 Sglang, Sglang | 2026-10-13 | 7.5 High |
| SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory by uploading oversized files to /v1/audio/transcriptions. Attackers can send concurrent large multipart uploads, which are fully read into memory before validation, to crash the HTTP/tokenizer worker and deny service. | ||||
| CVE-2026-108953 | 1 Cfdude | 1 Mac-shell-mcp | 2026-10-13 | 7.8 High |
| mac-shell-mcp before 2.0.0 contains an OS command injection vulnerability that allows MCP clients to bypass the command whitelist by injecting shell metacharacters into execute_command arguments. Attackers or malicious prompts can call a safe command such as pwd with arguments like ';' to run forbidden commands as the server user without approval. | ||||
| CVE-2026-108919 | 1 Sourcecodester | 1 Drug Recommendation System | 2026-10-13 | 4.3 Medium |
| A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Auth/add_student.php of the component Student Registration. This manipulation of the argument txtname/txtpassword/txtemail/txtphone/txtprevious_school causes cross site scripting. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-108917 | 1 Edimax | 2 Br-6208ac, Br-6208ac Firmware | 2026-10-13 | 10 Critical |
| A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108852 | 2 Ovidijusparsiunas, Thinkinai | 2 Deep Chat, Deepchat | 2026-10-13 | 4.7 Medium |
| Deep Chat through 2.5.1 contains a cross-site scripting vulnerability that allows attackers to inject javascript: links because RemarkableConfig.createNew disables Remarkable link validation. Attackers can place crafted Markdown links in AI responses, addMessage content, or loaded history to execute script in the embedding page when victims click them. | ||||
| CVE-2026-108159 | 1 Iflytek | 1 Astron-rpa | 2026-10-13 | 7.5 High |
| AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attackers to execute OS commands by abusing unsanitized LLM output rendered via v-html. Attackers can embed prompt-injection content in a web page so the model emits HTML event handlers invoking the unrestricted open-path IPC handler with shell metacharacters, executing commands as the desktop user. | ||||
| CVE-2026-108106 | 1 Xerial | 1 Snappy-java | 2026-10-13 | 7.5 High |
| Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by declaring a large uncompressed length in compressed input. Attackers can supply a few crafted bytes to Snappy.uncompress, uncompressString, SnappyInputStream or SnappyFramedInputStream to force allocations up to 2 GB, causing OutOfMemoryError and denial of service. | ||||
| CVE-2026-107889 | 1 Redhat | 2 Build Keycloak, Red Hat Single Sign On | 2026-10-13 | 5.5 Medium |
| A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be bypassed, allowing a realm administrator to store malicious scripts in display fields. This could result in unauthorized JavaScript execution in the browsers of users visiting the login page, potentially leading to data exposure or session interference. | ||||
| CVE-2026-107830 | 1 Banq | 1 Jivejdon | 2026-10-13 | 5.3 Medium |
| Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by SmsQQAction, allowing unlimited SMS sending. Attackers can load newAccount.jsp to set session attributes, then repeatedly call the endpoint to harass arbitrary phone numbers and exhaust the operator's Tencent Cloud SMS balance. | ||||
| CVE-2026-107799 | 1 Banq | 1 Jivejdon | 2026-10-13 | 5.4 Medium |
| Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum message bodies. Message bodies are rendered by messageListBody.jsp with filter="false" and non-escaping default filters, executing script in the browser of every user viewing the thread. | ||||
| CVE-2026-107780 | 1 Dromara | 1 Skyeye | 2026-10-13 | 9.8 Critical |
| Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains an OS command injection vulnerability in the unauthenticated /post/TtsController/textToSpeech endpoint via the format parameter. Attackers can inject a single quote into format to break out of the PowerShell string and execute commands as the Skyeye service account on Windows. | ||||
| CVE-2026-107727 | 1 Strawberry | 1 Strawberry | 2026-10-13 | 3.7 Low |
| Strawberry GraphQL is a library for creating GraphQL APIs. From 0.312.3 until 0.327.2, the legacy graphql-ws subscription handler in strawberry/subscriptions/protocols/graphql_ws/handlers.py does not remove naturally completed operations from self.tasks and self.subscriptions. When max_subscriptions_per_connection is configured, a client on a persistent WebSocket connection can use distinct operation IDs for one-shot subscriptions to fill the connection's configured slots even after those subscriptions send complete, causing later legitimate operations on that connection to be rejected with Subscription limit reached. The modern graphql-transport-ws protocol and deployments without the configured per-connection cap are not affected. This issue is fixed in version 0.327.2. | ||||
| CVE-2026-107397 | 1 Indico | 1 Indico | 2026-10-13 | 4.4 Medium |
| Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, the minute editor conflict UI can execute attacker-controlled script in the viewer's browser in the Indico origin. This issue is fixed in version 3.3.13. | ||||
| CVE-2026-104083 | 1 Smartertools | 1 Smartermail | 2026-10-13 | 6.1 Medium |
| SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy. | ||||
| CVE-2026-102982 | 1 Makeplane | 1 Plane | 2026-10-13 | N/A |
| Plane is an open-source project management tool. Prior to 1.4.0, the plane comments fail to sanitize unsafe URL schemes stored in comment_html. A project member can store a crafted link in a comment, and attacker-controlled script executes in the browser context of another user who selects the link. This issue is fixed in version 1.4.0. | ||||
| CVE-2025-71429 | 1 Rvc-boss | 1 Gpt-sovits-webui | 2026-10-13 | 9.8 Critical |
| GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can enter shell substitutions like $(...) in the UVR5 WebUI output folder textboxes with mp3 or m4a export to run commands as the server user. | ||||
| CVE-2023-54408 | 1 Frappe | 1 Frappe | 2026-10-13 | 6.1 Medium |
| Frappe before 13.52.0 and 14.x before 14.31.0 contains an HTML injection vulnerability caused by weak escaping of user-supplied content rendered in pages. Attackers can submit crafted HTML that bypasses the insufficient escaping and is rendered in the browsers of users who view it, enabling cross-site scripting. | ||||
| CVE-2020-37280 | 1 Pelioniot | 1 Cbor-sync | 2026-10-13 | 7.5 High |
| cbor-sync through 1.0.4 contains a resource exhaustion vulnerability in CBOR.decode that trusts declared array and map lengths without checking remaining input. Remote attackers can supply a tiny crafted CBOR payload declaring huge lengths to drive billions of iterations, exhausting CPU and process memory. | ||||
| CVE-2026-78017 | 1 Dell | 2 Policy Manager For Secure Connect Gateway, Secure Connect Gateway Policy Manager | 2026-10-13 | 3.8 Low |
| Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Check for Unusual or Exceptional Conditions vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering and Protection mechanism bypass. | ||||