Export limit exceeded: 10218 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 17137 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (17137 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-100251 | 1 Wormhole App | 1 Wormhole | 2026-10-11 | 6.5 Medium |
| Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an unauthenticated attacker to access instance metadata or to source TCP connections from the Wormhole relay's IP. | ||||
| CVE-2026-98293 | 1 Linux | 1 Linux Kernel | 2026-10-11 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix parent socket leak in iso_conn_ready() iso_get_sock() returns the parent socket with a reference held, which is dropped by sock_put() once the child socket has been set up. The error path taken when iso_sock_alloc() fails only calls release_sock() and returns, leaking the reference and thus the parent socket itself. Drop the reference on that path as well. | ||||
| CVE-2026-94590 | 2026-10-11 | 6.5 Medium | ||
| Improper Verification of Source of a Communication Channel vulnerability in CodePeople2 Sell Downloads sell-downloads allows Exploitation of Trusted Credentials.This issue affects Sell Downloads: from n/a through 1.2.3. | ||||
| CVE-2026-62098 | 2026-10-11 | 6.5 Medium | ||
| Unauthenticated Content Injection in Boutique <= 2.3.3 versions. | ||||
| CVE-2026-39802 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Remote Code Execution (RCE) in Everest Backup <= 2.3.13 versions. | ||||
| CVE-2026-103071 | 2026-10-11 | 7.5 High | ||
| Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Code Injection.This issue affects Thank You Page Customizer for WooCommerce: from n/a through 1.2.3. | ||||
| CVE-2026-101022 | 1 Grid Protection Alliance | 2 Openhistorian, Openpdc | 2026-10-11 | 4.3 Medium |
| A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network. | ||||
| CVE-2026-108259 | 1 Tina | 2 Cli, Tinacms | 2026-10-11 | 8.2 High |
| Tina is a headless content management system. Prior to 3.0.0, @tinacms/cli reads Git branch values from VERCEL_GIT_COMMIT_REF, GITHUB_BRANCH, or HEAD, incorporates the raw value into the API URL, and interpolates that URL into JavaScript string literals in packages/@tinacms/cli/src/next/codegen/index.ts and packages/@tinacms/cli/src/next/codegen/codegen/plugin.ts. A crafted Git-valid branch name containing a quote can terminate the generated string and inject an expression that executes when the generated client module is imported during a preview build. The injected code runs with the build process privileges and can read environment credentials, modify deployment artifacts, or make network requests. This issue is fixed in version 3.0.0. | ||||
| CVE-2026-108551 | 1 Ferdikoomen | 1 Openapi-typescript-codegen | 2026-10-11 | 9.8 Critical |
| openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to inject JavaScript by supplying unescaped values interpolated into single-quoted string literals. Attackers can embed a single quote in path keys, parameter names, servers[0].url, or info.version to execute arbitrary JavaScript when generated clients are imported or service methods called. | ||||
| CVE-2026-108554 | 1 Pdfmathtranslate | 1 Pdfmathtranslate | 2026-10-11 | 5.3 Medium |
| PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server fetch arbitrary URLs via the Link input. The translate_file handler passes user URLs to download_with_limit without scheme or address validation, letting attackers reach internal services and cloud metadata endpoints and retrieve returned PDFs. | ||||
| CVE-2026-66566 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. | ||||
| CVE-2026-62115 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions. | ||||
| CVE-2026-62099 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions. | ||||
| CVE-2026-62096 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions. | ||||
| CVE-2026-62094 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions. | ||||
| CVE-2026-62092 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions. | ||||
| CVE-2026-62075 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. | ||||
| CVE-2026-62074 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. | ||||
| CVE-2026-62070 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. | ||||
| CVE-2026-62069 | 2026-10-11 | 8.1 High | ||
| Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. | ||||