Export limit exceeded: 91658 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (91658 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-74030 | 1 Wazuh | 1 Wazuh | 2026-10-13 | 4.9 Medium |
| Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlled policy to exhaust agent memory. Attackers controlling the manager can push a small SCA policy with nested aliases via merged.mg to OOM-kill wazuh-modulesd on every agent in a group. | ||||
| CVE-2026-109961 | 1 Froxlor | 1 Froxlor | 2026-10-13 | 8.5 High |
| Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into the root-owned NSS group database via the unvalidated additional_members parameter of the Ftps.add API. Attackers can embed newline characters that the REBUILD_NSSUSERS cron writes unsanitized into /var/lib/extrausers/group, creating privileged group entries for local privilege escalation. | ||||
| CVE-2026-109960 | 1 Froxlor | 1 Froxlor | 2026-10-13 | 7.7 High |
| Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and JavaScript by setting a malicious theme value via customer_index.php. Script executes when an administrator views the customer overview with the Theme column enabled, letting attackers abuse the CSRF token to create administrator accounts or change server settings. | ||||
| CVE-2026-109952 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 5.3 Medium |
| The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOL_RDSTLS or PROTOCOL_HYBRID_EX against its enabled protocol set in nego_process_negotiation_response(), allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla pinning, complete authentication with an all-zero cookie, and receive the user's cleartext password in the Client Info PDU. | ||||
| CVE-2026-109947 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 6.5 Medium |
| FreeRDP from 3.20.1 before 3.32.0 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to exhaust client memory via oversized drive redirection read requests. Attackers can send IRP_MJ_READ with Length 0xffffffff, causing roughly 4 GiB of zeroed allocation on 64-bit builds or an under-reserved buffer on 32-bit builds. | ||||
| CVE-2026-109680 | 1 Freerdp | 1 Freerdp | 2026-10-13 | 5.3 Medium |
| FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes while keeping a pre-filled suggested username's length as its write offset. A malicious or compromised ARM routing service can return a long redirectedUsername that reaches the CLI credential prompt, crashing the client when the user types input. | ||||
| CVE-2026-73641 | 1 Dayforce | 2 Ess Excelity, Payroll | 2026-10-13 | N/A |
| Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4. | ||||
| CVE-2026-78557 | 2026-10-13 | 8.3 High | ||
| A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The application fails to properly sanitize or escape data received from the backend before rendering it in the user interface. Because the front end is integrated with Node.js, this vulnerability allows for the execution of arbitrary JavaScript, which can be leveraged to achieve remote code execution (RCE) on the victim's machine | ||||
| CVE-2026-63355 | 2026-10-13 | 6.1 Medium | ||
| Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in selection menus on the Trace page. This could allow an attacker to social engineer an authorized user who holds the function right “Read diagnostics” into importing a specially crafted trace file. Attacker-controlled JavaScript could be executed in the user’s browser session when the user subsequently interacts with an affected selection menu. | ||||
| CVE-2026-54870 | 2026-10-13 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1. | ||||
| CVE-2026-54869 | 2026-10-13 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.3.1. | ||||
| CVE-2026-54868 | 2026-10-13 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Stored XSS.This issue affects FV Simpler SEO: from n/a through 1.9.7. | ||||
| CVE-2026-54867 | 2026-10-13 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9. | ||||
| CVE-2026-109697 | 2026-10-13 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.4. | ||||
| CVE-2026-109691 | 2026-10-13 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Stored XSS.This issue affects Prime Slider – Addons For Elementor: from n/a through 4.7.1. | ||||
| CVE-2026-108691 | 1 Gz-yami | 1 Mall4j | 2026-10-13 | 5.4 Medium |
| mall4j through 4.0 contains an improper authorization vulnerability that allows authenticated storefront customers to delete other shoppers' cart items through an operator precedence error in the cleanExpiryProdList SQL statement. Attackers can send one DELETE request to /p/shopCart/cleanExpiryProdList to remove every user's cart entries for off-shelf products, which do not return when products are restocked. | ||||
| CVE-2026-108570 | 1 Furion | 1 .net Framework | 2026-10-13 | 6.3 Medium |
| A security flaw has been discovered in Furion .NET Framework up to 4.9.9.95. This affects the function RunCompile of the file framework/Furion/ViewEngine/Engines/ViewEngine.cs of the component View Engine. The manipulation of the argument content results in improper neutralization of special elements used in a template engine. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108566 | 1 Instantsoft | 1 Icms2 | 2026-10-13 | 3.5 Low |
| A vulnerability has been found in InstantSoft icms2 up to 2.18.2. This issue affects the function index of the file templates/default/controllers/messages/index.tpl.php of the component Private Message Handler. Such manipulation of the argument nickname leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 3a1ec8fcb073a46d06a2ab83bc2bf68225834281. It is best practice to apply a patch to resolve this issue. | ||||
| CVE-2026-108541 | 1 Highwarden | 1 Super Store Finder | 2026-10-13 | 6.3 Medium |
| A vulnerability has been found in highwarden Super Store Finder up to 3.8. Affected is an unknown function of the file /products/superstorefinder/index.php. The manipulation of the argument lat/lng leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Upgrading to version 3.9 is able to address this issue. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | ||||
| CVE-2026-108495 | 2026-10-13 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureForms sureforms allows Stored XSS.This issue affects SureForms: from n/a through 2.12.7. | ||||