Export limit exceeded: 425942 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425942 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19653 | 1 Ibm | 2 Aix, Vios | 2026-10-26 | 6.5 Medium |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper handling of memory page table configurations. | ||||
| CVE-2026-54309 | 1 N8n | 1 N8n | 2026-10-26 | 10.0 Critical |
| n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP endpoint accepts session initialization and tool invocation requests without any authentication. Any network-reachable client, or any website visited by the user, can establish an MCP session and invoke browser-control tools. Where the n8n AI Browser Bridge extension is installed and a browser connection is active, an unauthenticated caller can access browser-control capabilities including navigation, JavaScript evaluation, and cookie and storage access against the user's real browser profile. This issue only affects instances where @n8n/mcp-browser is run with the HTTP transport (--transport http). This vulnerability is fixed in 2.25.7 and 2.26.2. | ||||
| CVE-2026-54310 | 1 N8n | 1 N8n | 2026-10-26 | 9.9 Critical |
| n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database account. This vulnerability is fixed in 2.25.7 and 2.26.2. | ||||
| CVE-2026-54195 | 2 Jetmonsters, Wordpress | 2 Jetformbuilder, Wordpress | 2026-10-26 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.0.1 versions. | ||||
| CVE-2026-49778 | 2 Getwpfunnels, Wordpress | 2 Wpfunnels, Wordpress | 2026-10-26 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WPFunnels Pro <= 2.9.4 versions. | ||||
| CVE-2026-49767 | 2 Tomdever, Wordpress | 2 Wpforo Forum, Wordpress | 2026-10-26 | 9.8 Critical |
| Unauthenticated Broken Authentication in wpForo Forum <= 3.1.0 versions. | ||||
| CVE-2026-48967 | 2 Dylan Kuhn, Wordpress | 2 Geo Mashup, Wordpress | 2026-10-26 | 8.5 High |
| Subscriber SQL Injection in Geo Mashup <= 1.13.19 versions. | ||||
| CVE-2026-16824 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-10-26 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to unbounded recursion. | ||||
| CVE-2026-46497 | 1 Apify | 1 Crawlee-python | 2026-10-26 | N/A |
| Crawlee is a web scraping and browser automation library. From version 1.0.0 to before version 1.7.0, Crawlee is vulnerable to SSRF via sitemap-derived URLs. This issue has been patched in version 1.7.0. | ||||
| CVE-2026-52755 | 1 Nsa | 1 Ghidra | 2026-10-26 | 7.8 High |
| Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that allows attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys. | ||||
| CVE-2026-44901 | 1 Wazuh | 1 Wazuh | 2026-10-26 | 8.4 High |
| Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge() in framework/wazuh/core/results.py trusts the sort_casting field in a cluster worker's JSON response. During a distributed API merge, attacker-controlled type names are resolved through Python builtins without an allowlist. A compromised worker can set sort_casting to exec and place Python source in affected_items, causing the master to execute the payload as root when responses from multiple nodes are merged. This issue is fixed in versions 4.14.6 and 5.0.0-beta2. | ||||
| CVE-2026-7516 | 1 Lenovo | 1 Application | 2026-10-26 | 4.3 Medium |
| A vulnerability was identified in the Lenovo Android Application, distributed exclusively on tablets in the Chinese market, that could allow a website visited by the built-in browser to overwrite system clipboard contents. | ||||
| CVE-2026-52705 | 2 Bdthemes, Wordpress | 2 Sigmaforms Pro – Ai Generated Forms, Wordpress | 2026-10-26 | 9 Critical |
| Unauthenticated Arbitrary File Upload in SigmaForms Pro – AI Generated Forms <= 1.4.5 versions. | ||||
| CVE-2026-111974 | 1 Wordpress-extensions | 1 Givewp | 2026-10-26 | 5.3 Medium |
| The GiveWP WordPress plugin before 4.19.0.1 does not restrict the currency of a donation to the one the site or form accepts, while comparing its amount limits as bare numbers, allowing unauthenticated users to make donations below a form's configured minimum or fixed amount. | ||||
| CVE-2026-16928 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-10-26 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. | ||||
| CVE-2026-16851 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-10-26 | 7.4 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to a use-after-free. | ||||
| CVE-2026-16836 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-10-26 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | ||||
| CVE-2026-16833 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-10-26 | 5.3 Medium |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to disclose kernel memory due to an out-of-bounds read. | ||||
| CVE-2026-111813 | 2 Apache, Apache Software Foundation | 3 Apache Traffic Server, Traffic Server, Apache Traffic Server | 2026-10-26 | 10 Critical |
| Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue. | ||||
| CVE-2026-19446 | 1 Ibm | 3 Aix, Powervm Vios, Vios | 2026-10-26 | 7.5 High |
| IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 allows a remote unauthenticated attacker can send a crafted UDP packet to a reachable RPC service, resulting in complete system unavailability and requiring an LPAR restart. | ||||