Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423974 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123327 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.5 High |
| In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions | ||||
| CVE-2026-123326 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.1 High |
| In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension | ||||
| CVE-2026-123277 | 1 Jetbrains | 1 Clion | 2026-11-06 | 5 Medium |
| In JetBrains CLion before 2026.3, 2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux | ||||
| CVE-2026-123291 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 4.3 Medium |
| In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook | ||||
| CVE-2026-123290 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.3 Medium |
| In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint | ||||
| CVE-2026-123300 | 1 Jetbrains | 1 Hub | 2026-11-06 | 2.7 Low |
| In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings | ||||
| CVE-2026-123324 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 7.7 High |
| In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible | ||||
| CVE-2026-123292 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 2.7 Low |
| In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid | ||||
| CVE-2026-123336 | 1 Jetbrains | 1 Youtrack | 2026-11-06 | 3.1 Low |
| In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion | ||||
| CVE-2026-123288 | 1 Jetbrains | 1 Datalore | 2026-11-06 | 5.4 Medium |
| In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link | ||||
| CVE-2026-121818 | 1 About Time Technologies | 1 Herowatch Go | 2026-11-06 | 7.8 High |
| Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code. | ||||
| CVE-2026-94459 | 1 Iris | 1 Irispowerscan | 2026-11-06 | N/A |
| IRISPowerscan contain default user accounts with predictable credentials. An unauthenticated attacker with access to an affected installation could use these credentials to authenticate to the application and access functionality available to the affected accounts, potentially resulting in unauthorised access or modification of application data and configuration. | ||||
| CVE-2026-120422 | 1 Sogou | 1 Sogou Input Method | 2026-11-06 | N/A |
| Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application. | ||||
| CVE-2026-121936 | 1 Cosin2077 | 1 Easyvoice | 2026-11-06 | 6.5 Medium |
| easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send POST requests by supplying openaiBaseUrl with useLLM enabled. Attackers can target loopback and internal services through /api/v1/tts endpoints, using reflected error messages in the x-generate-tts-warning header to probe internal hosts and ports. | ||||
| CVE-2026-121938 | 1 Moyangzhan | 1 Langchain4j-aideepin | 2026-11-06 | 5.3 Medium |
| langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' character-chat conversations by supplying their character uuid. Attackers can request GET /character/{uuid}, which CharacterService.detail resolves without an ownership check, to obtain victims' questions, AI answers, and attachment and audio URLs. | ||||
| CVE-2026-121941 | 1 Munt | 1 Libmt32emu | 2026-11-06 | 7.8 High |
| libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application. | ||||
| CVE-2026-121945 | 1 Coopcycle | 1 Coopcycle-web | 2026-11-06 | 7.6 High |
| CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read and modify every incident because Incident operations only check ROLE_COURIER. Attackers can enumerate sequential incident ids and use PUT /api/incidents/{id}/action to re-price, cancel or reschedule other stores' orders and tasks. | ||||
| CVE-2026-121620 | 1 Coopcycle | 1 Coopcycle-web | 2026-11-06 | 6.5 Medium |
| CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Zelty webhook events because the x-zelty-hmac-sha256 HMAC signature is never verified. Attackers can POST forged dish, menu, option and order-status events to /api/zelty/webhook/* endpoints to toggle restaurant products and alter order preparation states. | ||||
| CVE-2026-122120 | 1 Yealink | 1 Plug-in Softwares | 2026-11-06 | 9 Critical |
| In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution. | ||||
| CVE-2026-122148 | 1 Yealink | 1 Meetingboard Pro | 2026-11-06 | 4.5 Medium |
| In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability. An attacker with administrator privileges can modify the page DOM to bypass front-end UI control logic and invoke screenshot-related interfaces, triggering the screenshot function by circumventing front-end interface restrictions. Exploitation can occur only when the attacker has a valid administrator account within the local network. | ||||