Export limit exceeded: 419920 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 419920 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419920 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-73186 | 2 Shortpixel, Wordpress-extensions | 2 Enable Media Replace, Enable Media Replace | 2026-10-30 | 8.8 High |
| Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. | ||||
| CVE-2026-119336 | 1 Pi-hole | 1 Pi-hole | 2026-10-30 | 7.8 High |
| Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. From 6.4.2 until 6.5, the root-run advanced/Scripts/updatecheck.sh cron job applies truncate -s 0 and chmod 644 to /etc/pihole/versions while following symbolic links in a directory owned by the pihole user. An attacker executing as pihole can replace that path with a symlink so the scheduled root operations truncate or create an arbitrary root-owned file, or race the operations so chmod makes a sensitive target world-readable without truncating it. This issue is fixed in version 6.5. | ||||
| CVE-2026-62334 | 1 Openvm-org | 1 Openvm | 2026-10-30 | N/A |
| OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` constructs raw proof calldata from user-controlled `proofData`, performs a `staticcall` to `address(this)`, and treats a successful call as proof acceptance. If the first four proof bytes match another external selector exposed by the wrapper, dispatch can invoke a successful non-verifier function instead of the generated Halo2 fallback verifier. Applications using the generated Solidity wrapper can consequently accept arbitrary app commitments and public values without checking the proof suffix, accumulator, app commitments or public values. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview. | ||||
| CVE-2026-79864 | 1 Hpe | 1 Aos | 2026-10-30 | 9.6 Critical |
| Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating system. | ||||
| CVE-2026-62335 | 1 Openvm-org | 1 Openvm | 2026-10-30 | N/A |
| OpenVM is a performant and modular zkVM framework built for customization and extensibility. Before 1.7.0 in the 1.x line and in affected 2.0 and 2.1 prereleases, `OpenVmHalo2Verifier.verify` accepts `appExeCommit` and `appVmCommit` as `bytes32` values without checking that either is less than the `BN254` scalar field modulus. Although public-value and proof-data lengths are checked, callers can provide non-canonical 256-bit encodings greater than or equal to that modulus at the Solidity wrapper boundary. Applications relying on the wrapper can therefore accept non-canonical app executable and app VM commitments, creating ambiguity between the supplied byte-level values and the field elements used by the verifier. This issue is fixed in versions 1.7.0, 2.0.0-rc.3 and 2.1.0-preview. | ||||
| CVE-2026-116853 | 2 Nexcess, Wordpress-extensions | 2 Givewp, Givewp | 2026-10-30 | 6.5 Medium |
| Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | ||||
| CVE-2026-62804 | 1 Microsoft | 14 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 11 more | 2026-10-30 | 7.8 High |
| External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-85893 | 1 Microsoft | 1 Edge Chromium | 2026-10-30 | 8.8 High |
| Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-81396 | 1 Microsoft | 11 365 Apps, Excel, Excel 2016 and 8 more | 2026-10-30 | 7.8 High |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | ||||
| CVE-2026-73013 | 1 Microsoft | 22 Office, Windows 10 1607, Windows 10 1809 and 19 more | 2026-10-30 | 8.8 High |
| Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69499 | 1 Microsoft | 23 Office, Office 365, Office Macos 2021 and 20 more | 2026-10-30 | 8.8 High |
| Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-64918 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-10-30 | 6.5 Medium |
| Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-69610 | 1 Microsoft | 22 Office 365, Office Macos 2021, Office Macos 2024 and 19 more | 2026-10-30 | 7 High |
| Buffer over-read in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-68880 | 1 Microsoft | 23 Office, Office 365, Office Macos 2021 and 20 more | 2026-10-30 | 8 High |
| Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-77491 | 1 Microsoft | 30 Office, Office 365, Office Macos 2021 and 27 more | 2026-10-30 | 5.5 Medium |
| Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-69576 | 1 Microsoft | 23 Office, Office 365, Office Macos 2021 and 20 more | 2026-10-30 | 7.8 High |
| Use after free in Graphic Fonts allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69609 | 1 Microsoft | 23 Office, Office 365, Office Macos 2021 and 20 more | 2026-10-30 | 5.5 Medium |
| Out-of-bounds read in Windows Win32K allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-63182 | 2026-10-30 | 8.1 High | ||
| LightSAML implements SAML 2.0 data model classes, XML serialization and deserialization, XML security, certificate support, and message bindings. Prior to 4.7.1 and 5.0.1, LightSAML and xmlseclibs disagree about which assertion an inbound SAML signature covers. `Response::deserialize` uses `manyElementsFromXml` to collect only direct-child `saml:Assertion` elements of `samlp:Response`, and `AssertionSignatureValidatorAction` validates their `ds:Signature` using an out-of-band trusted IdP credential resolved by Issuer, not a key from the document. `XMLSecurityDSig::validateReference()` removes the enveloped signature from the shared DOM, but `processRefNode()` resolves `Reference URI="#id"` document-wide through an XPath of the form `//*[@Id]` and takes `item(0)`, which need not be the assertion whose claims LightSAML consumes. An attacker who has captured one genuinely signed assertion, such as an earlier login response, can place its signature-stripped bytes earlier in `samlp:Extensions` and present a forged direct-child assertion with the same ID and copied genuine signature. Validation then covers the hidden genuine bytes while LightSAML surfaces unsigned attacker-controlled `Subject/NameID`, `Conditions`, and `Attributes`, enabling authentication bypass or privilege escalation even when signature validation is required. The behavior was confirmed in versions 5.0.0 and 4.6.1. This issue is fixed in versions 4.7.1 and 5.0.1. | ||||
| CVE-2026-78403 | 1 Thalesgroup | 1 Sentinel Keys Server | 2026-10-30 | 9.8 Critical |
| Stack-based buffer overflow and missing authorization vulnerability in Thales Sentinel Keys Server on Windows allows Overflow Buffers. Sentinel Keys Server does not check the length of the first field in the HTTP request. An attacker may craft an HTTP request and send it to Sentinel Keys Server. It may lead to remote code execution as NT AUTHORITY\SYSTEM. This issue affects Sentinel Keys Server: versions lower than 1.3.8.0. | ||||
| CVE-2026-115828 | 1 Delinea | 1 Secret Server | 2026-10-30 | N/A |
| In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when using a FIDO2-compliant device | ||||