Export limit exceeded: 405240 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405240 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-93748 | 1 Http-cache-semantics Project | 1 Http-cache-semantics | 2026-10-12 | 7.5 High |
| http-cache-semantics through 4.2.0 fails to properly validate security-zeroed cache entries when processing client max-stale directives, allowing unauthenticated attackers to retrieve cached responses belonging to other users. Attackers can request the same URL with a large max-stale value to obtain another user's Set-Cookie session credentials from shared-cache entries that were deliberately zeroed for security reasons. | ||||
| CVE-2026-93687 | 2 Jonschlinkert, Micromatch | 2 Braces, Braces | 2026-10-12 | 7.5 High |
| braces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError. | ||||
| CVE-2026-108811 | 1 Wmcms | 1 Wmcms | 2026-10-12 | 4.3 Medium |
| A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. | ||||
| CVE-2026-21126 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21132 | 1 Samsung Mobile | 1 Samsung Internet | 2026-10-12 | N/A |
| Improper input validation in Samsung Internet prior to version 30.0.5.24 allows remote attackers to inject arbitrary script. User interaction is required for triggering this vulnerability. | ||||
| CVE-2026-108810 | 1 Tsi-coop | 1 Tsi-dpdp-cms | 2026-10-12 | 5.3 Medium |
| A security flaw has been discovered in tsi-coop tsi-dpdp-cms 0.5.0/0.5.1/0.5.2. Impacted is an unknown function of the component JSON Schema Validation. The manipulation of the argument _func results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.3 is recommended to address this issue. You should upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | ||||
| CVE-2026-21115 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Out-of-bounds write in libcodec2-sec-flacdec.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21116 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory. | ||||
| CVE-2026-21117 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information. | ||||
| CVE-2026-21121 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs. | ||||
| CVE-2026-108809 | 1 Eleveo | 1 Call Recording Software | 2026-10-12 | 3.5 Low |
| A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/realms/default/protocol/openid-connect/logout. The manipulation leads to session expiration. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-21123 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper privilege management in Locksettings prior to SMR Oct-2026 Release 1 allows local privileged attackers with root privilege to access data of the tied profile in before first unlock. | ||||
| CVE-2026-108808 | 1 Eleveo | 1 Call Recording Software | 2026-10-12 | 2.6 Low |
| A vulnerability was determined in Eleveo Call Recording Software up to 10.3.0. This vulnerability affects unknown code of the file /auth/realms/default/protocol/openid-connect/logout of the component JWT Token Handler. Executing a manipulation of the argument id_token_hint can lead to use of get request method with sensitive query strings. The attack may be launched remotely. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-21118 | 1 Samsung Mobile | 1 Samsung Mobile Devices | 2026-10-12 | N/A |
| Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage. | ||||
| CVE-2026-108800 | 2 Ruoyi, Yangzongzhuan | 2 Ruoyi, Ruoyi | 2026-10-12 | 4.3 Medium |
| A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-108807 | 1 Krupalshah | 1 Employeerecruitmentsystem | 2026-10-12 | 7.3 High |
| A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function mysql_query of the file source/adminregister.php of the component Registration Handler. Performing a manipulation results in sql injection. The attack may be initiated remotely. The exploit has been made public and could be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108806 | 1 Krupalshah | 1 Employeerecruitmentsystem | 2026-10-12 | 7.3 High |
| A vulnerability has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file source/authprocessing.php of the component Forgot Password Handler. Such manipulation of the argument fpemail leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108805 | 1 Krupalshah | 1 Employeerecruitmentsystem | 2026-10-12 | 7.3 High |
| A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file source/loginprocessing.php of the component Login Handler. This manipulation of the argument email/password causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108804 | 1 Trendnet | 3 Tew-751dr, Tew-752dru, Tew733gr | 2026-10-12 | 10 Critical |
| A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor confirms: "As this router was EOL'd in 2011, we have no way of testing if such vulnerability exists. We will notify our customers of a potential vulnerability on this product." This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108982 | 1 Idrix | 1 Veracrypt | 2026-10-12 | N/A |
| VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service (go-nfsv4) and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the auxiliary mount continues to serve the decrypted volume image (volume.dmg) over a loopback SMB session, and the leaked processes retain an open handle to the underlying raw device. A local user or process can therefore remount and access the decrypted volume without the passphrase, e.g., by reopening a previously accessed path (such as through a macOS Open Recent menu) or by attaching volume.dmg from the stale auxiliary mount. (The macFUSE build of VeraCrypt is not affected.) | ||||