Export limit exceeded: 408281 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 408281 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (408281 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14496 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 8.2 High |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service due to a heap-based buffer overflow. | ||||
| CVE-2026-14497 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 8.1 High |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote authenticated attacker to bypass security restrictions due to improper verification of cryptographic signatures. | ||||
| CVE-2026-14502 | 1 Ibm | 5 Datapower Gateway, Datapower Gateway 1050, Datapower Gateway 1060 and 2 more | 2026-10-14 | 9.8 Critical |
| IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to obtain administrative access due to failure to reject empty passwords during LDAP authentication. | ||||
| CVE-2025-8444 | 2 Wealcoder, Wordpress | 2 Animation Addons For Elementor – Gsap Motion Elementor Addons & Website Templates, Wordpress | 2026-10-14 | 6.4 Medium |
| The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the multiple parameters in all versions up to, and including, 4.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-82096 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-14 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-82101 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-14 | 9.6 Critical |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability. | ||||
| CVE-2026-82103 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-14 | 9.6 Critical |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an exposure of sensitive information to an unauthorized actor. | ||||
| CVE-2026-82108 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-14 | 8.8 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command. | ||||
| CVE-2026-82110 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-14 | 9.6 Critical |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal. | ||||
| CVE-2026-84418 | 1 Ibm | 1 Datastage On Cloud Pak For Data | 2026-10-14 | 7.4 High |
| IBM DataStage on Cloud Pak for Data 5.4.0.0 can allow a man-in-the-middle attacker to present a forged TLS certificate, intercept the connection, and capture the IAM bearer Authorization header automatically attached by the session adapter. The captured token grants full platform-scope tenant API access, enabling the attacker to read and manipulate the victim's DataStage projects, flows, assets, and pipeline definitions. This is client-side SDK code running on the user's own machine, so exploitation requires an external network interceptor rather than a co-tenant in the shared cluster. | ||||
| CVE-2026-17484 | 1 Ibm | 1 I | 2026-10-14 | 5.3 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to cause a denial of service due to improper access control. | ||||
| CVE-2026-17487 | 1 Ibm | 1 I | 2026-10-14 | 5.3 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to enumerate user profiles due to the return of distinct error codes during the sign-on process. | ||||
| CVE-2026-18318 | 1 Ibm | 1 I | 2026-10-14 | 5.3 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform brute-force attacks to obtain credentials due to improper authentication. | ||||
| CVE-2026-18343 | 1 Ibm | 1 I | 2026-10-14 | 4.4 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a local attacker to modify the BOOTP table due to improper authorization. | ||||
| CVE-2026-81858 | 1 Ibm | 1 I | 2026-10-14 | 5.4 Medium |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain information due to an out-of-bounds read in the File Server. | ||||
| CVE-2026-93886 | 1 Ibm | 1 I | 2026-10-14 | 8.3 High |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to improper validation of user-supplied input. | ||||
| CVE-2026-96119 | 1 Ibm | 1 I | 2026-10-14 | 9.9 Critical |
| IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server Administration web application. | ||||
| CVE-2026-16275 | 1 Gitlab | 1 Gitlab | 2026-10-14 | 5.3 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.4 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to read confidential notes on public projects due to incorrect authorization checks. | ||||
| CVE-2026-74768 | 1 Dell | 1 Powerprotect Data Manager | 2026-10-14 | 4.1 Medium |
| Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a Server-Side Request Forgery (SSRF) vulnerability in the REST API. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. | ||||
| CVE-2026-73600 | 1 Dell | 1 Powerprotect Data Manager | 2026-10-14 | 7.8 High |
| Dell PowerProtect Data Manager, versions 20.2.0.0 and below, contain a stack buffer overflow vulnerability in file-level restore agent. A high privileged remote attacker could potentially exploit this vulnerability, leading to Information disclosure. | ||||