Export limit exceeded: 407435 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 407435 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 407435 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (407435 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-108546 | 2 Spotweb, Spotweb Project | 2 Spotweb, Spotweb | 2026-10-13 | 7.5 High |
| Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute commands by publishing spots with malicious titles. Attackers can post self-signed spots over Usenet with shell metacharacters in the title, which are substituted unescaped for $SPOTTITLE and passed to exec() when a user downloads the spot, running commands as the Spotweb PHP process. | ||||
| CVE-2026-108385 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.38.0 through 0.70.5, BaseGenerator.parse_enum and EnumRepresentation.render_symbols use each schema-controlled enum symbol as a generated enum member name after case conversion but without validating it as an identifier. When generator classes are used directly, newlines and punctuation can inject constrained statements into the generated enum class body, allowing namespace modification or preventing the module from loading. Version 0.70.6 fixes the vulnerability by validating every enum symbol as a name. | ||||
| CVE-2026-108380 | 2026-10-13 | 8.8 High | ||
| dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avro schemas. From version 0.65.9 through 0.70.5, PydanticFieldRepresentation.add_field_properties inserts a schema field's doc value between the quotes of a generated pydantic.Field description argument without escaping it. A crafted quote can terminate the string and inject an expression evaluated during generated class definition, allowing arbitrary Python code execution for Pydantic and AvroDantic model generation. Version 0.70.6 fixes the vulnerability by escaping the documentation value before rendering it. | ||||
| CVE-2026-108258 | 1 Posit-dev | 1 Py-shiny | 2026-10-13 | N/A |
| Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied state_id and joins it into the server-side shiny_bookmarks directory without validating that it is a single safe path segment. An unauthenticated request can use parent-directory segments or an absolute path to make the server open input.json and values.json outside the bookmark store, even when bookmark_store is set to disable. In applications configured with bookmark_store set to server and using ui.input_file(), the restore handler can additionally copy and expose an attacker-selected file from an attacker-selected directory. This issue is fixed in version 1.6.4. | ||||
| CVE-2026-108164 | 1 Opensource-socialnetwork | 1 Open Source Social Network | 2026-10-13 | 6.5 Medium |
| Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_com.php that allows authenticated users to read other users' private message attachments. Attackers can request the /messages/attachment/{guid} route with sequential or guessed file GUIDs to retrieve attachments from private conversations without sender or recipient verification. | ||||
| CVE-2026-108094 | 1 Redhat | 1 Enterprise Linux | 2026-10-13 | 7.8 High |
| A use-after-free flaw was found in mutter in the Wayland color-management ICC image-description path. A local attacker who can run a malicious Wayland client can destroy a wp_image_description_v1 resource while an asynchronous ICC file read is still in progress. When the read completes, the compositor uses the freed wl_resource, writes into freed memory, and frees a pointer derived from that memory. This can crash the GNOME session and may allow arbitrary code execution within the compositor process. | ||||
| CVE-2026-105081 | 1 Imagemagick | 1 Imagemagick | 2026-10-13 | 3.6 Low |
| ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 does not properly account for symbolic links in the IsRightsAuthorizedByName security policy check, allowing configured policy restrictions to be bypassed. Local attackers who can create a symlink can point it at a policy-restricted path to evade the configured policy. | ||||
| CVE-2026-104817 | 2026-10-13 | N/A | ||
| Misskey is an open source, federated social media platform. From 12.112.1 until 2026.7.0, the unauthenticated fetch-rss API lacks rate limiting and response-size restrictions and performs synchronous XML parsing. An attacker can trigger unbounded outbound HTTP requests and synchronous parsing, exhausting instance resources, amplifying requests toward third-party servers, or probing network-reachable services even when federation is disabled. This issue is fixed in version 2026.7.0. | ||||
| CVE-2026-104344 | 2026-10-13 | 7.8 High | ||
| Adobe Framemaker is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103967 | 2026-10-13 | 7.8 High | ||
| Adobe Framemaker is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2024-34323 | 2026-10-13 | 10 Critical | ||
| ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request. | ||||
| CVE-2026-86022 | 2026-10-13 | 7 High | ||
| VNote is a note-taking platform. Prior to 4.3.0, SessionConfig::ExternalProgram::fetchCommand wraps a note path in double quotes and substitutes it into a command string that QProcess::start(const QString&) reparses into arguments through ProcessUtils::startDetached. The automatic path in src/controllers/viewareacontroller.cpp and the Open With path in src/controllers/notebooknodecontroller.cpp both reach this sink. On Linux and macOS, an attacker-controlled double quote in a POSIX note filename can terminate the quoted path and add arguments to the victim's configured external program. If the configured program supports an argument that executes commands, such as the vim or gvim -c option, the injected arguments can execute arbitrary commands as the user. This issue is fixed in version 4.3.0. | ||||
| CVE-2026-104585 | 2026-10-13 | N/A | ||
| Mobile Security Framework (MobSF) v4.5.2 is vulnerable to Command Injection in /download_data/, /api/v1/scan, Dynamic Analyzer ADB integration module. | ||||
| CVE-2026-106425 | 1 Google | 1 Chrome | 2026-10-13 | 4.2 Medium |
| Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-64037 | 1 Linux | 1 Linux Kernel | 2026-10-13 | 9.8 Critical |
| In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled When the TLC notification disables AMSDU for a TID, the MLD driver sets max_tid_amsdu_len to the sentinel value 1. The TSO segmentation path in iwl_mld_tx_tso_segment() checks for zero but not for this sentinel, allowing it to reach the num_subframes calculation: num_subframes = (max_tid_amsdu_len + pad) / (subf_len + pad) = (1 + 2) / (1534 + 2) = 0 This zero propagates to iwl_tx_tso_segment() which sets: gso_size = num_subframes * mss = 0 Calling skb_gso_segment() with gso_size=0 creates over 32000 tiny segments from a single GSO skb. This floods the TX ring with ~1024 micro-frames (the rest are purged), creating a massive burst of TX completion events that can lead to memory corruption and a subsequent use-after-free in TCP's retransmit queue (refcount underflow in tcp_shifted_skb, NULL deref in tcp_rack_detect_loss). The MVM driver is immune because it checks mvmsta->amsdu_enabled before reaching the num_subframes calculation. The MLD driver has no equivalent bitmap check and relies solely on max_tid_amsdu_len, which does not catch the sentinel value. Fix this by detecting the sentinel value (max_tid_amsdu_len == 1) at the existing check and falling back to non-AMSDU TSO segmentation. Also add a WARN_ON_ONCE guard after the num_subframes division as defense-in-depth to catch any future code paths that produce zero through a different mechanism. | ||||
| CVE-2026-63697 | 1 Dell | 1 System Update | 2026-10-13 | 7.6 High |
| Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote execution. | ||||
| CVE-2026-86016 | 2026-10-13 | 8.2 High | ||
| VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdownit.js to insert YAML frontmatter metadata into a pre element before the protectFromXss sanitization path runs. Opening an attacker-supplied Markdown note can therefore execute stored JavaScript in the file:// viewer context. Because QWebEngineSettings::LocalContentCanAccessRemoteUrls enables local content to access remote URLs, the script can read reachable local note files and transmit their contents to a remote server without further interaction after the note is opened. This issue is fixed in version 4.3.0. | ||||
| CVE-2026-110118 | 1 Risesoft-y9 | 1 Workflow-engine | 2026-10-13 | 6.5 Medium |
| WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other users' workflow tasks via /vue/buttonOperation endpoints. Low-privileged attackers can supply a known taskId to the complete, completeTask or reAssign handlers to approve tasks or reassign them without authority. | ||||
| CVE-2026-110124 | 1 Kerwincui | 1 Fastbee | 2026-10-13 | 8.1 High |
| FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices. | ||||
| CVE-2026-110115 | 1 Risesoft-y9 | 1 Digital-infrastructure | 2026-10-13 | 7.5 High |
| Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters. Attackers can request the unauthenticated /rest/retrieveFileStream endpoint to retrieve files like application.yml, exposing database, Redis and Nacos credentials. | ||||