Export limit exceeded: 420374 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (420374 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-88126 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-06 | 7.8 High |
| Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88135 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-06 | 7.8 High |
| Improper access control in WebDAV allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-88136 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-11-06 | 8.8 High |
| Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network. | ||||
| CVE-2024-5742 | 2 Gnu, Redhat | 3 Nano, Enterprise Linux, Rhel Els | 2026-11-06 | 6.7 Medium |
| A vulnerability was found in GNU Nano that allows a possible privilege escalation through an insecure temporary file. If Nano is killed while editing, a file it saves to an emergency file with the permissions of the running user provides a window of opportunity for attackers to escalate privileges through a malicious symlink. | ||||
| CVE-2026-123664 | 1 Nasa-gcn | 1 Gcn.nasa.gov | 2026-11-06 | 5.4 Medium |
| A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-92396 | 2026-11-06 | 6.8 Medium | ||
| The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's capabilities or the ownership of the targeted post in one of its AJAX actions, and does not escape the stored value before outputting it in a JavaScript context, allowing users with a role as low as contributor to inject arbitrary scripts into any post that will run when a higher privileged user edits it. | ||||
| CVE-2026-118188 | 2026-11-06 | 4.3 Medium | ||
| The PublishPress Revisions: Duplicate Posts, Submit, Approve and Schedule Content Changes WordPress plugin before 4.3.1 does not verify that a user is permitted to read a given post before returning its content through its revision-comparison feature, allowing any authenticated user, including a Subscriber, to read the title, content and excerpt of any other user's private, draft, pending, scheduled or trashed post. | ||||
| CVE-2026-88800 | 2026-11-06 | 9.1 Critical | ||
| The MDJM Event Management and Mobile Events Manager WordPress plugins through 1.7.8.7 act on a role deletion request on every page load with no capability check and no nonce, and the guard meant to protect roles that have users assigned reads a different part of the request from the one that selects what is deleted, allowing unauthenticated attackers to remove any WordPress role including administrator, which permanently strips every user of their capabilities. | ||||
| CVE-2024-49395 | 3 Mutt, Neomutt, Redhat | 4 Mutt, Neomutt, Enterprise Linux and 1 more | 2026-11-06 | 5.3 Medium |
| In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info. | ||||
| CVE-2024-49394 | 3 Mutt, Neomutt, Redhat | 4 Mutt, Neomutt, Enterprise Linux and 1 more | 2026-11-06 | 5.3 Medium |
| In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender. | ||||
| CVE-2026-59105 | 2026-11-06 | 9.8 Critical | ||
| Jumis (formerly Tildes Jumis) creates and uses a Microsoft SQL Server login named ##Tilde_JumisAdmin## whose password is derived deterministically from a single non-secret input - the SQL Server name (@@servername). The derivation algorithm is hard-coded in the client application and is identical across every installation; it contains a hard-coded secret key for entropy. Because the only input (the server name) is not secret - the instance suffix is hard-coded and the host name is discoverable via the SQL Server Browser service (UDP 1434), the TDS pre-login response, or DNS/NetBIOS - any party able to reach a Jumis SQL Server can compute the password offline and authenticate. The ##Tilde_JumisAdmin## login is a member of the sysadmin server role. Successful authentication therefore grants full administrative control of the SQL Server instance and read/write access to every customer's accounting database hosted on it. The on-premise server installation also programmatically enables xp_cmdshell during routine operation, so sysadmin access escalates to operating-system command execution on the database server. | ||||
| CVE-2026-112535 | 1 Apple | 1 Macos | 2026-11-06 | 4.7 Medium |
| A race condition was addressed with improved handling of symbolic links. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to modify protected parts of the file system. | ||||
| CVE-2024-4029 | 1 Redhat | 7 Build Keycloak, Jboss Bpms, Jboss Data Grid and 4 more | 2026-11-06 | 4.1 Medium |
| A vulnerability was found in Wildfly’s management interface. Due to the lack of limitation of sockets for the management interface, it may be possible to cause a denial of service hitting the nofile limit as there is no possibility to configure or set a maximum number of connections. | ||||
| CVE-2026-112536 | 1 Apple | 1 Macos | 2026-11-06 | 7.7 High |
| An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to cause unexpected system termination or write kernel memory. | ||||
| CVE-2026-112537 | 1 Apple | 1 Macos | 2026-11-06 | 4 Medium |
| This issue was addressed with improved data protection. This issue is fixed in macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2. An app may be able to read sensitive location information. | ||||
| CVE-2026-78192 | 1 Perl | 1 Webdyne | 2026-11-06 | 7.5 High |
| WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page. WebDyne's wrapper scripts, such as webdyne.psgi, enable the built-in index page by default. Its source viewer returns files under the document root named in the source parameter of an HTMX request, including .psp, .pm and .pl files. A remote attacker can read the application's Perl code, including the __PERL__ blocks of .psp pages and any credentials they hold. | ||||
| CVE-2026-78188 | 1 Perl | 1 Webdyne | 2026-11-06 | 5.4 Medium |
| WebDyne versions from 2.014 before 3.022 for Perl issue session cookies without the Secure, HttpOnly and SameSite attributes. WebDyne::Session sets its session cookie with only a name, value and path. Browsers then send the session ID over plain HTTP and with cross-site requests, and expose it to page scripts. A network attacker or an injected script can steal the session, and another site can make requests that carry it. | ||||
| CVE-2026-118582 | 1 Drupal | 1 Captcha | 2026-11-06 | 7.3 High |
| Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA allows Functionality Bypass. This issue affects CAPTCHA versions: from 0.0.0 to 1.18.0, from 2.0.0 to 2.0.11. | ||||
| CVE-2026-118574 | 1 Drupal | 1 S3 File System | 2026-11-06 | 5.6 Medium |
| Incorrect Permission Assignment for Critical Resource vulnerability in Drupal S3 File System allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects S3 File System versions: from 0.0.0 to 3.12.0. | ||||
| CVE-2026-118570 | 1 Drupal | 1 Fasttoggle | 2026-11-06 | 6.5 Medium |
| Cross-Site Request Forgery (CSRF) vulnerability in Drupal Fasttoggle allows Cross Site Request Forgery. This issue affects Fasttoggle versions: from 0.0.0 to 4.1.1. | ||||