Export limit exceeded: 55228 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 12012 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423983 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423983 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423983 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-111257 | 2026-11-10 | N/A | ||
| With the default configuration and no users defined in the default user database, TomEE silently adds an administrative user with a well-known password at startup. A remote attacker can use these credentials to authenticate to web applications that use the default realm and grant access to any authenticated user or to the TomEE administrative role. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-111258 | 2026-11-10 | N/A | ||
| The optional request routing feature forwards requests to their configured destination without applying the security constraints of that destination or the protection of the web application's private directories. If a route copies client-controlled parts of the request path into its destination, a remote attacker can reach protected resources or read application configuration and class files. Only installations with such a routing configuration are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-84042 | 2 Containers, Redhat | 5 Crun, Enterprise Linux, Hardened Images and 2 more | 2026-11-10 | 7.8 High |
| A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. The issue is a regression in crun 1.29. It affects crun >= 1.29 | ||||
| CVE-2026-111259 | 2026-11-10 | N/A | ||
| The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by default. A remote attacker who observes a session identifier can predict the identifiers issued to other users and hijack their sessions, if the application relies on HTTP sessions for authentication. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-91582 | 1 Oracle | 1 Business Intelligence | 2026-11-10 | 3.7 Low |
| Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Business Intelligence Enterprise Edition. CVSS 3.1 Base Score 3.7 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). | ||||
| CVE-2026-124952 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox ESR 115.45. | ||||
| CVE-2026-121248 | 1 Google | 1 Chrome | 2026-11-10 | 6.5 Medium |
| Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium) | ||||
| CVE-2026-121231 | 1 Google | 1 Chrome | 2026-11-10 | 6.5 Medium |
| Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2025-15400 | 2 Openpix, Wordpress | 2 Pix Para Woocommerce, Wordpress | 2026-11-10 | 6.5 Medium |
| The OpenPix for WooCommerce WordPress plugin before 2.13.6 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration options without capability or nonce checks. This permits any authenticated users, such as subscribers to clear API credentials and webhook status, causing persistent disruption of OpenPix payment functionality. | ||||
| CVE-2026-111260 | 2026-11-10 | N/A | ||
| The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-cryptographic random number generator and insufficient entropy. A remote attacker who predicts these values can forge an authentication callback that logs a victim into the attacker's account, and the replay protection for ID tokens is weakened. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-111261 | 2026-11-10 | N/A | ||
| The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows unauthenticated binds, which some directory servers do by default. A remote attacker can then authenticate as any existing user without knowing the password. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-111262 | 2026-11-10 | N/A | ||
| The Jakarta Security LDAP identity store does not neutralize special characters in the caller name before using it in directory queries. A remote unauthenticated attacker can alter the queries to enumerate accounts, infer directory attribute values, or influence which directory entry the login is validated against. Only applications using the LDAP identity store are affected. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-111263 | 2026-11-10 | N/A | ||
| Authentication configured for an EJB JAX-WS endpoint in the TomEE deployment descriptor is not enforced when the endpoint is published within an existing web application. A remote unauthenticated attacker can invoke the web service operations, unless the application protects the endpoint with its own web.xml security constraints or EJB method permissions. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-111264 | 2026-11-10 | N/A | ||
| The security constraint generated for EJB JAX-WS endpoints with configured authentication protects only some HTTP methods. A remote unauthenticated attacker can bypass authentication by sending requests with another HTTP method. Users are recommended to upgrade to version 10.3.0 or 11.0.0-M2, which fix the issue. | ||||
| CVE-2026-92910 | 1 Adobe | 6 Adobe Commerce, Adobe Commerce B2b, Commerce and 3 more | 2026-11-10 | 7.2 High |
| Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-92911 | 1 Adobe | 6 Adobe Commerce, Adobe Commerce B2b, Commerce and 3 more | 2026-11-10 | 8.7 High |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. | ||||
| CVE-2026-92922 | 1 Adobe | 6 Adobe Commerce, Adobe Commerce B2b, Commerce and 3 more | 2026-11-10 | 8.1 High |
| Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed. | ||||
| CVE-2026-95631 | 1 Adobe | 6 Adobe Commerce, Adobe Commerce B2b, Commerce and 3 more | 2026-11-10 | 8.7 High |
| Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed. | ||||
| CVE-2026-103855 | 3 Adobe, Apple, Microsoft | 3 Dimension, Macos, Windows | 2026-11-10 | 5.5 Medium |
| Dimension is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||
| CVE-2026-103854 | 3 Adobe, Apple, Microsoft | 3 Dimension, Macos, Windows | 2026-11-10 | 7.8 High |
| Dimension is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | ||||