Export limit exceeded: 424665 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424665 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124078 | 1 Tootallnate | 1 Plist.js | 2026-11-10 | 7.5 High |
| plist.js (npm package 'plist') before 5.0.1 contains an uncontrolled resource consumption vulnerability in the binary property-list parser (parseBinary) that allows unauthenticated attackers to crash a Node.js process by exploiting unmemoized recursive resolution of shared object references for arrays and dictionaries. Attackers can craft a small binary plist (under 200 bytes) containing chained self-referencing object indices to trigger exponential (2^N) resolution calls and memory growth, causing an unrecoverable out-of-memory crash and denial of service. | ||||
| CVE-2026-124030 | 1 Gpac | 1 Gpac | 2026-11-10 | 5.5 Medium |
| GPAC through 26.07.0 contains a type confusion vulnerability in gf_sg_command_apply() in src/scenegraph/commands.c that fails to verify BIFS field-replace command types match target node fields. Attackers can supply a crafted XMT file opened with MP4Box, such as via chapter import, causing gf_sg_vrml_field_clone() to memcpy from invalid pointers and crash. | ||||
| CVE-2026-124026 | 2 Barassistant, Karlomikus | 2 Bar Assistant, Bar-assistant | 2026-11-10 | 4.3 Medium |
| Bar Assistant 6.0.0-rc1 before 6.11.0 contains an incorrect authorization vulnerability in CocktailController::copy that allows registered users to bypass source cocktail membership checks. Attackers owning a bar can POST to /api/cocktails/{id}/copy with other bars' cocktail ids to copy private recipes and images into their own bar. | ||||
| CVE-2026-123996 | 1 Hisense | 1 Vidaa | 2026-11-10 | 4.6 Medium |
| Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains a missing authentication vulnerability in the UPnP/DLNA RenderingControl service on TCP port 38400 that allows a LAN-adjacent attacker to issue SetVolume, SetMute, and SelectPreset(FactoryDefaults) commands after a one-time DLNA pairing with no per-command authentication or session token. Attackers can send a continuous loop of unauthenticated commands to override the physical remote, change volume and mute, and reset all picture and audio calibration settings. | ||||
| CVE-2026-123976 | 1 Teunis Van Beelen | 1 Edfbrowser | 2026-11-10 | 5.5 Medium |
| EDFbrowser before 2.16 contains an out-of-bounds write vulnerability in check_edf_file() that allows attackers to overflow the 256-element annot_ch array by supplying excessive annotation signals. Attackers can craft an EDF+ or BDF+ file with more than 256 annotation signals to overwrite edfhdrblock members, including the signal parameter pointer, crashing the application when opened. | ||||
| CVE-2026-123876 | 3 Containers, Red Hat, Redhat | 7 Podman, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-10 | 4.4 Medium |
| A flaw was found in the default seccomp profile used by Podman via containers-common. Deny rules for AF_VSOCK and NETLINK_AUDIT compared socket arguments with unmasked 64-bit equality. Because the kernel truncates those int arguments to 32 bits, setting upper bits can bypass the deny rules. | ||||
| CVE-2026-123664 | 1 Nasa-gcn | 1 Gcn.nasa.gov | 2026-11-10 | 5.4 Medium |
| A security flaw has been discovered in nasa-gcn gcn.nasa.gov up to b299b562af665878964b981a459f0a9c04b11adf. This issue affects some unknown processing of the file /user/email of the component Email Notification Handler. Performing a manipulation of the argument Recipient results in improper authorization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The pull request to fix this issue awaits acceptance. | ||||
| CVE-2026-120822 | 2026-11-10 | 6.7 Medium | ||
| MongoDB Server may omit an authorization check on the resource that a replication-related administrative command actually targets, because that check is conditioned on a value taken from the client's own request. A user holding backup and restore privileges may therefore read and relocate collections outside the set that user is permitted to access. This may result in unintended access to data and unintended changes to the collection catalog. | ||||
| CVE-2026-115646 | 2026-11-10 | 9.8 Critical | ||
| Partial String Comparison Vulnerability in HiRDB. This issue affects HiRDB Server Version 10: from 10-00 before 10-12-01; HiRDB Server Version 9: from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9: from 09-50-/F through 09-66/V; HiRDB Server Version 9(32): from 09-50-06 through 09-66-22; HiRDB Server with Additional Function Version 9(32): from 09-50-/F through 09-66-/V. | ||||
| CVE-2026-115640 | 1 Limesurvey | 1 Limesurvey Community Edition | 2026-11-10 | N/A |
| LimeSurvey Community Edition 7.7.0 contains a stored cross-site scripting vulnerability in the Central Participants Database blocklist control. An authenticated user with only global participantpanel:import permission can import a CSV participant_id containing HTML. The import flow persists that value without model validation. When a CPDB editor opens the participant list, LimeSurvey derives ButtonGroupWidget id and name attributes from participant_id and inserts them without HTML encoding, causing attacker-controlled markup to execute in the victim's authenticated LimeSurvey origin. Exploitation can access session-exposed data and issue same-origin requests with the victim's effective permissions. | ||||
| CVE-2026-112908 | 1 Tox-dev | 1 Filelock | 2026-11-10 | 5.3 Medium |
| filelock is a platform-independent file lock for Python. From version 3.30.0 until version 4.2.1, StrictSoftFileLock and AsyncStrictSoftFileLock on POSIX systems create coordination and claim directories without applying the caller’s restrictive lock mode. A permissive umask or inherited default ACL can leave these directories writable by another local user, allowing that user to delete an active holder’s claims. Another authorized process can then acquire the lock while the original holder remains in its critical section. An attacker can also plant malformed claims to prevent acquisition. This issue is fixed in version 4.2.1. | ||||
| CVE-2026-120821 | 2026-11-10 | 6.5 Medium | ||
| A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an aggregation sub-pipeline. The condition can be caused by an authenticated user with read privileges, and may result in the server terminating unexpectedly. | ||||
| CVE-2026-112336 | 1 Wazuh | 1 Wazuh | 2026-11-10 | 6.5 Medium |
| Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows remote attackers to exhaust wazuh-analysisd memory via repeated static fields. Attackers can enroll an agent through passwordless enrollment and send events with duplicate fields such as id, triggering an OOM kill that disables alerting. | ||||
| CVE-2026-112125 | 2026-11-10 | 7.3 High | ||
| Incorrect Permission Assignment for Critical Resource Vulnerability in HA Monitor. This issue affects HA Monitor: from 01-00 before 01-83-01. | ||||
| CVE-2026-109799 | 2026-11-10 | 7.5 High | ||
| The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider. | ||||
| CVE-2026-109798 | 2026-11-10 | 9.1 Critical | ||
| SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, enabling them to read sensitive files on the server and reach internal systems that are not otherwise exposed, impacting resources beyond the vulnerable component, resulting in a high impact on confidentiality and a low impact on both integrity and availability. | ||||
| CVE-2026-109797 | 2026-11-10 | 7.1 High | ||
| In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware session lookup path, allowing cross-tenant container operations such as listing, exposing or proxying, and deleting containers.The issue affects only the legacy Incus backend. Kubernetes and OpenShell deployments are not affected because the relevant Incus-specific handlers are unavailable there. | ||||
| CVE-2026-109081 | 2 Keycloak, Redhat | 3 Keycloak, Build Keycloak, Red Hat Single Sign On | 2026-11-10 | 6.8 Medium |
| A flaw was found in Keycloak. The Dynamic Client Registration (DCR) endpoint does not properly validate authorization when processing the deprecated defaultRoles field. An authenticated attacker with client creation privileges or an Initial Access Token (IAT) can inject excessive roles into the realm's default roles configuration. This causes clients across the realm to generate bloated access tokens, resulting in performance and memory degradation that can lead to a Denial of Service (DoS). | ||||
| CVE-2026-102650 | 1 Nuxt | 1 Content | 2026-11-10 | 7.5 High |
| Nuxt Content is the file-based CMS for Nuxt applications, powered by Markdown and Vue components. From 3.0.0 until 3.15.2, the unauthenticated POST /__nuxt_content/:collection/query endpoint accepts an attacker-controlled sql field in src/runtime/api/query.post.ts and permits expensive SQLite expressions. Version 3.0.0 performed no query validation; in affected releases using assertSafeQuery in src/runtime/internal/security.ts, the reported validation gap rejects a short list of SQL command keywords in WHERE clauses but permits function calls including randomblob(), zeroblob(), hex(), and length(). The query reaches the synchronous better-sqlite3 sink in src/runtime/internal/database.server.ts, allowing a single remote request to consume substantial CPU and memory while blocking the Node.js event loop and all concurrent request handling. Fully static prerendered deployments that do not expose the server endpoint are not affected. This issue is fixed in version 3.15.2. | ||||
| CVE-2026-120820 | 2026-11-10 | 4.3 Medium | ||
| MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field information. Entries are created for any namespace supplied in a request, with no limit on the number of entries and no way to remove entries that never corresponded to a real collection. A user with basic read privileges who repeatedly issues ordinary read commands referencing arbitrary namespace names may cause the server process to retain steadily increasing amounts of memory and to slow down on the affected code path; the memory is reclaimed only by restarting the process. | ||||