Export limit exceeded: 421737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421737 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421737 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-121411 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 3.1 Low |
| FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdp_image_scale stride assertion failures that terminate the client. | ||||
| CVE-2026-121407 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 6.5 Medium |
| FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions. | ||||
| CVE-2026-121403 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 4.3 Medium |
| FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a truncated IRP_MJ_CREATE body silently kills the drive worker. A malicious RDP server can send such an IRP then post further requests that accumulate unbounded in the IrpQueue, exhausting memory and causing session availability loss. | ||||
| CVE-2026-121399 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 4.3 Medium |
| FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD Gateway to force a 2 GiB client allocation before tunnel authentication. Attackers can send an eight-byte RDG header declaring packet length 0x7FFFFFFF to trigger pre-authentication memory exhaustion and denial of service. | ||||
| CVE-2026-121395 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 6.5 Medium |
| FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process. | ||||
| CVE-2026-121391 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 4.3 Medium |
| FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close previous descriptors on repeated IRP_MJ_CREATE requests. A hostile RDP server with parallel-device redirection enabled can send repeated CREATE requests to exhaust the client descriptor table and crash the process. | ||||
| CVE-2026-121387 | 1 Freerdp | 1 Freerdp | 2026-11-09 | 4.3 Medium |
| FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client. | ||||
| CVE-2026-120833 | 1 Nist | 1 Labbench | 2026-11-09 | 7.8 High |
| labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read() and read_relational() that passes any file with a .p or .pickle extension to pandas.read_pickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute arbitrary code when a user loads it with these functions. | ||||
| CVE-2026-120830 | 1 Redhat | 2 Enterprise Linux, Openshift | 2026-11-09 | 7.4 High |
| A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host memory into the ICMP error packet returned to a guest or container. | ||||
| CVE-2026-120503 | 1 Echohs | 1 Geekezbrowser | 2026-11-09 | 3.3 Low |
| A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading to version 1.8.1 is able to mitigate this issue. The patch is identified as 9317a89aa0fd2715d9c2bd27bdbb52b5d228dd9e. Upgrading the affected component is recommended. | ||||
| CVE-2026-120115 | 1 Ibm | 1 Aspera Connect | 2026-11-09 | 6.3 Medium |
| IBM Aspera Connect 1.6.1 through 4.2.19 fails to consistently enforce origin verification across all REST API endpoints. An attacker who convinces a user to visit a malicious website could delete or inspect account configurations. | ||||
| CVE-2026-119739 | 2 Amlogic, Nexbox | 2 Amlogic Android Sdk, A95x | 2026-11-09 | 5.3 Medium |
| The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService), as shipped on Nexbox A95X (Amlogic S905X) TV boxes, contains an out-of-bounds write vulnerability in vob_fill_pixel() that allows remote attackers to corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. Attackers can exploit this by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file to zero out adjacent stack bytes, resulting in silent stack corruption or process crash. | ||||
| CVE-2026-119735 | 1 Petpooja | 1 Munshi | 2026-11-09 | 5.4 Medium |
| Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malicious markup through item descriptions or messages submitted in the Purchase Inquiry thread (/purchase-inquiry/thread/{thread-id}), which is assigned to innerHTML during rendering before text cleaning completes. Attackers can store a payload that executes in the browser of another user who opens the affected thread, achieving JavaScript execution and full-page defacement that re-triggers whenever the thread is reopened. | ||||
| CVE-2026-119731 | 1 Petpooja | 1 Munshi | 2026-11-09 | 7.5 High |
| Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/order/webhook, which lacks webhook authentication, cryptographic signature verification, source validation, and independent server-side confirmation with the payment provider. A remote, unauthenticated attacker can submit a forged payment-success notification referencing an order obtained from the payment-status redirect URL, causing the backend to mark the subscription as paid/active and granting paid access without an actual successful payment. | ||||
| CVE-2026-119506 | 2026-11-09 | 9.1 Critical | ||
| Incorrect Privilege Assignment vulnerability in DynamiApps Frontend Admin by DynamiApps acf-frontend-form-element allows Privilege Escalation.This issue affects Frontend Admin by DynamiApps: from n/a through 3.30.1. | ||||
| CVE-2026-119474 | 1 Havelsan | 1 Liman Render Engine | 2026-11-09 | 7.8 High |
| Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc. Liman Render Engine allows Privilege Escalation. This issue affects Liman Render Engine: before 1.2-81. | ||||
| CVE-2026-113698 | 1 Ibm | 1 Db2 | 2026-11-09 | 6.5 Medium |
| IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when executing a specially crafted query with a Materialized Query Table. | ||||
| CVE-2026-108284 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-11-09 | 6.5 Medium |
| IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information. | ||||
| CVE-2026-105979 | 1 Welotec | 3 Tk100, Tk500 V2, Tk500 V3 | 2026-11-09 | 7.2 High |
| Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execute them with root privileges. | ||||
| CVE-2026-103320 | 1 Ibm | 1 Websphere Application Server Liberty | 2026-11-09 | 4.3 Medium |
| IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information. | ||||