Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425425 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425425 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126891 | 1 Google | 1 Chrome | 2026-11-13 | 4.3 Medium |
| Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-126884 | 1 Google | 1 Chrome | 2026-11-13 | 4.7 Medium |
| Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-18633 | 1 Synology | 1 Diskstation Manager | 2026-11-13 | 7.5 High |
| An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to conduct denial-of-service attacks. | ||||
| CVE-2026-19414 | 1 Synology | 1 Diskstation Manager | 2026-11-13 | 4.3 Medium |
| A missing authorization vulnerability in the Promotion API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to write specific files. | ||||
| CVE-2026-52786 | 1 Bacnetstack | 1 Bacnet Stack | 2026-11-13 | 7.1 High |
| BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0. | ||||
| CVE-2026-47259 | 1 Bacnetstack | 1 Bacnet Stack | 2026-11-13 | 8.2 High |
| BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0. | ||||
| CVE-2026-47711 | 1 Bacnetstack | 1 Bacnet Stack | 2026-11-13 | 8.6 High |
| BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0. | ||||
| CVE-2026-15198 | 1 Synology | 1 Diskstation Manager | 2026-11-13 | 6.5 Medium |
| A missing authentication for critical functionality vulnerability in the Webdav API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote attackers to read specific files and conduct limited denial-of-service attacks. | ||||
| CVE-2026-40820 | 3 Helmholz, Mb Connect Line, Mbconnectline | 7 Myrex24v2, Myrex24v2.virtual, Myrex24v2virtual and 4 more | 2026-11-13 | 4.9 Medium |
| A high privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getVpnData function due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality. | ||||
| CVE-2026-127111 | 1 Alinto | 1 Sogo | 2026-11-13 | 7.4 High |
| SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows unauthenticated attackers to reset account passwords by repeatedly guessing secret-question answers via the passwordRecoveryCheck endpoint without lockout or rate limiting. Attackers can submit unlimited candidate answers to obtain a valid recovery JWT, then use it to change the account password without the old credential and log in via the connect endpoint, achieving full account takeover on accounts without TOTP enabled. | ||||
| CVE-2026-127145 | 1 Alinto | 1 Sogo | 2026-11-13 | 4.3 Medium |
| SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the server connect to arbitrary internal host:port destinations by supplying a user-controlled URL to the Calendar/addWebCalendar endpoint. Attackers can trigger a reload of the subscribed web calendar via the reload endpoint and distinguish response outcomes such as connection failures, timeouts, authentication prompts, or invalid content to probe the internal network from the server's position. | ||||
| CVE-2026-127202 | 1 Mlflow | 2 Mlflow, Mlflow/mlflow | 2026-11-13 | 5.3 Medium |
| MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attackers can exploit the unvalidated model_id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE. | ||||
| CVE-2026-121876 | 2 Red Hat, Redhat | 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more | 2026-11-13 | 7.9 High |
| A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery — non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation. | ||||
| CVE-2026-127236 | 2 Opennms, The Opennms Group | 4 Horizon, Meridian, Horizon and 1 more | 2026-11-13 | 5.4 Medium |
| An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and Horizon. The ad-hoc graph endpoint (GET /graph/graph.png?adhoc=true) copies request parameters into the rrdtool command line without validation. A low-privileged authenticated user (ROLE_USER or ROLE_DASHBOARD) can insert extra rrdtool arguments. An injected --daemon argument makes the server connect to an attacker-chosen address, which is a server-side request forgery. An injected DEF statement reads a local RRD file by absolute path. The command runs through exec with an argument array and no shell, so arbitrary operating system command execution is not possible. The fix validates the ad-hoc graph parameters against allowlists. The solution is to upgrade to Meridian 2024.3.15, 2025.0.12, 2026.0.2 and Horizon 36.0.6 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. | ||||
| CVE-2026-45265 | 1 Bacnetstack | 1 Bacnet Stack | 2026-11-13 | 8.2 High |
| BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4 and 1.5.1, there is a stack-based out-of-bounds write / stack-buffer-overflow in bacnet-stack when the server processes a malicious Atomic-Read-File request in record access mode. The bug is triggered on the real server side. A crafted request can set an excessively large RecordCount, which is later used as the loop bound for writing record data into a stack-allocated BACNET_ATOMIC_READ_FILE_DATA data structure. However, the stack object only has space for one fileData element. When the loop reaches i = 1, the code computes &data->fileData[1], which is already out of bounds, and the resulting invalid pointer is passed down to memmove(), causing a stack-buffer-overflow. This issue has been patched in versions 1.4.4 and 1.5.1. | ||||
| CVE-2026-126885 | 1 Google | 1 Chrome | 2026-11-13 | 9.6 Critical |
| Use after free in ServiceWorker in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-126895 | 1 Google | 1 Chrome | 2026-11-13 | 8.8 High |
| Use after free in CSS in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-126911 | 1 Google | 1 Chrome | 2026-11-13 | 8.8 High |
| Use after free in Accessibility in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||
| CVE-2026-126889 | 1 Google | 1 Chrome | 2026-11-13 | 8.8 High |
| Off-by-one error in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-126886 | 1 Google | 1 Chrome | 2026-11-13 | 8.8 High |
| Use after free in Frames in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||