Export limit exceeded: 424885 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424885 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424885 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110697 | 1 Redhat | 2 Openshift Update Service, Quay | 2026-11-12 | 9.9 Critical |
| A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled namespace names without escaping wildcard metacharacters. An attacker who creates a namespace containing an underscore character can match and retrieve robot accounts and their decrypted authentication tokens from other tenants' namespaces, leading to cross-tenant credential theft and unauthorized image operations. | ||||
| CVE-2026-122095 | 2026-11-12 | 7.6 High | ||
| AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. An authenticated user with ordinary application privileges can upload an SVG file containing embedded JavaScript, which is served from the application origin. Normal menu rendering uses an HTML <img> element and does not execute the SVG script; exploitation requires a victim to load the uploaded SVG as a document (by directly navigating to its URL, or via <object>/<iframe>), in which case the script executes under the application origin. | ||||
| CVE-2026-121528 | 1 Fortinet | 1 Fortios | 2026-11-12 | 7.7 High |
| A improper certificate validation vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.13 may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the SSLVPN web portal and the backend destination website. | ||||
| CVE-2026-106140 | 2 Progress, Progress Software | 2 Telerik Reporting, Telerik Reporting | 2026-11-12 | 7.3 High |
| In Progress® Telerik® Reporting prior to version 20.3.26.1110, a deserialization of untrusted data vulnerability in the .NET Framework report designers allows a local attacker with low privileges to execute arbitrary code in the context of the designer process when the user performs certain editing operations. | ||||
| CVE-2026-114369 | 1 Qt | 3 Qt, Qt Framework, Qtwebsockets | 2026-11-12 | N/A |
| Resource exhaustion vulnerability in the Qt Framework QWebSocket and QWebSocketServer classes of the Qt WebSockets module | ||||
| CVE-2026-111760 | 1 Git | 1 Git | 2026-11-12 | 8.8 High |
| A flaw was found in Git. Unsafe handling of submodule-related repository metadata during recursive clone operations can lead to arbitrary code execution. A remote attacker could exploit this vulnerability by supplying a crafted repository that triggers unauthorized command execution on the host system when cloned recursively. | ||||
| CVE-2026-114466 | 1 Git | 1 Git | 2026-11-12 | 4.4 Medium |
| Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe | ||||
| CVE-2026-114467 | 2 Git, Git-scm | 2 Git, Git | 2026-11-12 | 3.3 Low |
| Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures | ||||
| CVE-2026-114469 | 1 Git | 1 Git | 2026-11-12 | 4.4 Medium |
| Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size | ||||
| CVE-2026-127058 | 2026-11-12 | 4.9 Medium | ||
| WonderCMS before 3.7.0 contains an unverified password change vulnerability in the saveAction functionality that allows an authenticated attacker to change the administrator password without re-authentication. Attackers can exploit this missing re-verification check during password changes to bypass re-authentication controls and maintain or escalate unauthorized access to the administrative account. | ||||
| CVE-2026-97845 | 1 Qt | 3 Qt, Qt5compat, Qtbase | 2026-11-12 | N/A |
| An uncontrolled recursion vulnerability has been discovered in the Qt QXmlSimpleReader XML parsing functionality of the Qt 5 Core Compatibility APIs module (Qt 6) and the Qt XML module (Qt 5). | ||||
| CVE-2026-121530 | 1 Fortinet | 1 Fortios | 2026-11-12 | 5.9 Medium |
| A improper authentication vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6 may allow a remote authenticated attacker to gain improper access control via an invalid token after entering a valid username and password | ||||
| CVE-2026-125285 | 2026-11-12 | N/A | ||
| Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane. This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21. | ||||
| CVE-2026-125870 | 2026-11-12 | 4.2 Medium | ||
| BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored. | ||||
| CVE-2026-121526 | 1 Fortinet | 1 Fortiauthenticator | 2026-11-12 | 5.8 Medium |
| A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests. | ||||
| CVE-2026-121527 | 1 Fortinet | 1 Forticlientems | 2026-11-12 | 6.3 Medium |
| A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands. | ||||
| CVE-2026-119818 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.8 High |
| Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119847 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.8 High |
| Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119852 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 6.7 Medium |
| Missing authorization in Windows Installer allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119855 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 5.5 Medium |
| Buffer over-read in Windows COM+ Event System Service allows an authorized attacker to disclose information locally. | ||||