Export limit exceeded: 425712 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425712 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425712 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-126294 | 1 Getgrav | 1 Grav | 2026-11-13 | 7.5 High |
| Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account password to skip two-factor verification when the global twofa_enabled setting is off. Attackers can sign in through the /login form, remember-me cookie, or magic link to obtain a session the API plugin accepts, gaining full account permissions including super-admin control. | ||||
| CVE-2026-126295 | 1 Nltk | 1 Nltk | 2026-11-13 | 6.8 Medium |
| NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to open files outside NLTK data roots by supplying unvalidated model paths. Attackers controlling parser_model, reranker_features, reranker_weights, or from_unified_model_dir() input can make the bllipparser C extension read sensitive files or block on FIFOs and devices. | ||||
| CVE-2026-126296 | 1 Nltk | 1 Nltk | 2026-11-13 | 4.8 Medium |
| NLTK before 3.10.4 contains a path traversal vulnerability in save_maxent_params() and load_maxent_params() that bypasses the pathsec filesystem restriction mechanism. Attackers who control the tab_dir argument can read or overwrite model parameter files outside permitted data roots, because the functions call Python's built-in open() directly. | ||||
| CVE-2026-126297 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains a quadratic-time denial of service vulnerability in ConllCorpusReader._get_srl_instances that allows remote attackers to exhaust CPU through nested span rescans. Attackers can supply a crafted CoNLL SRL corpus with many predicates and span columns, placing the head span last, to pin a core for minutes. | ||||
| CVE-2026-126298 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers to exhaust CPU through quadratic-time right-factor binarization using list.pop(0). Attackers can supply a wide flat treebank tree parsed by Tree.fromstring to force tens of seconds of single-threaded CPU consumption, blocking the processing thread. | ||||
| CVE-2026-126299 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote attackers to exhaust CPU by supplying wide inputs. Attackers can submit lexicon text with long flat bracket bodies or operator chains, triggering quadratic string re-slicing in matchBrackets and augParseCategory that blocks worker threads. | ||||
| CVE-2026-126300 | 1 Nltk | 1 Nltk | 2026-11-13 | 5.3 Medium |
| NLTK from 3.2.5 before 3.10.4 contains an algorithmic complexity vulnerability in TreebankWordTokenizer.span_tokenize that allows remote attackers to cause quadratic CPU consumption through repeated list.pop(0) calls. Attackers can submit long runs of double-quote characters to services span-tokenizing untrusted text, exhausting a CPU core and degrading availability. | ||||
| CVE-2026-126301 | 1 Nltk | 1 Nltk | 2026-11-13 | 5.3 Medium |
| NLTK from 3.6 before 3.10.4 contains an algorithmic complexity vulnerability in LegalitySyllableTokenizer.tokenize that allows remote attackers to exhaust CPU by supplying long all-vowel tokens. Attackers can submit a token such as a long run of vowels, causing the unguarded onset reversal loop to perform quadratic work and deny service to syllabification components. | ||||
| CVE-2026-126302 | 1 Nltk | 1 Nltk | 2026-11-13 | 3.3 Low |
| NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses the pathsec data-root sandbox containment check. Attackers who can write into a trusted NLTK data root can plant a symbolic link to read SQLite databases outside the sandbox. | ||||
| CVE-2026-126303 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in SteppingRecursiveDescentParser.parse() that lacks any max_time deadline or step limit. Attackers influencing the grammar can supply an ambiguous self-embedding grammar and short token input to force unbounded top-down search, pinning CPU cores and exhausting worker pools. | ||||
| CVE-2026-126304 | 1 Nltk | 1 Nltk | 2026-11-13 | 7.5 High |
| NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to read files outside the corpus root by planting psd or pos directory symlinks. Attackers controlling a YCOE corpus can make parsed_sents() and tagged_words() return file content from other corpora or temporary files within the NLTK data sandbox. | ||||
| CVE-2026-126305 | 1 Espocrm | 1 Espocrm | 2026-11-13 | 7.3 High |
| EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base articles that lets users with Knowledge Base create or edit access attach a JavaScript file and add a crafted link to the article body. When an administrator clicks the link, the script runs in their session and can create an administrator account with attacker-chosen credentials. | ||||
| CVE-2026-126306 | 1 Espocrm | 1 Espocrm | 2026-11-13 | 8 High |
| EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows low-privileged users to upload crafted SVG images that submit authenticated POST requests to arbitrary backend endpoints. Attackers can trick an administrator into opening the SVG in a separate browser tab and clicking it, performing administrator actions such as elevating the attacker's account to administrator. | ||||
| CVE-2026-126308 | 1 Coder | 1 Coder | 2026-11-13 | 7.7 High |
| The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6, and 2.38.0 before 2.38.2 replaces the $SESSION_TOKEN placeholder in external app URLs with a full-access API key without checking whether the app belongs to a sub-agent. Code running in a workspace can register a disguised sub-agent app with a custom protocol URL, so the owner's click sends their API key to an attacker-chosen destination. | ||||
| CVE-2026-126309 | 1 Openbao | 1 Openbao | 2026-11-13 | 7.1 High |
| OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated attackers to bypass name restrictions in ACL policies. Attackers limited by a required_parameters name constraint can craft traversal sequences during import to write key material under arbitrary Transit key names. | ||||
| CVE-2026-126310 | 1 Openbao | 1 Openbao | 2026-11-13 | 8.7 High |
| OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to obtain OIDC ID tokens by abusing public clients with client_credentials enabled. Attackers who know a public client's client_id can request tokens from the identity/oidc/provider/<name>/token endpoint to impersonate the client without any secret. | ||||
| CVE-2026-126311 | 1 Openbao | 1 Openbao | 2026-11-13 | 5.8 Medium |
| OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals rendered from unvalidated external token metadata via identity templates in the SSH secrets engine. Attackers controlling that metadata, typically through a compromised identity provider, can inject '*' to obtain SSH certificates valid for multiple hosts or users. | ||||
| CVE-2026-126312 | 1 Openbao | 1 Openbao | 2026-11-13 | 7.1 High |
| OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain an ACL bypass in the AppRole, Cert, LDAP, and RADIUS auth methods caused by implicit path canonicalization. Authenticated attackers can request non-canonical paths for AppRole Role IDs, Cert CRLs, LDAP groups and users, or RADIUS users to evade ACL deny rules. | ||||
| CVE-2026-126323 | 1 Vvveb | 1 Vvveb | 2026-11-13 | 4.3 Medium |
| Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf() in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET request to delete admin/user accounts, sites, orders, and menus or change comment status. | ||||
| CVE-2026-126369 | 1 Vvveb | 1 Vvveb | 2026-11-13 | 5.4 Medium |
| Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft. | ||||