Export limit exceeded: 422303 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (422303 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-17386 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.1 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 could allow a remote attacker to gain full administrative control due to the use of a cryptographically weak pseudo-random number generator. | ||||
| CVE-2026-17381 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization validation using user-controlled keys. | ||||
| CVE-2026-17343 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.1 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to bypass authorization checks to access or modify sensitive information due to improper authorization. | ||||
| CVE-2026-17338 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.1 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to broken object-level authorization. | ||||
| CVE-2026-17333 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8 High |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to bypass authentication and inject unauthorized configuration changes due to improper certificate validation. | ||||
| CVE-2026-17328 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Input checks are incomplete, which could allow them to be bypassed. | ||||
| CVE-2026-17313 | 1 Ibm | 1 Api Connect | 2026-11-09 | 9.8 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information and take control of gateway configuration due to authentication bypass via an alternate path. | ||||
| CVE-2026-17308 | 1 Ibm | 1 Api Connect | 2026-11-09 | 6.8 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive credentials and manipulate tool responses due to improper certificate validation. | ||||
| CVE-2026-17228 | 1 Ibm | 1 Api Connect | 2026-11-09 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. Destination restrictions on outbound requests can be bypassed, which could allow the server to retrieve content from unintended resources. | ||||
| CVE-2026-17167 | 1 Ibm | 1 Api Connect | 2026-11-09 | 4.3 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to falsify audit log information due to reliance on untrusted inputs. Information supplied by the client is relied on when recording the source of a request, so audit records could contain inaccurate details. | ||||
| CVE-2026-17139 | 1 Ibm | 1 Api Connect | 2026-11-09 | 5.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session. | ||||
| CVE-2026-17129 | 1 Ibm | 1 Api Connect | 2026-11-09 | 7.6 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information and cause a denial of service due to an insecure direct object reference. | ||||
| CVE-2026-124316 | 1 Frappe | 1 Erpnext | 2026-11-09 | 4.3 Medium |
| Frappe ERPNext before 15.121.4 and 16.x before 16.36.0 contains a missing authorization vulnerability in the whitelisted erpnext.buying.utils.get_linked_material_requests method lacking document or company permission checks. Authenticated users, including portal users or users without roles, can supply item codes to retrieve open Purchase-type Material Requests belonging to other companies. | ||||
| CVE-2026-124060 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-09 | 9.1 Critical |
| A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.884. Affected by this issue is the function UploadCustomModule of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument File results in buffer overflow. The attack may be launched remotely. The exploit is now public and may be used. | ||||
| CVE-2026-124039 | 1 Gitleaks | 1 Gitleaks | 2026-11-09 | 3.3 Low |
| Gitleaks through 8.30.1 contains an incorrect permission assignment vulnerability that allows local users to read scan reports because cmd/root.go creates the --report-path file with os.Create and default permissions. Unless --redact is passed, other local users on shared hosts or CI runners can read plaintext secrets and matching lines to obtain discovered credentials. | ||||
| CVE-2026-124028 | 1 Ericlbuehler | 1 Mistral.rs | 2026-11-09 | 4.2 Medium |
| mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments. | ||||
| CVE-2026-123998 | 1 Hisense | 1 Vidaa | 2026-11-09 | 8.3 High |
| Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an authentication bypass vulnerability in its remote-control MQTT broker on TCP port 36669, which accepts publicly documented default credentials and an ineffective 4-digit pairing PIN with no rate limiting or lockout, allowing a brute force of the entire code space in about five seconds, while some actions require no pairing at all. A LAN-adjacent attacker can exploit this to inject key events, change volume, switch input sources, enumerate inputs, launch arbitrary installed applications, and monitor pairing activity, posing a significant risk in hotel deployments where untrusted LAN access is common. | ||||
| CVE-2026-123994 | 1 Hisense | 1 Vidaa | 2026-11-09 | 6.3 Medium |
| Hisense VIDAA Smart TV firmware V0000.01.00a.P0220 contains an unauthenticated access vulnerability in the DIAL (Discovery and Launch) service on TCP port 56789, which accepts control requests from any LAN-adjacent device without authentication, pairing, or user notification. Attackers can query running application states, enumerate installed applications via HTTP response codes, terminate active sessions with a DELETE request, and launch applications or bypass YouTube's Origin check by spoofing the Origin header to disclose viewing activity and subscriptions or disrupt device functionality. | ||||
| CVE-2026-123988 | 1 Sililawijesinghe | 1 Food Ordering System | 2026-11-09 | 5.3 Medium |
| A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa5. This issue affects some unknown processing of the file /Food-Ordering-System/admin/. Such manipulation leads to exposure of information through directory listing. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-123961 | 1 Totolink | 2 Ca300-poe, Ca300-poe Firmware | 2026-11-09 | 9.9 Critical |
| A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.884. This impacts the function setWiFiBasicConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument KeyStr leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. | ||||