Export limit exceeded: 425814 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425814 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107365 | 1 Grafana | 3 Google Cloud Monitoring Datasource, Grafana, Grafana Enterprise | 2026-11-13 | 5.3 Medium |
| A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7. | ||||
| CVE-2026-106475 | 1 Grafana | 3 Elasticsearch Datasource, Grafana, Grafana Enterprise | 2026-11-13 | 7.1 High |
| The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation] | ||||
| CVE-2026-0460 | 1 Amd | 1 Bootgen | 2026-11-13 | N/A |
| Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity. | ||||
| CVE-2026-125784 | 2 Magnigenie, Wordpress-extensions | 2 Restropress, Restropress | 2026-11-13 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11. | ||||
| CVE-2026-126659 | 1 Blueprintue | 1 Blueprintue-self-hosted-edition | 2026-11-13 | 7.5 High |
| BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service. | ||||
| CVE-2026-119723 | 1 Facebook | 1 Hhvm | 2026-11-13 | N/A |
| When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested array succeeded before descending into it. A remote, unauthenticated attacker could send a GET or POST request which would crash the HHVM server process before any application code runs, leading to denial of service. This issue affected HHVM prior to 23c061f4e804a51badd5f85227e65185651253b5. | ||||
| CVE-2026-67542 | 1 Heymrun | 1 Heym | 2026-11-13 | 7.1 High |
| Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.70, POST /api/mcp/fetch-tools is reachable by any authenticated user (lowest role; no admin/workflow association) and fetches an attacker-supplied URL through the sse and streamable_http transports with no scheme / private-IP / allowlist / redirect guard. The transport error is reflected in the HTTP 422 response, giving a semi-blind SSRF oracle, and the attacker also controls the outbound request headers. This issue has been patched in version 0.0.70. | ||||
| CVE-2026-67545 | 1 Heymrun | 1 Heym | 2026-11-13 | 7.4 High |
| Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to version 0.0.73, the HTTP workflow node in Heym makes outbound HTTP requests to user-supplied URLs without validation of the target host or IP address. If a workflow author has already configured an HTTP node that targets internal addresses such as cloud metadata endpoints or private network hosts, and exposed the workflow with anonymous execution, an unauthenticated attacker can trigger the preconfigured SSRF sink. The same project has comprehensive SSRF protection in its MCP integration, which is absent from the HTTP node. This issue has been patched in version 0.0.73. | ||||
| CVE-2026-6460 | 1 Postgresql | 1 Postgresql | 2026-11-13 | 8.8 High |
| Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-119238 | 1 Lenovo | 1 Xiangbangbang Application | 2026-11-13 | 3.3 Low |
| A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local application to perform unauthorized touch gestures. | ||||
| CVE-2026-119233 | 1 Facebook | 1 Proxygen | 2026-11-13 | N/A |
| proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or reserved type, or a HEADERS frame, until its entire declared length had arrived, without limiting that length, and re-scanned all buffered data each time more bytes arrived. A remote, unauthenticated HTTP/3 peer could declare a very large frame and deliver it slowly, causing unbounded memory growth and CPU usage that grows quadratically with the number of fragments, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-125763 | 2 Brainstormforce, Wordpress-extensions | 2 Sureforms, Sureforms | 2026-11-13 | 5.3 Medium |
| Missing Authorization vulnerability in Brainstorm Force SureForms sureforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SureForms: from n/a through 2.13.0. | ||||
| CVE-2026-125708 | 2 Bdthemes, Wordpress-extensions | 2 Element Pack Elementor Addons, Element Pack Elementor Addons | 2026-11-13 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.4. | ||||
| CVE-2026-40853 | 1 Apache | 1 Xml Graphics Batik | 2026-11-13 | N/A |
| A Cross-Site Scripting via Unencoded Font Metadata in Apache Batik SVGFont. This issue affects Apache XML Graphics Batik: through 1.19. Users are recommended to upgrade to version 1.20, which fixes the issue. | ||||
| CVE-2026-14242 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-13 | 6.5 Medium |
| A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had view access, by creating a provisioning job through the jobs resource API, which skipped the folder permission checks (incorrect authorization). | ||||
| CVE-2026-82014 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2026-11-13 | 4.3 Medium |
| Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme and timezone, through an undocumented endpoint with no access control, and so redirect every member of that team to a dashboard of their choice (missing authorization). | ||||
| CVE-2026-119235 | 1 Facebook | 1 Proxygen | 2026-11-13 | N/A |
| proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the entire literal had been received. A remote, unauthenticated HTTP/3 peer could send an insert instruction on the QPACK encoder stream that declares an arbitrarily large literal and then keep sending data, causing the decoder to buffer it without bound for the lifetime of the connection and exhaust memory, leading to denial of service. The issue occurs regardless of the advertised QPACK dynamic table capacity, including when the dynamic table is disabled. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-119237 | 1 Facebook | 1 Proxygen | 2026-11-13 | N/A |
| In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been received, header decoding for that stream was paused, but the session continued to read the stream from the QUIC transport. The unread data bypassed the session's ingress buffer limit, returned flow-control credit to the peer, and was re-scanned in full on every read. With QPACK blocked streams enabled (the default), a remote, unauthenticated HTTP/3 peer could send a HEADERS block that references a dynamic table insert it never sends, followed by a continuous stream of data, causing memory growth until the request timed out and CPU usage that grows quadratically, leading to denial of service. This issue affects proxygen versions prior to v2026.11.09.00. | ||||
| CVE-2026-119055 | 1 Schneider-electric | 1 Ecostruxure Power Build - Rapsody | 2026-11-13 | N/A |
| CWE- 416: Use After Free vulnerability exists that could cause arbitrary code execution when a local attacker could trick the end user to open a specially crafted malicious SSD file. | ||||
| CVE-2026-81936 | 1 Lenovo | 1 Xclarity Controller | 2026-11-13 | 6.8 Medium |
| An internal security review identified a development regression from ThinkSystem v4 XClarity Controller 3 (XCC3) versions (2.51) IHX432Y to (2.56) IHX436K which re-introduces the default OpenBMC root password upon performing an XCC Reset to Default operation. An attacker can gain access to enabled administrative interfaces of XCC using the default OpenBMC credential re-introduced after Reset to Default. Additionally, this provides access to the underlying XCC Operating System which is not normally accessible. Only these versions are affected and are no longer available for download. Process enhancements have also been made to prevent and identify potential future regression. | ||||