Export limit exceeded: 417680 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417680 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-79876 | 1 Hpe | 1 Aos | 2026-10-30 | 9.3 Critical |
| A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to access sensitive information. Successful exploitation could allow an attacker to retrieve information which could be used to potentially gain further access to network services supported by AOS-10, or to interrupt the normal operation of the affected service. | ||||
| CVE-2026-79875 | 1 Hpe | 1 Aos | 2026-10-30 | 9.3 Critical |
| A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data. | ||||
| CVE-2026-79858 | 1 Hpe | 1 Aos | 2026-10-30 | 9.8 Critical |
| An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated remote attacker to obtain and modify sensitive information in the underlying database and to interrupt the normal operation of the affected service. | ||||
| CVE-2026-68482 | 2 Apache, Apache Software Foundation | 2 Answer, Apache Answer | 2026-10-30 | 5.3 Medium |
| Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue. | ||||
| CVE-2026-114555 | 1 Drupal | 1 Data Field | 2026-10-30 | 3.5 Low |
| Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field allows Stored XSS. This issue affects Data field versions: from 0.0.0 to 2.0.14. | ||||
| CVE-2026-103299 | 2026-10-30 | 5.3 Medium | ||
| The Payment Gateway WordPress plugin through 2.2.0 does not ensure a shared secret is configured before using it to authenticate the bank's payment-notification callback, allowing unauthenticated attackers to forge a valid notification and mark any WooCommerce order as paid on installs where the secret has not been set, and the same callback lets them move any pending order to a failed state whether or not the secret is configured. | ||||
| CVE-2026-106781 | 2026-10-30 | 7.8 High | ||
| An issue in WCH CH340/CH341 USB-to-Serial Windows Driver setup package CH341SER.EXE version 4.0 allows a local attacker to escalate privileges. | ||||
| CVE-2026-51905 | 1 Transformeroptimus | 1 Superagi | 2026-10-30 | 8.8 High |
| TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py. A remote authenticated attacker from one organization can read another organization's agent execution configuration by supplying the victim agent_id and agent_execution_id to /agent_executions_configs/details/agent_id/{agent_id}/agent_execution_id/{agent_execution_id}. The endpoint lacks an organization ownership check on the selected agent and execution. | ||||
| CVE-2026-117346 | 1 Bitcoin | 1 Bitcoin Core | 2026-10-30 | N/A |
| Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit | ||||
| CVE-2026-119842 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-10-30 | 6.5 Medium |
| A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file. | ||||
| CVE-2026-120046 | 1 Nezhahq | 1 Nezha | 2026-10-30 | 5.3 Medium |
| Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually. | ||||
| CVE-2026-100517 | 2 Villatheme, Wordpress-extensions | 2 Photo Reviews For Woocommerce, Photo Reviews For Woocommerce | 2026-10-30 | 7.5 High |
| Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30. | ||||
| CVE-2026-81627 | 2 Qemu, Redhat | 8 Qemu, Enterprise Linux, Enterprise Linux For Nvidia 26 and 5 more | 2026-10-30 | 8.2 High |
| A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. | ||||
| CVE-2026-91218 | 1 Oracle | 1 Soa Suite | 2026-10-30 | 9.6 Critical |
| Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle SOA Suite accessible data as well as unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 9.6 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N). | ||||
| CVE-2026-91219 | 1 Oracle | 1 Soa Suite | 2026-10-30 | 8.6 High |
| Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle SOA Suite. While the vulnerability is in Oracle SOA Suite, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle SOA Suite accessible data. CVSS 3.1 Base Score 8.6 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). | ||||
| CVE-2026-118696 | 1 Jetbrains | 11 Clion, Datagrip, Dataspell and 8 more | 2026-10-30 | 8 High |
| In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates | ||||
| CVE-2026-116851 | 2026-10-30 | 7.1 High | ||
| Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. | ||||
| CVE-2026-116854 | 2026-10-30 | 6.5 Medium | ||
| Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | ||||
| CVE-2026-116862 | 2026-10-30 | 7.5 High | ||
| Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions. | ||||
| CVE-2026-102918 | 2 Davidanderson, Wordpress-extensions | 2 Redux Framework, Redux Framework | 2026-10-30 | 6.4 Medium |
| The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API. | ||||