Export limit exceeded: 423974 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423974 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-66178 | 1 Fortinet | 1 Fortiweb | 2026-10-21 | 6.7 Medium |
| A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.2, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11, FortiWeb 7.2.0 through 7.2.12, FortiWeb 7.0.0 through 7.0.12 may allow an authenticated attacked to execute arbitrary commands via a specialy crafted HTTP request. | ||||
| CVE-2026-8743 | 1 Open5gs | 1 Open5gs | 2026-10-21 | 6.3 Medium |
| A vulnerability was found in Open5GS up to 2.7.6. This impacts the function ran_ue_find_by_amf_ue_ngap_id of the file src/amf/context.c of the component AMF/MME. Performing a manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 5746b8576cfceec18ed87eb7d8cf11b1fb4cd8b1. It is suggested to install a patch to address this issue. | ||||
| CVE-2026-56449 | 2 Apache, Redhat | 2 Http Server, Hummingbird | 2026-10-21 | 7.5 High |
| Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP Server version 2.4.68. | ||||
| CVE-2026-110927 | 1 Redhat | 1 Hummingbird | 2026-10-21 | 4.3 Medium |
| CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585. | ||||
| CVE-2026-110926 | 2026-10-21 | 5.3 Medium | ||
| CVE-2026-110926 has been marked as a duplicate of CVE-2026-106582. | ||||
| CVE-2026-110925 | 2026-10-21 | 5.4 Medium | ||
| CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583. | ||||
| CVE-2026-110924 | 2 Openssh, Redhat | 4 Openssh, Enterprise Linux, Hardened Images and 1 more | 2026-10-21 | 4.8 Medium |
| CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553. | ||||
| CVE-2026-110923 | 2026-10-21 | 6.5 Medium | ||
| CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552. | ||||
| CVE-2025-68045 | 2 Arraytics, Wordpress | 2 Wp Event Solution, Wordpress | 2026-10-21 | 7.5 High |
| Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.12. | ||||
| CVE-2026-14882 | 2 Themefusecom, Wordpress-extensions | 2 Brizy – Page Builder, Brizy | 2026-10-21 | 6.4 Medium |
| The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'brizy-compiled-sections' parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-102438 | 1 Asus | 2 Armoury Crate, Armoury Crate Se | 2026-10-21 | N/A |
| An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges via replacement of a dynamic-link library (DLL) that is later loaded by a high-privilege process. Refer to the ' Security Update for Armoury Crate App ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-95859 | 1 Libp2p | 1 Rust-libp2p | 2026-10-21 | N/A |
| libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message handling unconditionally adds attacker-supplied topic hashes to connected_peer.topics without confirming that the peer previously subscribed to those topics. A remote unauthenticated peer that can reach a Gossipsub listener can repeatedly send novel GRAFT topics, causing cumulative per-peer memory growth that is not bounded by subscription filters, peer scoring, or per-message size limits. This can exhaust process memory and cause a denial of service. This issue is fixed in version 0.49.5. | ||||
| CVE-2026-92263 | 1 Codewithcj | 1 Sparkyfitness | 2026-10-21 | 7.2 High |
| SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint interpolates an uploaded filename into a shell command. An authenticated global administrator uploads a restore archive with a crafted filename. The administrator can supply a restore archive with a filename containing shell metacharacters. Successful exploitation can execute arbitrary operating-system commands with the server process privileges. This issue is fixed in version 1.6.0. | ||||
| CVE-2026-86009 | 1 Mailu | 1 Mailu | 2026-10-21 | N/A |
| Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable spoofing for hosted domains they do not control. A potentially malicious domain administrator enables spoofing for another hosted domain and can send emails that are authenticated with DKIM/SPF for domains they should not be able to. This vulnerability is addressed by f05aeb8322e2f61096af6b089d61ba6f40587d96. | ||||
| CVE-2026-111609 | 1 Openjournalsystems | 1 Open Journal Systems | 2026-10-21 | 3.8 Low |
| PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription managers to access other journals' subscriptions by supplying arbitrary subscription ids. Attackers can enumerate sequential ids through editSubscription to view subscriber details and use updateSubscription to reassign subscriptions to their own journal, revoking victims' access. | ||||
| CVE-2026-111442 | 1 Backdropcms | 1 Backdrop | 2026-10-21 | N/A |
| Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SVG tags. SVG images can contain clickable links or executable scripting. By uploading a crafted SVG, it is possible to execute scripting in the browser when an SVG image is viewed. This issue is mitigated by the attacker needing to be able to upload SVG images, and that Backdrop embeds all uploaded SVG images within <img> tags, which prevents script from executing. The SVG must be viewed directly by its URL in order to run any embedded scripting. | ||||
| CVE-2026-111390 | 1 Erupt | 1 Erupt | 2026-10-21 | 5.3 Medium |
| Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities. | ||||
| CVE-2026-111380 | 1 Freerdp | 1 Freerdp | 2026-10-21 | 8.8 High |
| FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients. | ||||
| CVE-2026-111375 | 1 Freerdp | 1 Freerdp | 2026-10-21 | 4.8 Medium |
| FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWindowTextW, corrupting titles or crashing the client. | ||||
| CVE-2026-111367 | 1 Aapanel | 1 Billionmail | 2026-10-21 | 6.5 Medium |
| BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can submit forged tokens to /api/unsubscribe, /api/unsubscribe_new, or /api/subscribe/confirm to deactivate any contact or force confirmed subscriptions. | ||||