Export limit exceeded: 405305 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (405305 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-41210 | 1 Moonlight-stream | 1 Moonlight-qt | 2026-10-13 | 6.5 Medium |
| Moonlight Qt is a GameStream client for Windows, macOS, Linux, and Steam Link. In version 6.1.0 and earlier, after a victim initiates a streaming session to a malicious host, the host can send a crafted H.264 SPS NAL when Moonlight selects a decoder path that does not advertise CAPABILITY_REFERENCE_FRAME_INVALIDATION_AVC. The SPS fixup path in app/streaming/video/ffmpeg.cpp parses the server-provided data with h264bitstream, where attacker-controlled seq_parameter_set_id is used to index the 32-entry sps_table without validation. A value of 32 or greater causes an out-of-bounds write and remote heap corruption in the Moonlight client. The demonstrated impact is a reliable client crash, while code execution is not established. This issue is fixed in version 6.2.0. | ||||
| CVE-2026-53922 | 1 Openwrt | 2 Odhcpd, Openwrt | 2026-10-13 | 6.5 Medium |
| odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In commit cfddd56 and earlier, an unauthenticated host on the same link can first obtain two bindings through normal DHCPv6 SOLICIT and REQUEST exchanges and then send a crafted RENEW containing multiple IA_NA options. An earlier matched IA consumes most of the response buffer, an unmatched IA causes the build_ia() status branch to write and return a NOBINDING response larger than the remaining space, and a subsequent matched IA is processed after dhcpv6_ia_handle_IAs() subtracts that over-return from an unsigned size_t. The resulting underflow disables subsequent length checks and permits attacker-controlled IA_ADDR serialization beyond the 512-byte stack buffer pdbuf in handle_client_request(). The stack canary terminates odhcpd, and sustained packets can repeatedly disrupt DHCPv6 service while procd respawns the process. The observed configuration does not establish code execution. | ||||
| CVE-2026-49483 | 1 Codefori | 1 Vscode-ibmi | 2026-10-13 | N/A |
| Code for IBMi is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, IBMi components implementing IBMiComponent were accepted after checking that a procedure existed without reliably verifying component integrity. Components installed with broad public permissions allow another local account to alter a program such as GETMBRINFO. A later connection can execute the altered program under the connecting account because the LONG_COMMENT marker alone does not establish integrity. This issue is fixed in version 3.0.1. | ||||
| CVE-2026-49484 | 1 Codefori | 1 Vscode-ibmi | 2026-10-13 | N/A |
| Code for IBM i is a Visual Studio Code extension for maintaining and compiling ILE languages on the IBMi platform. Prior to 3.0.1, src/ui/views/objectBrowser.ts stores Object Browser downloads and the edit-save flow content in the shared /tmp directory without reliable cleanup. On systems where /tmp is accessible to other local accounts, file contents remain readable after download or editing operations. This issue is fixed in version 3.0.1. | ||||
| CVE-2026-44828 | 1 Qexo | 1 Qexo | 2026-10-13 | N/A |
| Qexo is an open source online editor for static blogs. From 4.0.0 until 4.2.0, Qexo exposes /api/init_step/ through init_step_api without authentication, authorization, or a setup-completion guard. An unauthenticated requester with a valid CSRF token obtained from a public page can submit the first initialization step and reset the INIT setting, causing the instance to re-enter the setup flow. The setup response and /init/ page can expose stored PROVIDER configuration, including service credentials, in frontend content. This issue is fixed in version 4.2.0. | ||||
| CVE-2026-109675 | 1 Frappe | 1 Suite | 2026-10-13 | 4.3 Medium |
| Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and get_quota APIs that allows authenticated mail users to access other users' data. Attackers can supply another user's JMAP account ID to read mailbox names, message counts, automation rules with sender addresses, and storage quota usage. | ||||
| CVE-2026-58249 | 1 Sap Se | 1 Sap Netweaver And Sap Web Dispatcher (internet Communication Manager) | 2026-10-13 | 7.5 High |
| SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful exploitation can therefore result in a high impact on the availability of the affected application. There is no impact on the confidentiality or integrity of the application. | ||||
| CVE-2026-76975 | 1 Sap Se | 1 Sapui5 (support Assistant Overlay) | 2026-10-13 | 6.1 Medium |
| Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected. | ||||
| CVE-2026-76976 | 1 Sap Se | 1 Sap Netweaver Application Server Abap (applications Based On Sap Gui For Html) | 2026-10-13 | 5.4 Medium |
| Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application. | ||||
| CVE-2026-89107 | 1 Sap Se | 1 Sap S/4hana (manage Substitution/validation Rules) | 2026-10-13 | 9.9 Critical |
| SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interpreted as executable ABAP code by the rule processing logic. Successful exploitation could allow the attacker to execute ABAP arbitrary code into the system, resulting in full compromise of the affected system and high impact on confidentiality, integrity, and availability of the system. | ||||
| CVE-2026-89108 | 1 Sap Se | 1 Sap Manufacturing Integration And Intelligence (configuration Service) | 2026-10-13 | 9.1 Critical |
| SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying Java application server. Successful exploitation could allow the attacker to gain administrative control over the underlying system, extending the impact beyond the vulnerable application. This results in a high impact on confidentiality, integrity and availability. | ||||
| CVE-2026-89110 | 1 Sap Se | 1 Sap Netweaver Visual Composer | 2026-10-13 | 9.9 Critical |
| SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of the remote system. This results in a high impact on confidentiality, integrity and availability. | ||||
| CVE-2026-89111 | 1 Sap Se | 1 Sap Cloud | 2026-10-13 | 10 Critical |
| The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. | ||||
| CVE-2026-89113 | 1 Sap Se | 1 Sap Commerce Cloud (ootb Code) | 2026-10-13 | 8.8 High |
| SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read, modify or delete sensitive data from the application's database, resulting in a high impact on confidentiality, integrity and availability of the application. | ||||
| CVE-2026-89116 | 1 Sap Se | 1 Sap Yeoman-ui | 2026-10-13 | 5.9 Medium |
| The affected code used child_process.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation. | ||||
| CVE-2026-89121 | 1 Sap Se | 1 Sap S/4hana (linear Asset Management Rap Business Object) | 2026-10-13 | 4.7 Medium |
| SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not authorized for. This results in a high impact on integrity. There is no impact on confidentiality and availability. | ||||
| CVE-2026-89124 | 1 Sap Se | 1 Sap Hana (display Product Catalog Based On Customs Declaration) | 2026-10-13 | 4.3 Medium |
| Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact on confidentiality of the data, with no impact on the integrity and availability of the application. | ||||
| CVE-2026-109758 | 1 Perforce | 1 Helix Authentication Service | 2026-10-13 | N/A |
| Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized access when the SCIM endpoint is reachable by an attacker. In version 25.2, the installation templates contain a default credential which the installer copies into the active configuration; the installer and configuration script do not automatically replace that value with a random token. An attacker who knows the default token can authenticate to the SCIM API and perform user and group operations allowed by the configured provisioning backend. This issue can be chained with CVE-2026-61834 in affected releases of the scim-patch dependency. A crafted SCIM PATCH request can cause server-side prototype pollution, corrupt application state, and disrupt service availability, including health checks and SCIM or SSO requests. In a later test, this primitive was confirmed to enable remote code execution in a Node.js 24/Express deployment through available gadget chains involving child_process, EJS/Pug, or Passport. This vulnerability exists in version 2022.1 - 2025.2 of HAS however the underlying defect was removed in version 2026.1 which was released July 17th 2026. The vulnerability was identified in older versions of HAS after version 2026.1 was released. | ||||
| CVE-2026-67165 | 2026-10-13 | 5.4 Medium | ||
| HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks. | ||||
| CVE-2026-66588 | 2 Dream-theme, Wordpress-extensions | 2 The7, The7 | 2026-10-13 | N/A |
| This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False-positive. | ||||