Export limit exceeded: 413900 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 413900 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (413900 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-114615 | 1 Authlib | 1 Authlib | 2026-10-23 | 7.4 High |
| Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key markers only at byte zero while Authlib's PEM loaders accept leading whitespace, comments, or a byte-order mark. In deployments that use the documented mixed algorithm registry and already configure verification with PEM or certificate bytes containing such a prefix, an unauthenticated attacker who knows those same public-key bytes can use them as an HMAC secret and forge HS256 tokens with arbitrary identity or authorization claims. This is a bypass of the remediation for CVE-2024-37568. The module-level jwt object reaches OctKey.import_key() in authlib/jose/rfc7518/oct_key.py, where POSSIBLE_UNSAFE_KEYS fails to identify prefixed asymmetric key material. This issue is fixed in version 1.9.0. | ||||
| CVE-2026-79855 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79859 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79888 | 2026-10-23 | 8.1 High | ||
| No description provided | ||||
| CVE-2026-79891 | 2026-10-23 | 8.1 High | ||
| No description provided | ||||
| CVE-2026-79893 | 2026-10-23 | 7.5 High | ||
| No description provided | ||||
| CVE-2026-79955 | 2026-10-23 | 7.5 High | ||
| No description provided | ||||
| CVE-2026-79956 | 2026-10-23 | 7.2 High | ||
| No description provided | ||||
| CVE-2026-95704 | 2026-10-23 | 7.2 High | ||
| No description provided | ||||
| CVE-2026-95705 | 2026-10-23 | 7.2 High | ||
| No description provided | ||||
| CVE-2026-95709 | 2026-10-23 | 7.2 High | ||
| No description provided | ||||
| CVE-2026-95711 | 2026-10-23 | 7.1 High | ||
| No description provided | ||||
| CVE-2026-95718 | 2026-10-23 | 5.3 Medium | ||
| No description provided | ||||
| CVE-2026-95721 | 2026-10-23 | 3.3 Low | ||
| No description provided | ||||
| CVE-2026-115351 | 2 Lepture, Mistune Project | 2 Mistune, Mistune | 2026-10-23 | 4.7 Medium |
| Mistune from 3.2.1 before 3.3.0 contains a CSS injection vulnerability that allows attackers controlling markdown input to inject arbitrary style declarations via the unvalidated figwidth option of the figure directive. Attackers can append declarations like background:url() to the rendered figure style attribute, forcing victim browsers to send requests to attacker servers and leak attribute values. | ||||
| CVE-2026-114613 | 1 Msgpack | 1 Msgpack-python | 2026-10-23 | 7.5 High |
| MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inputs can cause unbounded process memory growth and denial of service in applications that deserialize attacker-controlled MessagePack data. Both unpackb() and the streaming Unpacker API are affected. The pure-Python fallback does not exhibit this leak in the reported tests. This issue is fixed in version 1.2.3. | ||||
| CVE-2026-115484 | 2 Red Hat, Redhat | 2 Enterprise Linux, Enterprise Linux | 2026-10-23 | 7.6 High |
| A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration. | ||||
| CVE-2026-96376 | 1 Drupal | 1 Cloud | 2026-10-23 | 6.4 Medium |
| Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal Cloud allows OS Command Injection. This issue affects Cloud versions: from 0.0.0 to 7.0.1. | ||||
| CVE-2026-79860 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||
| CVE-2026-79861 | 2026-10-23 | 9.8 Critical | ||
| No description provided | ||||