Export limit exceeded: 425461 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425461 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-119899 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.8 High |
| Improper access control in Windows Win32K allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-119988 | 1 Microsoft | 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more | 2026-11-12 | 7.1 High |
| Numeric truncation error in Windows SMB allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-17134 | 1 Ibm | 1 Api Connect | 2026-11-12 | 9.9 Critical |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary SQL commands due to SQL injection. | ||||
| CVE-2026-17137 | 1 Ibm | 1 Api Connect | 2026-11-12 | 4 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a local attacker to obtain sensitive information due to improper use of cryptography. The encryption applied to stored data is not implemented with sufficient strength, which weakens its protection. | ||||
| CVE-2026-17139 | 1 Ibm | 1 Api Connect | 2026-11-12 | 5.4 Medium |
| IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session. | ||||
| CVE-2026-64523 | 1 Linux | 1 Linux Kernel | 2026-11-12 | 9.8 Critical |
| In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch. | ||||
| CVE-2026-64522 | 1 Linux | 1 Linux Kernel | 2026-11-12 | 8.8 High |
| In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA mlx5e_xfrm_add_state() handles acquire-flow temporary SAs by allocating software state and skipping hardware offload setup. That path jumps to the common success label before taking the eswitch mode block. After tunnel-mode validation was moved earlier, the common success label unconditionally calls mlx5_eswitch_unblock_mode(). For acquire SAs, this decrements esw->offloads.num_block_mode without a matching increment. Return directly after installing the acquire SA offload handle, so only the paths that successfully called mlx5_eswitch_block_mode() call the matching unblock. | ||||
| CVE-2026-126793 | 1 Aws | 1 Aws-advanced-go-wrapper | 2026-11-12 | 8 High |
| An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release 2026-04-06 (awssql/v2.0.0) and before release 2026-07-29 (awssql/v2.0.3) could allow a remote authenticated user to escalate privileges to those of another database user, including a member of the rds_superuser role, via a crafted function that runs when that user connects to an Aurora PostgreSQL cluster through an affected version of the wrapper. To remediate this issue, users should upgrade to the AWS Advanced Go Wrapper release 2026-07-29 (awssql/v2.0.3) or later. | ||||
| CVE-2026-64515 | 1 Linux | 1 Linux Kernel | 2026-11-12 | 8.3 High |
| In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix MLE defragmentation If either reconf or EPCS multi-link element (MLE) is contained in a non-transmitted profile, the defragmentation routine is called with a pointer to the defragmented copy, but the original elements. This is incorrect for two reasons: - if the original defragmentation was needed, it will not find the correct data - if the original frame is at a higher address, the parsing will potentially overrun the heap data (though given the layout of the buffers, only into the new defragmentation buffer, and then it has to stop and fail once that's filled with copied data. Fix it by tracking the container along with the pointer and in doing so also unify the two almost identical defragmentation routines. | ||||
| CVE-2026-105612 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-12 | 3.5 Low |
| PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked roles. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions | ||||
| CVE-2026-118074 | 2 Daman Jeet, Wordpress-extensions | 2 Finale Lite, Finale Lite | 2026-11-12 | 7.2 High |
| Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | ||||
| CVE-2026-118075 | 2 Dbarrere, Wordpress-extensions | 2 Wp Media Folders, Wp Media Folders | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in WP Media folders <= 1.1.10 versions. | ||||
| CVE-2026-118076 | 2 Frisbii, Wordpress-extensions | 2 Frisbii Pay, Frisbii Pay | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | ||||
| CVE-2026-118077 | 2 Fast Themes, Wordpress-extensions | 2 Sastra Essential Addons For Elementor, Sastra Essential Addons For Elementor | 2026-11-12 | 7.2 High |
| Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. | ||||
| CVE-2026-105618 | 1 Dalibo | 1 Postgresql Anonymizer | 2026-11-12 | 5.7 Medium |
| PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables. Direct access to the paritions / inheritance tables is masked but not thru the parent table. The problem is resolved in PostgreSQL Anonymizer 3.3.0 and later versions. | ||||
| CVE-2026-118079 | 2 Foliovision, Wordpress-extensions | 2 Fv Flowplayer Video Player, Fv Flowplayer Video Player | 2026-11-12 | 7.2 High |
| Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.This issue affects FV Flowplayer Video Player: from n/a through 7.5.56.7212. | ||||
| CVE-2026-118080 | 2 Social Snap, Wordpress-extensions | 2 Social Snap, Social Snap | 2026-11-12 | 8.8 High |
| Contributor PHP Object Injection in Social Snap <= 1.5.4 versions. | ||||
| CVE-2026-118083 | 2 Themeum, Wordpress-extensions | 2 Wp Crowdfunding, Wp Crowdfunding | 2026-11-12 | 7.5 High |
| Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | ||||
| CVE-2026-104368 | 2 Webtoffee, Wordpress-extensions | 2 Export And Import Users And Customers, Export And Import Users And Customers | 2026-11-12 | 8.8 High |
| The Export and Import Users and Customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.7.5 via the plugin's own export and re-import workflow. The vulnerability exists because of a CSV escape-character mismatch between the exporter and the importer: class-csvwriter.php writes cells with fputcsv() using PHP's default backslash (\) escape character, while class-csvreader.php parses the same file with fgetcsv() using a double-quote (") as the escape character. As a result, a crafted value stored in a Subscriber's Biographical Info field — containing a backslash-quote sequence followed by a newline — is written as a single quoted CSV field but parsed back as two separate rows on import. The injected second row is then processed by hf_create_customer() as a new user record whose user_login, user_pass, user_email, and role are entirely attacker-controlled, allowing the creation of an arbitrary Administrator account. This makes it possible for authenticated attackers with Subscriber-level access and above to escalate their privileges to Administrator. | ||||
| CVE-2026-118194 | 2 Cyberlord92, Wordpress-extensions | 2 Page And Post Restriction, Page And Post Restriction | 2026-11-12 | 6.5 Medium |
| The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This is due to the `papr_restrict_page_post_rest_api()` function, hooked on `rest_pre_dispatch`, re-authenticating the current user from the `wordpress_logged_in` cookie via `wp_set_current_user()` for any GET or HEAD REST request where the current user is 0, without verifying a REST nonce — silently undoing the nonce-zeroing that WordPress core's `rest_cookie_check_errors()` performs on cookie-authenticated requests that lack an `X-WP-Nonce` header or `_wpnonce` parameter. Combined with WordPress's permissive REST CORS behavior — which echoes the request `Origin` and sets `Access-Control-Allow-Credentials: true` — this allows an unauthenticated attacker to read REST API GET responses as a logged-in victim, exposing role-restricted and private post/page content, victim user profile data via `/wp-json/wp/v2/users/me`, and comments the victim is authorized to see. This requires the attacker to lure a logged-in user into visiting an attacker-controlled page that issues credentialed cross-origin `fetch` requests against the target site's REST API; no nonce or further victim interaction beyond the page visit is needed. | ||||