Export limit exceeded: 425979 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425979 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63282 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 6.5 Medium |
| Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation. | ||||
| CVE-2026-14918 | 1 Axis Communications Ab | 3 Axis File Player, Signed Media Verifier, Signed Video Framework | 2026-11-15 | 5.3 Medium |
| The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected. | ||||
| CVE-2026-88710 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an unauthenticated nearby user to trigger a chain of actions—unauthenticated queries, identifier guessing, credential overwriting, and command injection—resulting in the execution of arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-88707 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| An out-of-bounds write in certain ASUS Router firmware allows an unauthenticated nearby user to send an HTTP request containing parameters that exceed the buffer length, potentially overwriting other memory regions or causing the system to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-9063 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 6.7 Medium |
| A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized code execution. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-14543 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 3.9 Low |
| The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-13387 | 1 Axis Communications Ab | 1 Axis Camera Station Pro | 2026-11-15 | 3.5 Low |
| A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected to unintended external content under specific conditions. | ||||
| CVE-2026-63287 | 1 Axis Communications Ab | 2 Axis Camera Station, Axis Camera Station Pro | 2026-11-15 | 6.5 Medium |
| It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station. | ||||
| CVE-2026-128824 | 2 Red Hat, Redhat | 5 Red Hat Quay 3, Mirror Registry, Quay and 2 more | 2026-11-15 | 5.4 Medium |
| A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session. | ||||
| CVE-2026-88709 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| Improper neutralization of special elements used in an OS command in certain ASUS Router firmware allows an user with physical access to insert a USB device containing a specially crafted directory name, potentially executing arbitrary commands with root privileges. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-88708 | 1 Asus | 1 Router Firmware | 2026-11-15 | N/A |
| An off-by-one error in certain ASUS Router firmware allows an unauthenticated nearby user to send a packet with a specific header length, potentially overwriting memory and causing the affected service to crash. Refer to the ' Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information. | ||||
| CVE-2026-123707 | 1 Wordpress-extensions | 1 Wpgraphql | 2026-11-15 | N/A |
| The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses, allowing users with the Contributor role and above to read the content of other users' posts in those statuses. | ||||
| CVE-2026-129443 | 1 Itsourcecode | 1 Airline Reservation System | 2026-11-15 | 6.3 Medium |
| A vulnerability was determined in itsourcecode Airline Reservation System 1.0. The impacted element is an unknown function of the file /admin/manage_user.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. | ||||
| CVE-2026-110960 | 2026-11-15 | N/A | ||
| The Auth Armor WordPress plugin through 1.0.3 does not require authentication on several handlers available to logged-out users, which leak the site's stored API credentials and allow an unauthenticated attacker to reset an administrator's enrollment and take over that administrator account. | ||||
| CVE-2026-124671 | 1 Wordpress-extensions | 1 Burst Statistics | 2026-11-15 | N/A |
| The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it serves to the report's share link, allowing anyone holding the link to read the report's statistics for any period the site retains rather than the period the report was shared for. | ||||
| CVE-2026-124673 | 1 Wordpress-extensions | 1 Burst Statistics | 2026-11-15 | N/A |
| The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published content, nor check post status before listing post titles and links in its public statistics output, allowing unauthenticated attackers to disclose the titles and permalinks of draft, pending and private posts. | ||||
| CVE-2026-13409 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 4.3 Medium |
| The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account. | ||||
| CVE-2026-14542 | 1 Axis Communications Ab | 1 Axis Os | 2026-11-15 | 6.7 Medium |
| The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-63288 | 2026-11-15 | 8.3 High | ||
| A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint. This bypasses the intended authentication layer. | ||||
| CVE-2026-4762 | 1 Axis Communications Ab | 1 Axis Camera Station Pro | 2026-11-15 | 8.8 High |
| A vulnerability to perform a privilege escalation attack on the server as a non-admin user. | ||||