Export limit exceeded: 18202 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 10773 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10773 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18800 | 1 Wso2 | 12 Api Control Plane, Api Manager, Identity Server and 9 more | 2026-11-02 | 4.4 Medium |
| When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets. | ||||
| CVE-2026-119334 | 1 Pi-hole | 1 Pi-hole | 2026-11-02 | 2.2 Low |
| Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software. Prior to 6.5, gravity.sh checks file:// adlist readability with sudo -u pihole test -r but then allows curl, sometimes running as root, to normalize URL dot segments and open a different file. A pihole-readable decoy can therefore pass the check while curl reads a root-only target, and /proc/self paths can similarly resolve against different processes. Exploitation requires an administrator who can add adlists and can place a symlink and decoy on the filesystem. This issue is fixed in version 6.5. | ||||
| CVE-2026-39738 | 2026-11-01 | 9.8 Critical | ||
| Deserialization of Untrusted Data vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Object Injection.This issue affects FunnelKit Automations: from n/a through 3.8.6.1. | ||||
| CVE-2026-86404 | 1 Redhat | 6 Amq Broker, Build Of Apache Camel For Quarkus, Build Of Apache Camel For Spring Boot and 3 more | 2026-11-01 | 8.8 High |
| EAP's Artemis deserialization configuration permits deserialization by default. ObjectMessage.getObject() uses ObjectInputStreamWithClassLoader, which implements allow-list/block-list filtering via its checkSecurity()/isTrustedType() method. However, by default both allow-list and block-list are empty. When the allow-list is empty (size == 0), isTrustedType() returns true for ALL classes. This means all classes are deserializable by default. | ||||
| CVE-2026-15555 | 1 Redhat | 4 Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Els, Jboss Enterprise Application Platform Expansion Pack and 1 more | 2026-11-01 | 8.8 High |
| A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node. | ||||
| CVE-2026-116230 | 2 Ndemic Creations, Ndemiccreations | 2 Plague Inc Evolved, Plague Inc Evolved | 2026-10-31 | 6.3 Medium |
| A vulnerability was identified in Ndemic Creations Plague Inc Evolved up to 1.24.0.3. The affected element is an unknown function of the component Workshop Scenario Loader. Such manipulation leads to deserialization. The attack may be performed from remote. Upgrading to version 1.24.0.4 is sufficient to fix this issue. It is recommended to upgrade the affected component. | ||||
| CVE-2026-88137 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-31 | 6.5 Medium |
| Files or directories accessible to external parties in WebDAV allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-78527 | 2026-10-30 | 8.8 High | ||
| Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions. | ||||
| CVE-2023-22793 | 1 Veeam | 1 Management Pack For Microsoft System Center | 2026-10-30 | N/A |
| A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Extensions service of Veeam Management Pack for Microsoft System Center. | ||||
| CVE-2026-107238 | 1 Veeam | 1 Management Pack For Microsoft System Center | 2026-10-30 | N/A |
| A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account on servers running the Veeam Management Pack for Microsoft System Center Collector service. | ||||
| CVE-2026-103039 | 2 Gravityforms, Wordpress-extensions | 2 Gravity Forms, Gravity Forms | 2026-10-30 | 9.8 Critical |
| The Gravity Forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.2 via a Post Custom Field whose input type is List. This is due to GFFormsModel::create_post() passing the submitted value to WordPress' unrestricted global maybe_unserialize() rather than the plugin's own hardened GFCommon::maybe_unserialize(), which was added in 3.1.1 and passes allowed_classes => false precisely to prevent object instantiation. Where the field has a content template enabled, the submitted row reaches that call verbatim. This makes it possible for unauthenticated attackers to inject a PHP object into post meta. No PHP Object Injection gadget chain is present in the plugin itself; however, if a gadget chain is present via an additional plugin or theme, it could allow the attacker to perform actions such as remote code execution. Where the custom field is mapped to the protected _wp_page_template meta key, WordPress itself supplies the chain: validate_file() accepts non-scalars, WP_Theme::__toString() then resolves an attacker-controlled path, and on hosts with a readable PEAR install and register_argc_argv enabled this yields remote code execution. | ||||
| CVE-2026-119290 | 1 Zuke-build | 1 Zuke | 2026-10-30 | 7.5 High |
| Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core writes rendered reportSummary(...) notes to GITHUB_STEP_SUMMARY through writeJobSummary without applying the redactor that protects resolved secret() values in console and persisted run output. A GitHub Actions build that places secret-derived text in a summary note can publish credentials in cleartext to everyone able to view the workflow run, including unauthenticated viewers of a public repository, and the durable summary remains exposed until the run is deleted. GitHub Actions masking directives do not protect the summary file, while runs outside GitHub Actions and builds that do not summarize secret-derived text are not affected. This issue is fixed in version 1.51.0. | ||||
| CVE-2026-119117 | 1 Aws | 1 Amazon-kinesis-producer | 2026-10-30 | 6.5 Medium |
| Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later. | ||||
| CVE-2026-118763 | 1 Sigstore | 1 Sigstore | 2026-10-30 | 7.4 High |
| sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn() method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while RegistryClient.uploadBlob() sends a fresh PUT to an absolute blob-upload Location supplied by the registry without checking that its origin or scheme matches the registry. A malicious or compromised registry can therefore direct a user pushing an artifact through attachArtifactToImage() to an attacker-controlled host and receive the registry bearer token, Basic credentials, or custom authentication headers. Redirect-time header stripping does not prevent the leak because the cross-host PUT is a new explicit request rather than a followed redirect. This is a residual of CVE-2026-59891, whose fix changed credential selection in credentials.ts but did not constrain where credentials are sent from registry.ts. Version 0.7.2 fixes the issue by separating registry credentials from client-wide defaults and sending them only to the registry origin. | ||||
| CVE-2026-59388 | 1 Cloudfoundry | 2 Cf-deployment, Cloud Controller | 2026-10-30 | 6.5 Medium |
| Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events for app manifest application, creation, and updates; syslog drain URL credentials are exposed in user-provided service instance audit events; and service binding parameters are leaked in app manifest and service binding audit events. | ||||
| CVE-2026-93327 | 1 Google | 1 Application Integration | 2026-10-30 | N/A |
| A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 on Google Cloud Platform allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. This vulnerability was patched on 11 September 2026, and no customer action is needed. | ||||
| CVE-2026-73186 | 2 Shortpixel, Wordpress-extensions | 2 Enable Media Replace, Enable Media Replace | 2026-10-30 | 8.8 High |
| Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions. | ||||
| CVE-2026-64918 | 1 Microsoft | 5 365 Apps, Office 2016, Office 2019 and 2 more | 2026-10-30 | 6.5 Medium |
| Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-115569 | 1 Fallow-rs | 4 Fallow, Fallow-cli, Fallow-core and 1 more | 2026-10-30 | 3.3 Low |
| Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fallow follows attacker-controlled Jest projects paths outside the project root through absolute paths, parent segments, dot-prefixed wildcard globs, or symlinks. In version 3.33.1, the same behavior also affects Vitest test.projects paths, Vitest inline-project extends paths, and symlinked script --config paths. Fallow parses the outside files as test-runner configuration and uses them to credit dependencies, setup files, and JSX import sources, which can change unused dependency and unused file findings in CI or agent analysis. The outside file contents are not printed or sent over the network. This issue is fixed in version 3.34.0. | ||||
| CVE-2026-90888 | 2026-10-30 | 9.8 Critical | ||
| Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | ||||