Export limit exceeded: 425031 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 425031 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (425031 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-124007 | 2026-11-12 | 8.1 High | ||
| XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-76964 | 1 Sap Se | 1 Sap Netweaver And Abap Platform | 2026-11-12 | 10 Critical |
| SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Successful exploitation could allow the attacker to execute arbitrary code and fully compromise the system, resulting in a high impact on confidentiality, integrity and availability of the system. | ||||
| CVE-2026-76973 | 1 Sap Se | 1 Sap Netweaver And Abap Platform | 2026-11-12 | 7.5 High |
| Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause the server to crash and disrupt active connections, leading to a denial of service condition. Successful exploitation could result in a high impact to the availability while the confidentiality and integrity remains unaffected. | ||||
| CVE-2026-121669 | 1 Microsoft | 3 Powershell, Powershell 7.6, Powershell 7.7 | 2026-11-12 | 6.1 Medium |
| Insufficiently protected credentials in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-121675 | 1 Microsoft | 3 Powershell, Powershell 7.6, Powershell 7.7 | 2026-11-12 | 6.1 Medium |
| Improper restriction of xml external entity reference in Microsoft PowerShell allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-124016 | 1 Postalsys | 1 Postal-mime | 2026-11-12 | 5.3 Medium |
| postal-mime before 4.2.1 contains an algorithmic complexity denial of service vulnerability that allows unauthenticated remote attackers to cause excessive CPU consumption in the PostalMime.processLine() function by crafting deeply nested multipart email messages with boundary lines sharing long prefixes with open boundaries. Attackers can deliver a malicious email with nesting up to the default maxNestingDepth of 256, causing per-line parsing cost to scale as O(depth x shared prefix length) and blocking the Node.js event loop for seconds per message. | ||||
| CVE-2026-124006 | 2026-11-12 | 8.1 High | ||
| XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-105986 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-12 | N/A |
| Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a percent-encoded role name or a self-assigned role. | ||||
| CVE-2026-107372 | 1 Auth0 | 1 Auth0 Ai Js | 2026-11-12 | N/A |
| The auth0-ai-js FGA retriever does not distinguish between authorization checks under different conditions when filtering documents during retrieval-augmented generation, resulting in documents denied by Auth0 FGA being included in the model context and used in the generated response. | ||||
| CVE-2026-123041 | 1 Konghq | 2 Kong Ai Gateway, Kong Gateway Enterprise | 2026-11-12 | N/A |
| The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, allowing a cached callout response for a caller to be served to another. | ||||
| CVE-2025-62620 | 1 Amd | 8 Epyc 7003 Series Processors, Epyc 8004 Series Processors, Epyc 9004 Series Processors and 5 more | 2026-11-12 | N/A |
| Improper validation of unsafe equivalence in input could allow an attacker with high privileges to reclaim the ring buffer queue status page, potentially resulting in loss of guest memory integrity. | ||||
| CVE-2025-52535 | 1 Amd | 8 Epyc 7003 Series Processors, Epyc 8004 Series Processors, Epyc 9004 Series Processors and 5 more | 2026-11-12 | N/A |
| Improper resource reuse in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor access to write to the Reverse Map Table (RMP) protected memory, potentially resulting in loss of guest memory integrity. | ||||
| CVE-2026-124005 | 2026-11-12 | 8.1 High | ||
| XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026. | ||||
| CVE-2025-0027 | 1 Amd | 8 Epyc 7003 Series Processors, Epyc 8004 Series Processors, Epyc 9004 Series Processors and 5 more | 2026-11-12 | N/A |
| Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass Reverse Map Table (RMP) protections, potentially impacting the integrity of Secure Encrypted Virtualization-Secure Nested Paging (SEV-SNP) guest memory. | ||||
| CVE-2026-107356 | 1 U.s. Geological Survey | 1 Area Species Management Research Program | 2026-11-12 | 8.8 High |
| U.S. Geological Survey Area Species Management Research Program (ARMI) accepts any uploaded file and stores the file under '/uploads/{upload-file}'. A remote, authenticated attacker could upload a crafted PHP file that executes and returns command output from the server when accessed. Fixed on 2026-07-20. | ||||
| CVE-2026-0480 | 1 Amd | 3 Epyc 8005 Series Processors, Epyc 9005 Series Processors, Epyc Embedded 9005 Series Processors | 2026-11-12 | N/A |
| Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to forge SEV-TIO guest request messages potentially compromising SEV-SNP guest memory integrity and confidentiality. | ||||
| CVE-2026-0454 | 1 Amd | 3 Epyc 8005 Series Processors, Epyc 9005 Series Processors, Epyc Embedded 9005 Series Processors | 2026-11-12 | N/A |
| An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to corrupt global firmware variables, potentially resulting in loss of integrity. | ||||
| CVE-2026-0435 | 1 Amd | 3 Epyc 8005 Series Processors, Epyc 9005 Series Processors, Epyc Embedded 9005 Series Processors | 2026-11-12 | N/A |
| Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with administrative privileges to swap out a guest device without the guest's knowledge, potentially resulting in a loss of confidentiality and integrity. | ||||
| CVE-2026-124004 | 2026-11-12 | 9.8 Critical | ||
| XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-0003 | 1 Amd | 6 Epyc 7003 Series Processors, Epyc 8004 Series Processors, Epyc 9004 Series Processors and 3 more | 2026-11-12 | N/A |
| Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted Virtualization (SEV) firmware and exploit known vulnerabilities to decrypt memory potentially resulting in loss of confidentiality. | ||||