Export limit exceeded: 55345 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (55345 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-60044 | 2 Helmholz, Mb Connect Line | 4 Myrex24v2 Firmware, Myrex24v2virtual, Mbconnect24 and 1 more | 2026-11-10 | 7.5 High |
| The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access their content. This can result in a total loss of confidentiality. | ||||
| CVE-2026-107364 | 2026-11-10 | 7.5 High | ||
| In all released versions of MIT krb5, an unauthenticated attacker can cause a KDC process to perform a large read overrun, likely causing the process to terminate. | ||||
| CVE-2026-123268 | 1 Libyal | 1 Libvmdk | 2026-11-10 | 3.5 Low |
| A security vulnerability has been detected in libyal libvmdk up to 3fdd7839758e9f44ef95e1dfccde8552b860a4fc. Affected is the function libvmdk_extent_table_get_extent_data_file_path of the file libvmdk/libvmdk_extent_table.c of the component Extent Data File Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The identifier of the patch is 175d3fc0a0b961f362f16e7560a6169d7213e16b. Applying a patch is the recommended action to fix this issue. | ||||
| CVE-2026-124591 | 1 Bahleel | 1 Bahleel | 2026-11-10 | 5.5 Medium |
| A vulnerability was detected in Bahleel 0.1.0/0.1.1. Affected is the function fputcsv of the file app/Exporters/CsvExporter.php. The manipulation results in csv injection. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet. | ||||
| CVE-2026-87056 | 1 Operator-sdk-builder | 1 Operator-sdk-builder | 2026-11-10 | 2.6 Low |
| A flaw was found in operator-sdk-builder. The repository lacks automated dependency-update configurations for its git submodules, Containerfile base image, and Tekton bundle references. This absence prevents the automatic flagging of stale or vulnerable dependencies. Consequently, this could lead to the inclusion of known vulnerable components in the build process, increasing the risk of security exposures. | ||||
| CVE-2026-87060 | 1 Olm-operator-konflux-sample | 1 Olm-operator-konflux-sample | 2026-11-10 | 2.6 Low |
| A flaw was found in olm-operator-konflux-sample. The system's automated merging of updates, known as Renovate automerge, is configured too broadly, allowing a wide range of updates without sufficient scrutiny. Additionally, the critical base image for the catalog, ose-operator-registry, is entirely excluded from this update tracking. This combination creates an inconsistent and potentially insecure update process, increasing the risk of unpatched vulnerabilities being introduced into the system. | ||||
| CVE-2026-93519 | 2 X.org, X.orgg | 3 X Server, Xorg-x11-server, Xwayland | 2026-11-10 | 7.8 High |
| A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland before 24.1.14 could be used by authenticated X clients to crash or potentially execute code in X server context. | ||||
| CVE-2026-93521 | 1 X.org | 3 X Server, Xorg-x11-server, Xwayland | 2026-11-10 | 7.8 High |
| A buffer overflow in RandR ChangeProviderProperty requests in X.Org X Server before 2.1.25 and XWayland before 24.4.14 could be used by authenticated X clients to crash or execute code within the X server context. | ||||
| CVE-2026-44768 | 1 Sap Se | 1 Sap Webclient Ui | 2026-11-10 | 4.1 Medium |
| SAP WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted. | ||||
| CVE-2026-63287 | 2026-11-10 | 6.5 Medium | ||
| It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate permissions, which could be used to tamper with audit log creation in AXIS Camera Station. | ||||
| CVE-2026-13312 | 2026-11-10 | 9.9 Critical | ||
| A vulnerability that could allow an attacker to compromise a system. | ||||
| CVE-2026-14918 | 2026-11-10 | 5.3 Medium | ||
| The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected. | ||||
| CVE-2026-63282 | 2026-11-10 | 6.5 Medium | ||
| Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which could lead to privilege escalation. | ||||
| CVE-2026-14543 | 2026-11-10 | 3.9 Low | ||
| The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting unauthorized access to protected system resources. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-92697 | 1 Pavel-odintsov | 1 Fastnetmon | 2026-11-10 | 7.5 High |
| FastNetMon is a high-performance DDoS detector and sensor. In version 1.2.9 and earlier, the NetFlow v9 collector calls strlen() on an attacker-controlled interface-description field without bounding the scan to the field’s declared length. Although fields longer than 128 bytes are excluded from this operation, an accepted field without a null terminator can cause reads beyond the field and packet buffer. An unauthenticated remote attacker who can send crafted UDP packets to the collector can trigger an out-of-bounds read and potentially crash the process, causing denial of service. No fixed release is available as of this review. | ||||
| CVE-2026-73472 | 1 Gstreamer | 1 Gst-plugins-good | 2026-11-10 | 6.1 Medium |
| A flaw was found in GStreamer gst-plugins-good (avidemux). In the superindex and subindex parsers, integer overflow can bypass bounds checks and cause out-of-bounds reads. Because avidemux is auto-plugged by playbin, decodebin, and gst-discoverer, opening or previewing a crafted AVI is sufficient to trigger the issue. Fixed upstream in gst-plugins-good 1.28.6 (GStreamer-SA-2026-0072). | ||||
| CVE-2026-123653 | 1 Esengine | 1 Deepseek-reasonix | 2026-11-10 | 6.3 Medium |
| A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the function discoverDocs of the file internal/memory/doc.go. The manipulation leads to improper neutralization of input used for llm prompting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.53.0 is able to address this issue. The identifier of the patch is 4ca33493a673c2788aa8598fbca2b2f47a69e1b8. It is suggested to upgrade the affected component. | ||||
| CVE-2026-14542 | 2026-11-10 | 6.7 Medium | ||
| The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation. This flaw can only be exploited after authenticating with an admin-privileged service account. | ||||
| CVE-2026-106020 | 1 Johnsoncontrols | 1 Easyio Neo Io Manager And Tools Installer | 2026-11-10 | N/A |
| Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking. This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0. | ||||
| CVE-2026-13409 | 2026-11-10 | 4.3 Medium | ||
| The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality. This flaw can only be exploited after authenticating with an operator or admin-privileged service account. | ||||