Export limit exceeded: 410867 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (410867 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112177 | 2 Ghostscript, Redhat | 2 Ghostscript, Enterprise Linux | 2026-10-20 | 7.3 High |
| A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 8. The correction for CVE-2019-14869 was omitted during the rebase from version 9.25 to 9.27, leaving privileged .forceput operations in the .charkeys procedure insufficiently protected. Processing a specially crafted PostScript file may allow an attacker to bypass -dSAFER restrictions and access files outside the permitted paths or execute commands with the permissions of the Ghostscript process. | ||||
| CVE-2026-107805 | 2 0xjacky, Nginxui | 2 Nginx-ui, Nginx Ui | 2026-10-20 | 7.5 High |
| Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary file staging of an attacker-controlled request body and synchronizes it before validating the body digest and cryptographic signature. An unauthenticated remote client that can reach the API and provide syntactically valid signature metadata can consume temporary filesystem capacity, disk input and output, and request-processing resources before rejection. The issue affects availability and does not bypass authentication or provide confidentiality or integrity impact. This issue is fixed in version 2.6.0. | ||||
| CVE-2026-111088 | 1 Stormshield | 1 Stormshield Network Security | 2026-10-20 | 6.5 Medium |
| A Stored Cross-Site Scripting vulnerability exists in the SNS VPN log monitoring screen. | ||||
| CVE-2026-112248 | 1 Grandnode | 2 Grandnode, Grandnode2 | 2026-10-20 | 4.7 Medium |
| A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated remotely. Upgrading to version 2.4.0 will fix this issue. The identifier of the patch is 2abbaed232080ad74949c6f35581f0351e309972. It is suggested to upgrade the affected component. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-112252 | 1 Wuxi Wubang Security Software | 2 Five-in-one Safety Production Management Information System, Wubang Five-in-one Safety Production Management Information System | 2026-10-20 | 7.3 High |
| A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-107806 | 2 0xjacky, Nginxui | 2 Nginx-ui, Nginx Ui | 2026-10-20 | 7.2 High |
| Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching manifest to POST /api/restore. The restore flow trusts the supplied key, decrypts attacker-controlled contents, and replaces the live app.ini, including protected nginx command settings such as TestConfigCmd. Triggering POST /api/nginx/test then executes the restored command in the Nginx UI runtime context, affecting confidentiality, integrity, and availability. This issue is fixed in version 2.5.0. | ||||
| CVE-2026-112712 | 2026-10-20 | 9.1 Critical | ||
| @fastify/middie is the Express-style middleware engine for Fastify. In versions from 9.0.0 through 9.3.5, the use() function joined a path-scoped middleware's mount path to the plugin scope prefix in a way that could diverge from the path Fastify's router serves, most often when the scope prefix ended in a slash, and also for array mount paths and for mount paths written without a leading slash. When the two paths disagreed, the middleware was silently skipped while the route handler still ran, so path-scoped middleware such as authentication, authorization, or rate limiting could be bypassed by a single unauthenticated request. The issue is fixed in @fastify/middie 9.3.6, and users should upgrade to 9.3.6 or later. As a workaround, enforce authorization in a Fastify hook such as preHandler that runs after the router has resolved the request. | ||||
| CVE-2026-109679 | 1 Freerdp | 1 Freerdp | 2026-10-20 | 5.3 Medium |
| FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 200 body. Attackers controlling the configured ARM gateway can return a zero-length body to pass NULL to strnlen and crash the connecting client. | ||||
| CVE-2026-112148 | 1 Ly Corporation | 1 Liff Sdk | 2026-10-20 | N/A |
| A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session. | ||||
| CVE-2026-112238 | 1 Typo3 | 1 Extension File Manager | 2026-10-20 | N/A |
| The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query. This allows an attacker to read data from the database. The issue affects every searched field. | ||||
| CVE-2026-111844 | 2 Brizy, Wordpress-extensions | 2 Brizy, Brizy | 2026-10-20 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy allows Stored XSS.This issue affects Brizy: 2.8.23. | ||||
| CVE-2026-108062 | 1 Eclipse | 1 Eclipse Pia | 2026-10-20 | N/A |
| Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service. | ||||
| CVE-2026-107597 | 1 Eclipse | 1 Eclipse Pia | 2026-10-20 | N/A |
| PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the field is non-empty (`pia/oidc.py:42-52`). An approved identity provider — and every registered per-project Jenkins instance under `https://ci.eclipse.org/<project>/oidc` is a separate such party (`pia/models.py`) — can therefore direct PIA to issue a GET request to an arbitrary host and port, including over plaintext `http`, from PIA's own network position. The fetch happens before any signature is verified, as a side effect of an unauthenticated `POST /v1/upload/sbom` request that is ultimately rejected with 401. | ||||
| CVE-2026-108086 | 1 Apache | 1 Cocoon | 2026-10-20 | N/A |
| ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted external system As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108087 | 1 Apache | 1 Cocoon | 2026-10-20 | N/A |
| ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. Missing input sanitation would allow arbitrary SQL injection through the SQL processor or sql:/esql: logicsheets. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108088 | 1 Apache | 1 Cocoon | 2026-10-20 | N/A |
| ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-108089 | 1 Apache | 1 Cocoon | 2026-10-20 | 7.5 High |
| ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and profile information. This issue affects Apache Cocoon: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-112833 | 2 Castos, Wordpress-extensions | 2 Seriously Simple Podcasting, Seriously Simple Podcasting | 2026-10-20 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0. | ||||
| CVE-2026-112834 | 2 Castos, Wordpress-extensions | 2 Seriously Simple Podcasting, Seriously Simple Podcasting | 2026-10-20 | 5.3 Medium |
| Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0. | ||||
| CVE-2026-109700 | 2 Elightup, Wordpress-extensions | 2 Meta Box – Wordpress Custom Fields Framework, Meta Box | 2026-10-20 | 6.5 Medium |
| Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: from n/a through 5.15.2. | ||||