Export limit exceeded: 421761 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421761 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2023-30589 | 3 Fedoraproject, Nodejs, Redhat | 4 Fedora, Node.js, Enterprise Linux and 1 more | 2026-10-08 | 7.5 High |
| The llhttp parser in the http module in Node v20.2.0 does not strictly use the CRLF sequence to delimit HTTP requests. This can lead to HTTP Request Smuggling (HRS). The CR character (without LF) is sufficient to delimit HTTP header fields in the llhttp parser. According to RFC7230 section 3, only the CRLF sequence should delimit each header-field. This impacts all Node.js active versions: v16, v18, and, v20 | ||||
| CVE-2023-22490 | 2 Git-scm, Redhat | 3 Git, Enterprise Linux, Rhel Eus | 2026-10-08 | 5.5 Medium |
| Git is a revision control system. Using a specially-crafted repository, Git prior to versions 2.39.2, 2.38.4, 2.37.6, 2.36.5, 2.35.7, 2.34.7, 2.33.7, 2.32.6, 2.31.7, and 2.30.8 can be tricked into using its local clone optimization even when using a non-local transport. Though Git will abort local clones whose source `$GIT_DIR/objects` directory contains symbolic links, the `objects` directory itself may still be a symbolic link. These two may be combined to include arbitrary files based on known paths on the victim's filesystem within the malicious repository's working copy, allowing for data exfiltration in a similar manner as CVE-2022-39253. A fix has been prepared and will appear in v2.39.2 v2.38.4 v2.37.6 v2.36.5 v2.35.7 v2.34.7 v2.33.7 v2.32.6, v2.31.7 and v2.30.8. If upgrading is impractical, two short-term workarounds are available. Avoid cloning repositories from untrusted sources with `--recurse-submodules`. Instead, consider cloning repositories without recursively cloning their submodules, and instead run `git submodule update` at each layer. Before doing so, inspect each new `.gitmodules` file to ensure that it does not contain suspicious module URLs. | ||||
| CVE-2023-20178 | 1 Cisco | 2 Anyconnect Secure Mobility Client, Secure Client | 2026-10-08 | 7.8 High |
| A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed after a successful VPN connection is established. This vulnerability exists because improper permissions are assigned to a temporary directory that is created during the update process. An attacker could exploit this vulnerability by abusing a specific function of the Windows installer process. A successful exploit could allow the attacker to execute code with SYSTEM privileges. | ||||
| CVE-2022-44729 | 3 Apache, Debian, Redhat | 4 Xml Graphics Batik, Debian Linux, Camel Spring Boot and 1 more | 2026-10-08 | 7.1 High |
| Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16. On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later. | ||||
| CVE-2022-34305 | 1 Apache | 1 Tomcat | 2026-10-08 | 6.1 Medium |
| In Apache Tomcat 10.1.0-M1 to 10.1.0-M16, 10.0.0-M1 to 10.0.22, 9.0.30 to 9.0.64 and 8.5.50 to 8.5.81 the Form authentication example in the examples web application displayed user provided data without filtering, exposing a XSS vulnerability. | ||||
| CVE-2022-2304 | 3 Debian, Fedoraproject, Vim | 3 Debian Linux, Fedora, Vim | 2026-10-08 | 7.8 High |
| Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. | ||||
| CVE-2022-2257 | 2 Fedoraproject, Vim | 2 Fedora, Vim | 2026-10-08 | 7.8 High |
| Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. | ||||
| CVE-2022-2042 | 2 Apple, Vim | 2 Macos, Vim | 2026-10-08 | 7.8 High |
| Use After Free in GitHub repository vim/vim prior to 8.2. | ||||
| CVE-2022-29577 | 2 Antisamy Project, Oracle | 3 Antisamy, Enterprise Manager Base Platform, Weblogic Server | 2026-10-08 | 6.1 Medium |
| OWASP AntiSamy before 1.6.7 allows XSS via HTML tag smuggling on STYLE content with crafted input. The output serializer does not properly encode the supposed Cascading Style Sheets (CSS) content. NOTE: this issue exists because of an incomplete fix for CVE-2022-28367. | ||||
| CVE-2022-27545 | 1 Hcltech | 1 Bigfix Platform | 2026-10-08 | 4.6 Medium |
| BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page. | ||||
| CVE-2022-27544 | 1 Hcltech | 1 Bigfix Platform | 2026-10-08 | 5 Medium |
| BigFix Web Reports authorized users may see SMTP credentials in clear text. | ||||
| CVE-2022-26921 | 1 Microsoft | 1 Visual Studio Code | 2026-10-08 | 7.3 High |
| Visual Studio Code Elevation of Privilege Vulnerability | ||||
| CVE-2022-26878 | 1 Linux | 1 Linux Kernel | 2026-10-08 | 5.5 Medium |
| drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed). | ||||
| CVE-2022-25762 | 3 Apache, Oracle, Redhat | 3 Tomcat, Agile Product Lifecycle Management, Enterprise Linux | 2026-10-08 | 8.6 High |
| If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it has been closed. The error handling triggered in this case could cause the a pooled object to be placed in the pool twice. This could result in subsequent connections using the same object concurrently which could result in data being returned to the wrong use and/or other errors. | ||||
| CVE-2022-24545 | 1 Microsoft | 13 Windows 10, Windows 10 1607, Windows 10 1809 and 10 more | 2026-10-08 | 8.1 High |
| Windows Kerberos Remote Code Execution Vulnerability | ||||
| CVE-2022-24486 | 1 Microsoft | 14 Windows 10, Windows 10 1507, Windows 10 1607 and 11 more | 2026-10-08 | 7.8 High |
| Windows Kerberos Elevation of Privilege Vulnerability | ||||
| CVE-2022-23960 | 4 Arm, Debian, Redhat and 1 more | 45 Cortex-a57, Cortex-a57 Firmware, Cortex-a65 and 42 more | 2026-10-08 | 5.6 Medium |
| Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information. | ||||
| CVE-2022-23958 | 1 Hp | 4 Probook 440 G8, Probook 440 G8 Firmware, Prodesk 405 G6 Small Form Factor and 1 more | 2026-10-08 | 5.5 Medium |
| Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. | ||||
| CVE-2022-23957 | 1 Hp | 4 Probook 440 G8, Probook 440 G8 Firmware, Prodesk 405 G6 Small Form Factor and 1 more | 2026-10-08 | 5.5 Medium |
| Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. | ||||
| CVE-2022-23956 | 1 Hp | 4 Probook 440 G8, Probook 440 G8 Firmware, Prodesk 405 G6 Small Form Factor and 1 more | 2026-10-08 | 5.5 Medium |
| Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. | ||||