Export limit exceeded: 417644 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (417644 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116641 | 1 Mongodb | 1 Database Tools | 2026-10-29 | 6.8 Medium |
| The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store. However, the crypto/x509 package also has its own internal denylist of known-bad CA certificates. Golang 1.27.3 adds the eMudhra certificates to this list. DB Tools version 100.19.0 was compiled with Golang 1.26.8, which does not include this check. The issue is resolved by updating to Golang 1.27.3 in DB Tools 100.20.0 | ||||
| CVE-2026-116071 | 1 Rotki | 1 Rotki | 2026-10-29 | 5.9 Medium |
| rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history. | ||||
| CVE-2026-116067 | 1 Ananthakumaran | 1 Paisa | 2026-10-29 | 8.2 High |
| Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory. | ||||
| CVE-2026-116052 | 1 Linkstackorg | 1 Linkstack | 2026-10-29 | 4.3 Medium |
| A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-116048 | 1 Krupalshah | 1 Employeerecruitmentsystem | 2026-10-29 | 7.3 High |
| A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the argument firstname/middlename/lastname/gender/birthdate/state/statespecify/city/cityspecify results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-116045 | 1 1999azzar | 1 Designer-mcp | 2026-10-29 | 4.3 Medium |
| A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The patch is identified as c8c2951dcbed9b1710a745993f028317f10a3f10. Applying a patch is advised to resolve this issue. | ||||
| CVE-2026-116018 | 1 Onearmy | 1 Community-platform | 2026-10-29 | 4.3 Medium |
| ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows authenticated users to mark other users' notifications as read via POST /api/notifications/:id/read. Attackers can iterate sequential notification IDs to suppress unread indicators of users in the same tenant, causing them to miss replies, comments and new-content notices. | ||||
| CVE-2026-116006 | 2 Yunaiv, Zhijiantianya | 2 Ruoyi-vue-pro, Ruoyi-vue-pro | 2026-10-29 | 7.3 High |
| A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-115999 | 1 Mansi-k | 1 Restaurant Ims | 2026-10-29 | 7.3 High |
| A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-115995 | 2 Unitree Robotics, Unitreerobotics | 2 Unitree Go2, Unitree Go2 | 2026-10-29 | 9.6 Critical |
| A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be launched remotely. Upgrading to version 1.1.11.5 is sufficient to resolve this issue. You should upgrade the affected component. The vendor confirmed early: "Submission 990502 corresponds to our internal ticket #474 (Go2 chat_go set_volume OS command injection, CWE-78)." | ||||
| CVE-2026-115973 | 1 Faveosuite | 2 Faveo-helpdesk, Faveo Helpdesk | 2026-10-29 | 7.3 High |
| A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak password recovery. The attack may be initiated remotely. The vendor was contacted early about this disclosure. | ||||
| CVE-2026-115970 | 1 Travisun | 1 Opptrix | 2026-10-29 | 7.3 High |
| A vulnerability has been found in Travisun Opptrix 0.4.0. This impacts an unknown function of the file /api/system-update/import of the component Import Endpoint. Such manipulation leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project has been completely taken offline and deprecated. The project maintainer explains: "The mentioned security risk was a design flaw that manifested primarily in local environments during earlier stages of version development. We previously addressed and resolved this specific risk; however, because the project was restricted to a small learning scope and the main versions were intended to run exclusively on localhost, the security fix was only pushed directly to our GitHub repository before it went private." This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-100132 | 1 Adobe | 1 Acrobat For Edge | 2026-10-29 | 4.3 Medium |
| Acrobat for Edge is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to disclose sensitive information. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. | ||||
| CVE-2026-83785 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 7 High |
| Use after free in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83786 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 4.7 Medium |
| Generation of error message containing sensitive information in Windows NTFS allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-83787 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-10-29 | 5.5 Medium |
| Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-83788 | 1 Microsoft | 28 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 25 more | 2026-10-29 | 4.6 Medium |
| Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack. | ||||
| CVE-2026-118304 | 1 Google | 1 Chrome | 2026-10-29 | 8.8 High |
| Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-118305 | 1 Google | 1 Chrome | 2026-10-29 | 9.6 Critical |
| Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-118306 | 1 Google | 1 Chrome | 2026-10-29 | 9.6 Critical |
| Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | ||||