Export limit exceeded: 424910 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 424910 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (424910 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-59986 | 2026-11-10 | 7.4 High | ||
| rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to version 0.17.0, the bounds check (*offset = o + len) <= encoded.len overflows when o + len > SIZE_MAX on 32-bit systems. len is a uint32_t read from the AMQP wire as a BYTES/UTF8 field length. The overflow wraps the check to a small value that passes, producing a decoded amqp_bytes_t with a multi-GB .len pointing into a small frame buffer. This results in an out-of-bounds read of up to ~4GB of process memory on 32-bit systems (ARM, MIPS, x86 ILP32, embedded IoT AMQP clients). Enabling information disclosure or denial of service. Not exploitable on 64-bit systems where size_t is 64-bit. This issue has been patched in version 0.17.0. | ||||
| CVE-2026-57907 | 1 Watchguard | 1 Endpoint Security | 2026-11-10 | N/A |
| A privilege escalation vulnerability in WatchGuard Endpoint Protection's inter-process communication between the console and the protection service allows a local, low-privileged authenticated user to execute arbitrary code with SYSTEM privileges by injecting code into the trusted console process and issuing privileged commands to the service. | ||||
| CVE-2026-17437 | 1 Ibm | 1 App Connect Enterprise | 2026-11-10 | 5.5 Medium |
| IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction. | ||||
| CVE-2026-17355 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.2 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information from internal network resources due to server-side request forgery. Destination checks on outbound requests can be bypassed, which could allow the server to reach internal systems that should be blocked. | ||||
| CVE-2026-17352 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. | ||||
| CVE-2026-17334 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorization via user-controlled keys. | ||||
| CVE-2026-17330 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. | ||||
| CVE-2026-17325 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. | ||||
| CVE-2026-17304 | 1 Ibm | 1 Api Connect | 2026-11-10 | 6.4 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation. Locations supplied when service definitions are imported are not sufficiently validated, which could allow the server to retrieve content it should not access. | ||||
| CVE-2026-17188 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to server-side request forgery. When service definitions are imported, references to external resources are not sufficiently restricted, so the server could be made to request resources it should not access. | ||||
| CVE-2026-17187 | 1 Ibm | 1 Api Connect | 2026-11-10 | 8.5 High |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of user-supplied URLs. | ||||
| CVE-2026-17154 | 1 Ibm | 1 Api Connect | 2026-11-10 | 5.4 Medium |
| IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform cross-site scripting due to improper neutralization of user-supplied input. | ||||
| CVE-2026-125757 | 1 Mailcow | 1 Mailcow\ | 2026-11-10 | 9.1 Critical |
| mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain administrators to execute commands in the shared rspamd container by storing a malicious domain-wide footer. Attackers can embed a Jinja macro with an os.execute default value, rendered by the rspamd MOO_FOOTER prefilter, to read or inject mail for every tenant and disable filtering. | ||||
| CVE-2026-125753 | 2026-11-10 | 5.9 Medium | ||
| ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability in DefaultBlobFilePathCalculator that allows unauthenticated attackers to access files outside the blob container. Attackers can send %5C-encoded backslashes through the Blogging api/blogging/files/{name} endpoint on Windows hosts to read files like appsettings.json containing signing keys and connection strings. | ||||
| CVE-2026-125749 | 2026-11-10 | 4.2 Medium | ||
| TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actions.ts that allows authenticated users to modify other users' data by supplying an arbitrary userId. Attackers can invoke Server Actions like deleteCategoryAction or editFieldAction with a victim's UUID to delete categories, clear transaction assignments, or alter LLM prompts. | ||||
| CVE-2026-125745 | 2026-11-10 | 4.3 Medium | ||
| Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attackers with access to any WCK meta box to read custom-field values on posts they cannot edit by exploiting the wck_show_update_form AJAX handler, which lacks the capability checks enforced by other handlers and relies on a shared, non-unique nonce action. Attackers can send a crafted admin-ajax.php request with a valid wck-edit-entry nonce, a target meta key, and an arbitrary post ID to disclose sensitive post-meta or option values belonging to other users, including private or draft post data. | ||||
| CVE-2026-125672 | 1 Redhat | 2 Enterprise Linux, Rhel Els | 2026-11-10 | 6.6 Medium |
| A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user. | ||||
| CVE-2026-125404 | 2 Ettercap, Ettercap-project | 2 Ettercap, Ettercap | 2026-11-10 | 7.5 High |
| Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the 8-byte CCMP trailer without checking minimum length. Attackers on a network whose WPA key is loaded can send a short crafted CCMP frame to overflow a stack buffer in the Ettercap process, which normally runs as root. | ||||
| CVE-2026-125400 | 2 Ettercap, Ettercap-project | 2 Ettercap, Ettercap | 2026-11-10 | 8.8 High |
| Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2 ovector after freeing match data. Network-adjacent attackers can send packets matching a loaded pcre_regex() substitution filter to corrupt memory and potentially execute code as root. | ||||
| CVE-2026-125396 | 1 Artifex | 1 Ghostscript | 2026-11-10 | 7.8 High |
| Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps, which calls the privileged .forceput operator without checking operand types. Attackers can supply crafted PostScript or PDF documents that trigger a type error, recover .forceput via a custom error handler, and cause a use-after-free across save/restore to execute arbitrary code. | ||||